Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governor vows criminal prosecution of reporter who found flaw in state website

missouriindependent.com

Post reply on HN
Print view View original

401–410 of 705 posts

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#401

Post by MangezBien »

ModernMech wrote: post #393
jaywalk wrote: post #329

Earlier quoted context omitted.

>if the person letting you in wasn't expecting you and didn't want you there. Then they shouldn't have let you in. How are you completely absolving them of responsibility when all they had to do was say "Who the hell are you? No, you can't come in."

Well, to go with the analogy more: I leave my door unlocked because I'm expecting someone. There's a knock at my door and I yell "Come in" without looking at who is at the door. Not an unreasonable thing, happens all the time. When I finally look, I find you in my house, going through all of my things, for no reason other than you wanted to gain insight on my financial situation. Do I bear responsibility for letting…

It doesn't mean I am there illegally though. Maybe I am there for some other reason and I thought you wanted to to let me in.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#402

Post by __float »

soylentnewsorg wrote: post #371
michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

So his issue was not that you discovered the bug. His issue was that after discovering it, you went on to view a bunch of other people's data. What you did was walk down the block, pull on the doors of random houses, and if you found one unlocked, went in and took a look around. If you found my door unlocked and left me a note, I would be grateful. If you went in and took a look around, then did it to all of my neigh…

"malicious actors" is quite a strong statement, for someone who was not really aiming to harm anyone or get much personal gain from it.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#403

Post by jeremyjh »

Dylan16807 wrote: post #388
kmlx wrote: post #307

Earlier quoted context omitted.

> pretty sure that is just the fascists. i’m not from the US, but is it common in the US to use these kinds of accusations? seems ultra far fetched.

Is prosecuting reporters not, like, definitionally fascist?

Right, you don't need any other supporting information and you don't have to bring political parties into it. If a politician is prosecuting a reporter for embarrassing the state - not for committing a crime - they are a fascist.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#404

Post by vadfa »

Talanes wrote: post #397
soylentnewsorg wrote: post #371

Earlier quoted context omitted.

So his issue was not that you discovered the bug. His issue was that after discovering it, you went on to view a bunch of other people's data. What you did was walk down the block, pull on the doors of random houses, and if you found one unlocked, went in and took a look around. If you found my door unlocked and left me a note, I would be grateful. If you went in and took a look around, then did it to all of my neigh…

It's a public website. If we have to use the doors analogy, these are doors at City Hall, not people's houses.

And it's a public street. It's what inside the houses (URLs) that is not public.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#406

Post by dylan604 »

alexjplant wrote: post #364
dylan604 wrote: post #12

Earlier quoted context omitted.

We've always known that using DevTools was a criminal activity. In fact, the sheer number of people using them places this at criminal conspiracy levels. Better start filing those RICO cases against the browser devs. /s

The US Government has a STIG (Security Technical Implementation Guide [1], a government-proprietary term for "IT policy") that requires that you disable Dev Tools in IE [2], Edge [3] and Chrome[4]. Their justification (from [1]): > Information needed by an attacker to begin looking for possible vulnerabilities in a web browser includes any information about the web browser and plug-ins or modules being used. When deb…

This seems really lazy. Duh, it's gov't, but I'm talking about the attacker. If they can use JS to gather all of that info to display in the console hoping to get a user to read it back to them or whatever, why not just save it all and submit back via ajax?

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#407

Post by kelnos »

rpdillon wrote: post #318
bawolff wrote: post #202

Earlier quoted context omitted.

In real life, if you do it under false pretenses, you are. In this analogy the real-world version would be considered fraud.

Not sure I see how. More like the records office decided that, rather than staffing the front desk to handle records requests, they instead just dumped an unlocked filing cabinet into an alcove off the hallway with an arrow pointing to it labelled "Health Care Plans". Essentially identical to blaming users for finding an unsecured S3 bucket or MongoDB instance: it's on the operator to secure the data.

> Essentially identical to blaming users for finding an unsecured S3 bucket or MongoDB instance

I agree that it's unreasonable to blame users for finding things like that. But if those same users are downloading all the data and making use of it for their own purposes, that's not ok. Finding a vulnerability and reporting it is an admirable thing to do; exploiting that vulnerability yourself is not.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#408

Post by Spivak »

Talanes wrote: post #397
soylentnewsorg wrote: post #371

Earlier quoted context omitted.

So his issue was not that you discovered the bug. His issue was that after discovering it, you went on to view a bunch of other people's data. What you did was walk down the block, pull on the doors of random houses, and if you found one unlocked, went in and took a look around. If you found my door unlocked and left me a note, I would be grateful. If you went in and took a look around, then did it to all of my neigh…

It's a public website. If we have to use the doors analogy, these are doors at City Hall, not people's houses.

Yeah you still can't just walk into the Mayor's office just because it's unlocked. Access isn't authorization.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#409

Post by [deleted] »

soylentnewsorg wrote: post #371
michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

So his issue was not that you discovered the bug. His issue was that after discovering it, you went on to view a bunch of other people's data. What you did was walk down the block, pull on the doors of random houses, and if you found one unlocked, went in and took a look around. If you found my door unlocked and left me a note, I would be grateful. If you went in and took a look around, then did it to all of my neigh…

[deleted]

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#410

Post by what_is_orcas »

n8cpdx wrote: post #351
mindcrime wrote: post #163

I try to be an optimistic person, I really do. I try to remind myself that the sky isn't literally falling, and that the world is a more generally pleasant and peaceful place today than what it has been throughout much of history. But. Every time I see something like this, it just about drains my spirit to nothingness. I want to embrace nihilism and just quit giving a fuck about anything or anybody when I see stupidi…

I'm with you. It is really hard. First big wake up call was Brexit and the election of DJT. Are my countrymen really willing to shit on dedicated public servants and throw away the foundation of our remarkably safe and prosperous world? Sadly, yes, and the europeans are just as eager; madness everywhere. I stepped out of public engagement for a while, then moved to Portland when I was ready to get back in. That was a…

> The politicians are awful, but in a democracy, the fault for that lies 100% with the people.

Yes and no. Yes in that the politicians are selected from people they represent (in theory), but also no in that once a person becomes a politician, their incentives change and they are no longer representing the people that elected them.

Further, once in power, the systems can be "rigged" into maintaining that power (gerrymandering is an example of this). DJT couldn't become King of America without first becoming president. Once he became president, though, he definitely tried to rig the system to make him, effectively, King of America.

Post reply on HN