Governor vows criminal prosecution of reporter who found flaw in state website • Hacker News Board

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#591

Post by ModernMech » Thu, Oct 14, 2021, 10:57 PM UTC

kmlx wrote: post #532

jeremyjh wrote: post #403

Earlier quoted context omitted.

Right, you don't need any other supporting information and you don't have to bring political parties into it. If a politician is prosecuting a reporter for embarrassing the state - not for committing a crime - they are a fascist.

i don’t think either of you is correct. there are many tenets of fascism, and prosecuting (or straight up imprisoning) journalists is a common occurance in socialist and capitalist countries. by your definition a lot of capitalist and socialist countries around the world are fascist, which is false.

I don't think they meant to imply that all people who imprison reporters are definitionally fascist, but that fascists definitely imprison reporters as a matter of course. The claim was that accusing someone of imprisoning reporters of being fascist is "ultra far fetched". But if imprisoning reporters is something that fascists are wont to do, then it doesn't seem to me that questioning if these people are fascist is "ultra far fetched". You could also want to know if they were socialists if that's the thing you believe socialists do.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#592

Post by cmckn » Thu, Oct 14, 2021, 10:58 PM UTC

0x262d wrote: post #246

idworks1 wrote: post #174

Earlier quoted context omitted.

> echo json_encode($search_results); This is how I found out how much I, and all other contractors were being paid. And also how much the contracting company was actually charging the clients. All the data was being returned in a json but the very little was being displayed. Looking at the story, this is more of a posture thing. I'm sure the Governor is surrounded with people who can tell him that no hacking took pla…

wow, what fraction of websites leak data I want to look at? should I be poking at every non-tech-giant site I go to?

Last year, when a Nintendo Switch was difficult to come by, I found that a large retailer’s API returned exact stock counts (and even restock dates in some cases) for any physical store you wanted. Got a Switch for myself and a couple friends in an afternoon.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#593

Post by datavirtue » Thu, Oct 14, 2021, 10:59 PM UTC

jameshart wrote: post #512

michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

Unfortunately, this is the top comment and it has led to a lengthy discussion about the ethics of altering a url to retrieve a resource you should not have access to. Which is a fascinating discussion, but has nothing to do with the case at hand which is where the underlying html on a publicly accessible search result page contained SSNs of the teachers returned in the search. All the analogies about ‘it’s like askin…

URLs are not secrets. End of discussion.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#594

Post by hn_throwaway_99 » Thu, Oct 14, 2021, 10:59 PM UTC

merpnderp wrote: post #172

mindcrime wrote: post #163

I try to be an optimistic person, I really do. I try to remind myself that the sky isn't literally falling, and that the world is a more generally pleasant and peaceful place today than what it has been throughout much of history. But. Every time I see something like this, it just about drains my spirit to nothingness. I want to embrace nihilism and just quit giving a fuck about anything or anybody when I see stupidi…

It isn't stupidity. Government officials know this kind of thing will ultimately be a loser for them. But they know the mere threat of putting someone through the process of prosecution is punishment enough. This is what we need to work on correcting. If a judge laughs your case out of court, there should be a severe penalty, especially if you're the government.

> It isn't stupidity.

Hard disagree. If you're arguing that it's malice, and not stupidity, on the part of governor and others that put out this nonsense, then at least they are surely depending on the stupidity of their constituents at large for not laughing them out of office.

And to be clear, I'm not at all taking the position that people who don't have a deep depth of technology are stupid. But pretty much everyone in the US knows how to use a web browser these days, and believing people will buy the governor's completely lobotomized argument [1] is totally embarrassing, either for the governor or his constituents that elected him.

1. https://twitter.com/GovParsonMO/status/1448750830857904129

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#595

Post by chefandy » Thu, Oct 14, 2021, 11:01 PM UTC

joshenberg wrote: post #19

Quote from the St Louis Post Dispatch article is even more groan-worthy: "In the letter to teachers, Education Commissioner Margie Vandeven said “an individual took the records of at least three educators, unencrypted the source code from the webpage, and viewed the social security number (SSN) of those specific educators.” I guess webpages are kinda like encryption for idiots.

Nothing, and I mean nothing could give me a grimmer impression of cops' abilities to deal with tech. I guess all of the technically capable cops are busy installing government surveillance systems.

About 12 years ago, someone smashed the window of my car and grabbed my messenger bag, including my cheap prepaid smart phone and shitty laptop— I was a line cook at the time, and those were my most valuable possessions except my knives. Filed a report and moved on. Hours later, I later saw a picture of a person I didn't know standing next to a car with a visible license plate automatically auto-uploaded to my Facebook account from my stolen phone. I called up the detective assigned to the case, but as soon as I said "uploaded" he said I needed to talk to the "computer guy," who called me the next day. After— no shit— 15 minutes of back-and-forth, this expert absolutely could not understand that I wasn't trying to report the new crime of someone accessing my Facebook account without authorization. He had no clue how it possibly could have been related to a telephone. In 2009.

