Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Governor vows criminal prosecution of reporter who found flaw in state website

missouriindependent.com

Post reply on HN
Print view View original

661–670 of 705 posts

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#661

Post by _0ffh »

mindcrime wrote: post #177
_0ffh wrote: post #34

I don't think I can blame a politician for being technically illiterate, especially one that old. But what the heck is up with the state bureaucrats who report to that guy? I mean someone it the freaking state bureaucratic hierarchy should at least be lucid enough to consult someone who has an actual clue about things as these.

I don't think I can blame a politician for being technically illiterate, especially one that old. I don't think age should excuse this guy at all, nor do I buy into the meme that age has much of anything to do with technical literacy. Consider that Brian Kernighan is ~78, Tim Berners-Lee is 66 (the same age as Governor Parsons here), James Gosling is also 66, Rob Pike is 65, Steve Wozniak is 71, Geoffrey Hinton is 73…

Nobody tries to deny that old people can be top notch computer scientists. It's just a fact that computer technology has only arrived in the daily life of the greater population a few decades ago and therefore older people are statistically less likely to be familiar and comfortable with it the way younger people are. I'm surprised I have to write this.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#662

Post by taejo »

Tepix wrote: post #340
qwertox wrote: post #230

Earlier quoted context omitted.

All this reminds me of the case of Lilith Wittmann [1], who got sued by the CDU (Germany's majority-holding party) in May 2021 because she discovered a security flaw in their election campaign app "CDU connect". Data from around 100.000 visitors and 18.500 election campaign helpers was not sufficiently secured. She used responsible disclosure to let the CDU know of this flaw, got sued in response. After an outcry fro…

The CDU party no longer holds the majority :-)

No party ever held a majority in the Federal Republic of Germany. But the CDU was the largest party in the previous parliament, and part of the governing majority.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#663

Post by alpaca128 »

Spivak wrote: post #624
alpaca128 wrote: post #607

Earlier quoted context omitted.

> This is more like someone giving you key to a filing cabinet in order to retrieve some documents No. It's like someone asking you what you need, you telling them "I want all my documents and the ones from my neighbours because I feel like it", and them proceeding to hand you everything you asked for neatly collected in a folder.

You’re still ascribing agency and authority to a fancy vending machine. The server has absolutely zero authority to grant you authorization to the documents. It can only grant you access. The servers are not representatives of the government or the site-owners, they are just machines. And just because the vending machine is broken and works without you paying doesn’t make it not stealing.

The fact that the server cannot make decisions that were not predetermined is exactly why the responsibility for its behaviour lies with the people running it. They make the rules, they are the ones whose job it is to read the manual. And when someone makes a technically valid request (instead of, say, SQL injection attacks) it's not the user's fault for an incorrect response. They might not even be aware that they're not allowed to do a specific request: it's reasonable to assume IDs in the URL are not sensitive information, as URLs are public and unprotected by default.

Of course it's on the user if they know they're not supposed to have access to some info and they use it to their advantage regardless. If they're a nice person they'll even report the issue (though less likely after news like this).

> just because the vending machine is broken and works without you paying doesn’t make it not stealing

So if it's broken and doesn't work despite me paying, does that make my payment a donation? No. Though it probably is theft if I knowingly abuse the error for profit.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#664

Post by jessaustin »

mbg721 wrote: post #387
kmlx wrote: post #307

Earlier quoted context omitted.

> pretty sure that is just the fascists. i’m not from the US, but is it common in the US to use these kinds of accusations? seems ultra far fetched.

Just think how much trouble we would have saved if only we'd been able to call Mussolini a Fascist in the 30s.

Mussolini called himself a fascist, and certainly didn't mind when everyone else did as well.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#665

Post by jessaustin »

handrous wrote: post #275
jeremyjh wrote: post #194

Earlier quoted context omitted.

Missouri is not even remotely considered to be in "the south". At least not by those who live there or in neighboring states.

I know a lot of people who regard it as a hybrid southern/midwestern state. Plenty of confederate flags to be found in Missouri, certainly, and the MU/KU rivalry is, on our side at least, heavy on "bleeding Kansas" rhetoric and imagery, which keeps Missouri's Southern-sympathizing role in the war alive in our popular culture (such as it is). Lots and lots of our local icons, oft-mentioned historical figures, et c., r…

County seats with those late-addition cheap confederate soldier memorial-statutes outside the courthouse are, AFAIK, quite common in the state.

This seems libelous. Can you provide a single example of such a statue? I drive through several county seats in Missouri multiple times a week. There are WWII and Vietnam memorials, and actually several Civil War Union memorials, but not a single confederate memorial.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#666

Post by Ginden »

Spivak wrote: post #640
tremon wrote: post #634

Earlier quoted context omitted.

Yes, how could anyone assume that the ATM down the street can be acting as an authoritative representative of your bank when you insert your card? That's just silly. /s

But that’s exactly right! It’s not. If the machine has a bug and reports the wrong balance or gives you too much or not enough money on withdrawals it’s explicitly not authoritative and you can get it corrected by an actual representative of the bank.

If human in government office has a bug and reports wrong result when queried, it can be corrected by their higher-up.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#667

Post by sfoley »

michael_michael wrote: post #124

After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…

There is a 0% chance this story is true.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#668

Post by beezischillin »

The government of my country passed a law requiring all companies to provide some documentation yearly under the threat of giant fines for noncompliance. Unfortunately the first year it was due was last year, and that complicated things so as governments do they opened up their pockets and paid bug for this upload form.

My friend attempted to submit his and when he tried to download the paperwork that needs filing he discovered that not only was it very slow but they basically threw a webserver at a Windows PC’s C drive and turned indexes on and proxied it into a subfolder. So he could browse the entire computer and similarly could access the private data of every employer and their employees in the country. He wrote a few emails to relevant places and by the next day the entire thing was offline. I believe they never put it back up, and I know for sure they delayed applying the law by an entire year, maybe through some emergency decrees or idk. They didn’t really publicise it outside of saying that it’s been delayed. You now have to submit it in person.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#669

Post by FrodoB »

taejo wrote: post #662
Tepix wrote: post #340

Earlier quoted context omitted.

The CDU party no longer holds the majority :-)

No party ever held a majority in the Federal Republic of Germany. But the CDU was the largest party in the previous parliament, and part of the governing majority.

There is by definition almost always a party holding a relative majority (more seats than any other party), which the CDU did for the longest time.

You are correct that they did not hold an absolute majority (more seats than everybody else combined), ensuring that they always had to form a coalition to achieve that.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#670

Post by gwd »

soylentnewsorg wrote: post #642
gwd wrote: post #451

Earlier quoted context omitted.

> You are walking down the street, and notice that there is a public noticeboard. It has a list of names, yours among them, associated with a number of steps each. It instructs you to walk a certain number of steps down the street, and then look up at the paper taped to the sidewalk that many steps down. Or perhaps, "Here's a binder with numbered pages; turn to page 345 for your information." You wonder what's on pag…

Which as I said would be perfectly fine. You then tell the owner of the binder that confidential information for other people is in the binder, and you get gratitude. If once you find the information on page 346, you then keep flipping and looking at people's private information on the next hundred pages like the OP did, you have now committed a crime. The fact that you can easily access something, does not give you…

> If once you find the information on page 346, you then keep flipping and looking at people's private information on the next hundred pages like the OP did, you have now committed a crime.

I agree that morally, the guy should certainly not have continued to look through what he knew was private information he wasn't meant to have access to. I'm not sure the law sees a difference between looking at pages 347-350 and and looking at page 346 however.

Post reply on HN