Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governor vows criminal prosecution of reporter who found flaw in state website

missouriindependent.com

Post reply on HN
Print view View original

451–460 of 705 posts

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#451

Post by gwd »

plainnoodles wrote: post #419
soylentnewsorg wrote: post #371

Earlier quoted context omitted.

So his issue was not that you discovered the bug. His issue was that after discovering it, you went on to view a bunch of other people's data. What you did was walk down the block, pull on the doors of random houses, and if you found one unlocked, went in and took a look around. If you found my door unlocked and left me a note, I would be grateful. If you went in and took a look around, then did it to all of my neigh…

I think that's a PRETTY uncharitable analogy and interpretation of the OP's actions. I would say it's more like: You are walking down the street, and notice that there is a public noticeboard. It has a list of names, yours among them, associated with a number of steps each. It instructs you to walk a certain number of steps down the street, and then look up at the paper taped to the sidewalk that many steps down. So,…

> You are walking down the street, and notice that there is a public noticeboard. It has a list of names, yours among them, associated with a number of steps each. It instructs you to walk a certain number of steps down the street, and then look up at the paper taped to the sidewalk that many steps down.

Or perhaps, "Here's a binder with numbered pages; turn to page 345 for your information." You wonder what's on page 346, so you turn the page, and lo and behold, someone else's information.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#452

Post by ripe »

As a hobby, I have been writing little explainers for non-technical people on my blog. I wrote one for this particular incident:

https://www.robotsinplainenglish.com/e/2021-10-14-blame-sham...

I hope HN readers will (gently) correct any mistakes or provide clarifications to make it better. Thanks!

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#453

Post by Talanes »

fshbbdssbbgdd wrote: post #319
Keyframe wrote: post #256

Earlier quoted context omitted.

I think we're all gronw-ups here and don't need analogies here.

People of all ages suffer from confirmation bias. Analogies can be useful because they allow someone to appreciate the logic of an argument while temporarily dissociating from strongly-held opinions. After the framing moves back to the question under debate, the logic might stick. At least all parties might understand everyone’s perspective better after a few analogies are exchanged.

The analogies in this thread are mostly only furthering confirmation bias.

Because any physical analogy is such a poor representation of how a website actually works, everyone just cherry-picks the analogy that demonstrates the logic they believe should apply, and then tries to constrain the argument to that logic via analogy.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#454

Post by olyjohn »

cm2187 wrote: post #392
michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

How is it a bad response? They want to know what data has been exposed and ensure you delete that data. That's data leak 101. Why would you be defensive about it?

Because you have no way of knowing if they deleted the data or not from their system. It's a pointless exercise, unless you're just gonna take their word for it.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#456

Post by kelnos »

Dylan16807 wrote: post #321
bawolff wrote: post #284

Earlier quoted context omitted.

Users don't normally construct urls by hand. Wouldn't the equivalent more be like: You filled out some form to request a document from the irs. You give the form to the person they give you the document. You notice they dont check ids, so you change the name on the form, and get someone else's document. This definitely seems to fit the definition of fraud: 380 (1) Every one who, by deceit, falsehood or other fraudule…

I don't think changing the name is a fair comparison. This definition of fraud doesn't define the word "defraud"? I don't know how I'm supposed to see if it fits or not. It can't mean any action, or going into a store, lying about my name, and asking what aisle has baked beans would fit. Because that has "deceit" and "any service". If I interpret things as the service being minimal and provided for free, so that I'm…

The data in this case clearly had value; OP admitted to continuing to change numbers in the URL to get more information about what plans other companies were signing up for, because that information was valuable to them.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#457

Post by MangezBien »

ModernMech wrote: post #435
MangezBien wrote: post #401

Earlier quoted context omitted.

It doesn't mean I am there illegally though. Maybe I am there for some other reason and I thought you wanted to to let me in.

No one said anything about legality. I'm still going to yell at you to gtfo and never come back again, and I don't see why it would be surprising that I would. Let's drop the metaphor. The original story was that someone accessed a number of documents they weren't supposed to but technically could, and the question was whether or not that it was reasonable that the owners of the documents were upset with that. I argu…

The only person to be upset at is the one who didn't put access control on the site. That was a publically available endpoint. The better analogy is putting something private on a public bulletin board and being mad if someone read something you didn't want them to.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#458

Post by tshaddox »

jonas21 wrote: post #382
mindcrime wrote: post #163

I try to be an optimistic person, I really do. I try to remind myself that the sky isn't literally falling, and that the world is a more generally pleasant and peaceful place today than what it has been throughout much of history. But. Every time I see something like this, it just about drains my spirit to nothingness. I want to embrace nihilism and just quit giving a fuck about anything or anybody when I see stupidi…

> It really is hard sometimes, to not just withdraw into a shell of isolation and decide "fuck it, this world is too damned stupid for me to bother with." In moderation, I think this is actually the correct response. Unless you live in Missouri, who cares what stupid things the Governor of Missouri says? In a previous era, you never would have heard about this story at all. It's just a politician in a minor state try…

> Unless you live in Missouri, who cares what stupid things the Governor of Missouri says?

Because that person literally rules over millions of people, the overwhelming majority of which didn’t vote for him (1.7m votes out of the 6.1m population). Right now he is literally threatening state violence against a reporter for looking at a government website that accidentally leaked personal information.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#459

Post by [deleted] »

MrOrelliOReilly wrote: post #398
soylentnewsorg wrote: post #371

Earlier quoted context omitted.

So his issue was not that you discovered the bug. His issue was that after discovering it, you went on to view a bunch of other people's data. What you did was walk down the block, pull on the doors of random houses, and if you found one unlocked, went in and took a look around. If you found my door unlocked and left me a note, I would be grateful. If you went in and took a look around, then did it to all of my neigh…

Wow. The parent comment did not state they then sifted around for personal data. They checked if there was a bug and found it. For all we know the personal data is front and center, so this rudimentary check also revealed personal information. It’s not like they said they downloaded the SSNs. Good job a miming the ignorance and bad faith of the nameless bureaucrat the parent comment mentioned though, maybe this is ju…

[deleted]

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#460

Post by kelnos »

marcellus23 wrote: post #345
bawolff wrote: post #284

Earlier quoted context omitted.

Users don't normally construct urls by hand. Wouldn't the equivalent more be like: You filled out some form to request a document from the irs. You give the form to the person they give you the document. You notice they dont check ids, so you change the name on the form, and get someone else's document. This definitely seems to fit the definition of fraud: 380 (1) Every one who, by deceit, falsehood or other fraudule…

A closer analogy would be that you keep the name as your name, but change the # of the document you're requesting. It's the IRS's job to ensure you're allowed to retrieve that doc.

Sure, but I guarantee you that if the IRS screwed up and gave you the other doc, and you made use of that information (rather than immediately turning around and saying "um, IRS, I think you made a mistake; this doc doesn't belong to me"), you'd be in trouble as well.
Post reply on HN