471–480 of 705 posts
I'm from Missouri, this might be the first embarrassment many of you've seen from him, but there have been alot more prior. Truly not a good look for the state that this guy got reelected.
Same here. And don't look up how he first came upon the job either.
From the article, it sounds like nothing even remotely questionable was done by the reporter who found the flaw: > "According to the Post-Dispatch, one of its reporters discovered the flaw in a web application allowing the public to search teacher certifications and credentials. No private information was publicly visible, but teacher Social Security numbers were contained in HTML source code of the pages."
Translation: search for a certification on the public website, receive an SSN in response. Only 'hacking' by reporter was to then press 'Ctrl+U' in the browser and read the characters.
I try to be an optimistic person, I really do. I try to remind myself that the sky isn't literally falling, and that the world is a more generally pleasant and peaceful place today than what it has been throughout much of history. But. Every time I see something like this, it just about drains my spirit to nothingness. I want to embrace nihilism and just quit giving a fuck about anything or anybody when I see stupidi…
I'm with you. It is really hard. First big wake up call was Brexit and the election of DJT. Are my countrymen really willing to shit on dedicated public servants and throw away the foundation of our remarkably safe and prosperous world? Sadly, yes, and the europeans are just as eager; madness everywhere. I stepped out of public engagement for a while, then moved to Portland when I was ready to get back in. That was a…
Democracy is a convenient way for the ruling class to hand-pick the people who are allowed to run for office and blame the voters for any bad results. There's research showing that there's very little correlation between the policy goals of the voting public and policy outcomes, but there's a strong correlation between policy goals of the ruling class and policy outcomes.
Earlier quoted context omitted.
There were cia.gov email addresses in there too. When these guys don't get a joke and fixate on you, they really fixate on you. They are more clingy than that song.
Redacted.
Earlier quoted context omitted.
People of all ages suffer from confirmation bias. Analogies can be useful because they allow someone to appreciate the logic of an argument while temporarily dissociating from strongly-held opinions. After the framing moves back to the question under debate, the logic might stick. At least all parties might understand everyone’s perspective better after a few analogies are exchanged.
Not if everyone constantly shifts the analogy so their argument still works ;)
So the argument is a heist occurring on a train, so we've got the thing that we're trying to heist (which would be our point) and then we're shifting it from one car to another. And some of the analogies here are clearly like passenger coaches, but others are more like those... coal transporting car, whatever they are called... and at some point we move to the inappropriate railroad car and drop the point in the coal which obscures it.
Anyway, the point is that at some point you really just hope that some conventional train robbers will show up and derail the whole thing because it has gotten too convoluted to follow.
Earlier quoted context omitted.
It's a public website. If we have to use the doors analogy, these are doors at City Hall, not people's houses.
And it's a public street. It's what inside the houses (URLs) that is not public.
A url is not a door, but an archway, or possibly a door frame.
Earlier quoted context omitted.
So his issue was not that you discovered the bug. His issue was that after discovering it, you went on to view a bunch of other people's data. What you did was walk down the block, pull on the doors of random houses, and if you found one unlocked, went in and took a look around. If you found my door unlocked and left me a note, I would be grateful. If you went in and took a look around, then did it to all of my neigh…
This was not an "unlocked door". This was going to the doctor's office, and while sitting in the room with your files, seeing a bunch of other patient files just left on the desk in eyesight. Not in an unlocked filing cabinet, not in an envelope, but in the open. Changing a URL is not "malicious use" nor is it considered doing something you're not supposed to. As a web client, I should be able to change or manipulate…
...and then proceeding to rifle through a bunch of those files to satisfy your curiosity.
Finding a vulnerability and reporting it -> Good
Continuing to exploit the vulnerability after you've found it just to satisfy your curiosity -> Bad
Somebody who's been out of touch for the past 20 years could easily see responsible disclosure as the beginning of an extortion attempt. "I can access your data and I'll publish sensitive information about it in 30 days." sounds like it's about to be followed up with "...unless you send me a pile of money in unmarked bills".
Earlier quoted context omitted.
> ... someone from their IT department rang me on the phone and started grilling me about how many other plans I browsed, and insisted that I clear my cache and browsing history, and notified me that they would be watching to make sure nobody at our IP address didn't access any other plans while the issue was being fixed. An IT employee who doesn't know about VPNs. Sigh.
Maybe he was hoping OP didnt know about VPNs, it's not an uncommon scare tactic to imply being tracked is unavoidable.
After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…
How is it a bad response? They want to know what data has been exposed and ensure you delete that data. That's data leak 101. Why would you be defensive about it?
Instead of a normal company having a bug bounty and sometimes even with cash prizes.
Do you think google "will watch your IP" after you reported a bug? or will they give yo money?
What helps in the short run? and what helps in the long run?