Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governor vows criminal prosecution of reporter who found flaw in state website

missouriindependent.com

Post reply on HN
Print view View original

361–370 of 705 posts

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#361

Post by CountDrewku »

javajosh wrote: post #135
_0ffh wrote: post #34

I don't think I can blame a politician for being technically illiterate, especially one that old. But what the heck is up with the state bureaucrats who report to that guy? I mean someone it the freaking state bureaucratic hierarchy should at least be lucid enough to consult someone who has an actual clue about things as these.

I can't stress how differently power works in the Southern States (EDIT: Missouri is a midwestern state officially, but I've always considered it part of the South). It's a very traditional place, where you do not dare contradict, let alone correct, your boss. There is none of this "avoid surrounding yourself with sycophants because they will only tell you what you want to hear" business. There is no upside to speaki…

If you think that's a "southern" trait I've got news for you...

This attitudes fits the majority of workplaces. I know it probably makes you feel better to pass the blame off on a specific group that you can try to avoid but I've worked all over the US and it's the same crap everywhere you go.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#362

Post by _dain_ »

michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

People have gone to jail for incrementing integers in URLs like that (most famously, weev).

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#363

Post by bastardoperator »

The only crime here is that this uninformed governor is going to spend taxpayer dollars and time to chase ghosts. His staff are either terrible, or this is all political theatre. I don't expect everyone to understand the internet at a technical level but no one under this guy could explain that this is a Missouri problem not a hacker problem?

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#364

Post by alexjplant »

dylan604 wrote: post #12
mdek wrote: post #3

From the article, it sounds like nothing even remotely questionable was done by the reporter who found the flaw: > "According to the Post-Dispatch, one of its reporters discovered the flaw in a web application allowing the public to search teacher certifications and credentials. No private information was publicly visible, but teacher Social Security numbers were contained in HTML source code of the pages."

We've always known that using DevTools was a criminal activity. In fact, the sheer number of people using them places this at criminal conspiracy levels. Better start filing those RICO cases against the browser devs. /s

The US Government has a STIG (Security Technical Implementation Guide [1], a government-proprietary term for "IT policy") that requires that you disable Dev Tools in IE [2], Edge [3] and Chrome[4]. Their justification (from [1]):

> Information needed by an attacker to begin looking for possible vulnerabilities in a web browser includes any information about the web browser and plug-ins or modules being used. When debugging or trace information is enabled in a production web browser, information about the web browser, such as web browser type, version, patches installed, plug-ins and modules installed, type of code being used by the hosted application, and any back-ends being used for data storage may be displayed

I wish I were making this up.

[1] https://en.wikipedia.org/wiki/Security_Technical_Implementat...

[2] https://stigviewer.com/stig/microsoft_internet_explorer_11/2...

[3] https://www.stigviewer.com/stig/microsoft_edge/2021-02-16/fi...

[4] https://www.stigviewer.com/stig/google_chrome_current_window...

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#365

Post by Miraste »

cortesoft wrote: post #339
formerly_proven wrote: post #180

Earlier quoted context omitted.

I dunno, this seems pretty normal. Just today news broke that in Germany some guy who found a flaw in a web-shop backend leaking the data of hundreds of thousands of people got raided, because the operator reported him to the police - and somehow both police and state attorney found it wise to prosecute him instead of referring the case to the GDPR officer to fine the operator. It's pretty obvious that when you find…

Umm, this seems to imply that these security vulnerabilities are intentional, which doesn't seem like what is happening. In your mayor example, you wouldn't go to the mayor because you know he is intentionally trying to break the law, so going to him doesn't make sense. Incompetence is very different than malfeasance.

The problem is that the response, as it pertains to you, is going to be the same for incompetence or malfeasance in a large number of organizations. Consider what the average self-interested politician would do if you uncovered a corruption problem in their administration they did not know about. Are they going to fix the problem, reward you, and risk losing the next election beneath an avalanche of attack ads? Or are they going to bury it and crush you?

