Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governor vows criminal prosecution of reporter who found flaw in state website

missouriindependent.com

Post reply on HN
Print view View original

441–450 of 705 posts

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#441

Post by mcbutterbunz »

_dain_ wrote: post #362
michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

People have gone to jail for incrementing integers in URLs like that (most famously, weev).

Didn't he also give the data he found to Gawker before notifying AT&T of the issue? That seems like a pretty key difference here, but I don't know what weev was charged and convicted for.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#442

Post by Spivak »

dragonwriter wrote: post #286
bawolff wrote: post #202

Earlier quoted context omitted.

In real life, if you do it under false pretenses, you are. In this analogy the real-world version would be considered fraud.

> In real life, if you do it under false pretenses, you are. Sure, but how is that relevant? What material false representation was made which was relied on in deciding to provide the data?

Because servers don't decide anything. They're autonomous systems imperfectly carrying out the will of humans who make the actual authorization decisions. If a computer system erroneously prints an extra 0 on a check mailed out to you that doesn't mean you get to keep the money because the computer isn't the entity that decides how much money you're owed.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#443

Post by bee_rider »

rpdillon wrote: post #318
bawolff wrote: post #202

Earlier quoted context omitted.

In real life, if you do it under false pretenses, you are. In this analogy the real-world version would be considered fraud.

Not sure I see how. More like the records office decided that, rather than staffing the front desk to handle records requests, they instead just dumped an unlocked filing cabinet into an alcove off the hallway with an arrow pointing to it labelled "Health Care Plans". Essentially identical to blaming users for finding an unsecured S3 bucket or MongoDB instance: it's on the operator to secure the data.

It is more like the records office decide that, but didn't tell the people who they were holding records for that they didn't feel like staffing the desk. The records office is of course 99% to blame for their incompetence here, but it is still a bummer for the people who trusted them, and better not to look.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#444

Post by theandrewbailey »

dylan604 wrote: post #383
jaywalk wrote: post #344

Earlier quoted context omitted.

Who browses the web with Dev Tools exposed by default? Why do you feel the need to "fix" every web page you look at?

websites attempting to poorly comply with cookie banners and other GDPR regs that block a site from working without accepting something. I just display:none the offending elements and then remove the overflow:hidden. Disabling JS usually works, but sometimes the images in the page are lazy loaded via JS and will not load without.

FYI, that's not the View Source feature.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#445

Post by InitialLastName »

merpnderp wrote: post #167
mcguire wrote: post #140

Earlier quoted context omitted.

Somehow, I have the feeling the St. Louis Post-Dispatch's lawyers are thinking, "Bring it! We haven't had this much fun in ages."

I'm sure the judges likely to see this case are giggling over what they'll say to the state prosecutors.

Having read opinions by federal circuit court judges on technical matters, it's not clear to me that the judges who will see this case are likely to understand the matter any better than the governor.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#446

Post by kelnos »

strofcon wrote: post #309
bawolff wrote: post #284

Earlier quoted context omitted.

Users don't normally construct urls by hand. Wouldn't the equivalent more be like: You filled out some form to request a document from the irs. You give the form to the person they give you the document. You notice they dont check ids, so you change the name on the form, and get someone else's document. This definitely seems to fit the definition of fraud: 380 (1) Every one who, by deceit, falsehood or other fraudule…

But... they didn't change their name on the form. They literally just said "I'm still me, but I want this other file now, please." All company data was, in OPs scenario, made public to any and all authenticated users. There is no way to rationally spin this as a malicious act, in my view.

I don't think simply changing the ID in the URL to see what would happen is itself a malicious act. But, after discovering the vulnerability, OP admitted to continuing to exploit the vulnerability so they could make use of the information they'd gotten, information that they should not have access to. That part of it is actively malicious.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#447

Post by philote »

nonesuchluck wrote: post #106

Why is everyone here acting like the governor is merely stupid? He is not arguing from ignorance, he is arguing in bad faith. Mike Parson wants to feed the narrative that the American free press is the "enemy of the people" because it suits his politics, nothing more. The only message here is "be careful embarrassing fascists."

I wonder if he's trying to "control the narrative" in the hopes that he (or the state) isn't sued for releasing private teachers' data to the public.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#448

Post by hoppla »

codegeek wrote: post #43
dylan604 wrote: post #12

Earlier quoted context omitted.

We've always known that using DevTools was a criminal activity. In fact, the sheer number of people using them places this at criminal conspiracy levels. Better start filing those RICO cases against the browser devs. /s

How dare you did "View Source", you hacker.

Some serious Jedi business going on here

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#450

Post by lloydgrossman »

SamPatt wrote: post #335
kmlx wrote: post #307

Earlier quoted context omitted.

> pretty sure that is just the fascists. i’m not from the US, but is it common in the US to use these kinds of accusations? seems ultra far fetched.

Yes. Most online discourse about politics will eventually have someone claim fascism or make a Hilter reference. If you aren't among one of the two sides it can be humorous to watch at times.

and there's the 3rd response: the enlightened centrist.
Post reply on HN