Before I cooked, I'd worked in support from entry-level call centers to code level third-tier support. I am completely confident in my ability to explain WAY more complicated technical ideas to folks who've never used computers before... but I just had to give up. I didn't know what else to do. He was possibly the least technically capable person I've ever encountered and I used to help 90 year olds remove spyware from windows 98 machines. I said never mind and hung up the phone. Depressing.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#596

Post by hn_throwaway_99 » Thu, Oct 14, 2021, 11:03 PM UTC

dghlsakjg wrote: post #584

tshaddox wrote: post #458

Earlier quoted context omitted.

> Unless you live in Missouri, who cares what stupid things the Governor of Missouri says? Because that person literally rules over millions of people, the overwhelming majority of which didn’t vote for him (1.7m votes out of the 6.1m population). Right now he is literally threatening state violence against a reporter for looking at a government website that accidentally leaked personal information.

Grandstanding politicians are one thing. Getting a prosecutor to risk their career on prosecuting a journalist for politics is quite a bit more difficult. Journalists are well aware of their rights, and have lawyers between them and law enforcement. I think its dumb, but as a former photojournalist who had a very large oil company (Haliburton) use a very small police department to come after me for trespassing, I can…

> Grandstanding politicians are one thing.

But that's what's got me so depressed over the past 5 years or so. It used to be, in the not too distant past, that politicians were embarrassed to be caught in an easily demonstrable lie or stupid gaffe.

These days they just yell "fake news", repeat the lie/gaffe louder and more frequently (which is EXACTLY what the governor is doing on Twitter [1]), perhaps maybe pair it with a catchy slogan, and that seems to be a winning strategy.

1. https://twitter.com/GovParsonMO/status/1448750830857904129

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#597

Post by datavirtue » Thu, Oct 14, 2021, 11:04 PM UTC

watchdogtimer wrote: post #494

michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

I found a similar vulnerability in one of our vendors' online order system. I noticed after placing an order an integer in the order confirmation page URL. I reduced it by one and refreshed the page. Sure enough, I got all the order details of the previous customer's sale. Reducing _that_ URL by one got the next previous sale details etc. I notified the company about it. They fixed it, and in gratitude sent me a smal…

I notified the State of Ohio about the unemployment site displaying full blown debug information in error messages (it genuinely errored out on me while doing legit stuff). The amount of information was very interesting and detailed, basically begging a malicious actor to probe further. I sent screenshots and a detailed writeup about what my next moves would be if I were a "hacker" straight to the CISO/CTO and their boss (my info is in that system!). No response...thankfully.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#598

Post by fpgaminer » Thu, Oct 14, 2021, 11:12 PM UTC

e-clinton wrote: post #590

Someone once took a photo in a hospital waiting room. There was a screen in the photo with a browser window that listed the queue of patients waiting to be seen (first name + last initial). I zoomed into the photo, typed the URL in my home machine and sure enough, the list of patients actively waiting to be seen loaded up. To make matters worse, incrementing a number in the URL cycled through different hospital waiti…

Similarly, but much smaller potatoes: Went to pick up an order at Ikea and their online queue system lists your place in line. Nice. Except it also lists everyone else in line. Including their first name, last initial, and make and model of car. And I could still access the list after we left.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#599

Post by kova12 » Thu, Oct 14, 2021, 11:13 PM UTC

e-clinton wrote: post #590

Someone once took a photo in a hospital waiting room. There was a screen in the photo with a browser window that listed the queue of patients waiting to be seen (first name + last initial). I zoomed into the photo, typed the URL in my home machine and sure enough, the list of patients actively waiting to be seen loaded up. To make matters worse, incrementing a number in the URL cycled through different hospital waiti…

Post a URL here, then I'm sure vendor would reconsider

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#600

Post by r1ch » Thu, Oct 14, 2021, 11:14 PM UTC

0x262d wrote: post #246

idworks1 wrote: post #174

Earlier quoted context omitted.

> echo json_encode($search_results); This is how I found out how much I, and all other contractors were being paid. And also how much the contracting company was actually charging the clients. All the data was being returned in a json but the very little was being displayed. Looking at the story, this is more of a posture thing. I'm sure the Governor is surrounded with people who can tell him that no hacking took pla…

wow, what fraction of websites leak data I want to look at? should I be poking at every non-tech-giant site I go to?

With the move to client-side rendering, too many. The backend becomes dumber and dumber and all logic such as filtering data moves to the frontend. You'd be surprised what you can find poking around at APIs that client-side apps use.