Large governments and corporations are not your friends. They will hurt you if it benefits them, often very short-sightedly and regardless of the root problem. There are far too many articles like this one to think "responsible disclosure" is a safe practice. I remember one case where the red team was hired by the agency involved explicitly to perform pentesting, and when they found a vulnerability the government pressed charges!

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#368

Post by saruken »

mindcrime wrote: post #218
natechols wrote: post #181

Earlier quoted context omitted.

Read more history! (Especially read what the Wilson administration did to the Socialists - the origin of the phrase "yelling fire in a crowded theater." Many of us would riot if this happened today.) Stories like this have been happening since long before I was born, and will continue to happen long after I die, because voters will continue to elect stupid people some fraction of the time. The correct response isn't…

The correct response isn't nihilism, but constant vigilance, and constant shaming of elected officials who abuse their powers. I want to believe that, but after watching the Trump administration and how people seemed to embrace him more and more despite his continuing shameful acts, it's just hard to sustain belief that this all leads anywhere. Sorry guys, not trying to be Debbie Downer here. I guess I'm just in a sh…

> it's just hard to sustain belief that this all leads anywhere

I'm with you 100%. I don't want to be there, but there I am. And sometimes it all feels utterly pointless – civilization, the human endeavour, everything. My particular slippery slope goes like this:

    Humanity is going to waste the one-time gift of fossil fuel accreting the already-grotesque hoards of a few hundred individuals. Then these people will die, nothing will have been gained on the whole, and instead of infrastructure which we could have used to pivot to some recognizable future, our descendants will be left with nothing but unrest and some variety of ecological hot potato. And then we will all die out or revert to a pre-technological state, and either way all the gains of science and human ingenuity will be lost.
Is that how yours goes too?

I don't know what to do about all that, but usually I can convince myself that working on some tiny project to help things not go that way is a worthwhile effort. And of course it's pretty much all I can do.

Also here are a couple quotes that help me get out of such perspective ruts:

* "Even though I'm always in pain, it's worth sticking around to make my corner of the world a slightly better place." -Ricky Gervais' character from After Life

* "I cringe at my arrogance. Actually, cringing at my arrogance is just another, more rarified, level of arrogance." -Alison Bechdel

* "Goodness: You got to make it out of badness. Because there isn't anything else to make it out of." -Robert Penn Warren

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#369

Post by bawolff »

dymax78 wrote: post #333
bawolff wrote: post #265

Earlier quoted context omitted.

I used the word "malicious". Its not like i used the word "murderer" or "evil overlord". I'm not saying OP should go to jail or anything. All i'm saying is if you find an exploit, and after you verify it works, you contunue to use it for your own personal ends, you're no longer benign and you shouldn't expect a warm welcome from the security team. The line is when you start to use exploits on computers not owned by y…

> ... and you shouldn't expect a warm welcome from the security team. The appropriate response from the security team (after verification) is to pull the site down or immediately patch the vulnerability, if possible. Making an outbound call to a third-party is pointless and irresponsible.

I imagine having an assertion that the person didn't keep any of the data might be important to legal. (Ianal)

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#370

Post by somebehemoth »

NoGravitas wrote: post #274
mindcrime wrote: post #218

Earlier quoted context omitted.

The correct response isn't nihilism, but constant vigilance, and constant shaming of elected officials who abuse their powers. I want to believe that, but after watching the Trump administration and how people seemed to embrace him more and more despite his continuing shameful acts, it's just hard to sustain belief that this all leads anywhere. Sorry guys, not trying to be Debbie Downer here. I guess I'm just in a sh…

Yeah, even leaving aside the T-word; there's a broad swath of the US population who are willing to believe anything that is expected of them by their chosen authorities (mainstream Democrats are as guilty of this as Republicans, they just chose different authority figures). Sometimes, insanity is the only sane response to an insane world.

> Democrats are as guilty as Republicans

No they aren't. Not even remotely close. I'm exhausted by "both sides". "Both sides" arguments cause apathy in people because what is even the point in voting if, "both sides".

Post reply on HN