Gov Parson pushes to prosecute reporter who found security flaw in state site • Hacker News Board

Re: Gov Parson pushes to prosecute reporter who found security flaw in state site

#471

Post by hackersword » Thu, Oct 21, 2021, 7:31 PM UTC

TimTheTinker wrote: post #432

xapata wrote: post #375

Earlier quoted context omitted.

I wouldn't call them moral values, because the values expressed are so context-dependent.

The problem is that the true moral values held don't appear often enough in political speech. I and almost all of my friends and family hold that "humans are created in the image of God, and thus their inalienable rights begin at conception. Therefore abortion at any stage is committing murder against the baby." Not exactly context-dependent, unless I'm missing something. Perhaps you could elaborate?

I would construe your belief to be summarized by "all life has value and should be protected/valued".

The missing context is that your argument seek to protect the baby's life BEFORE birth , but after ... generally speaking the (R)/pro-life stance is pretty weak on social safety net, should the child have adequate (free!) health care, nutrition, etc.

Does that life "deserve" these things when they are only an infant? How about when they are 5-10 ... or 10-20 , or ANY age?

Passing laws to force women to give birth, but then systematically strip and reduce the social safety nets available seems highly context-dependent, and weakens greatly the belief that you "value life"

Re: Gov Parson pushes to prosecute reporter who found security flaw in state site

#472

Post by dane-pgp » Thu, Oct 21, 2021, 7:38 PM UTC

sam0x17 wrote: post #442

snarf21 wrote: post #160

Earlier quoted context omitted.

This is a "no such thing as bad publicity" political tact. If the case doesn't go forward because, you know, the actual 1st amendment, then the next response will be how he is being cancelled by the liberal media. This is mostly signaling to his base that he is out there fighting for them but the other side isn't playing fair.

I think it's more of a "screw gamers/intellectuals/scientists/researchers because my base hates them" tact.

As an aside, seeing the word "tact" used like this is a little disorienting, even if it is a widely used slang form of the word "tactic".

There is the (originally nautical?) term "tack" which means "A direction or course of action, especially a new one.", and it's hard to separate those similar sounding/meaning/looking words.

Re: Gov Parson pushes to prosecute reporter who found security flaw in state site

#473

Post by indig0g0 » Thu, Oct 21, 2021, 7:40 PM UTC

breckenedge wrote: post #36

dreyfan wrote: post #17

The US is so completely and utterly fucked I think it's beyond redemption at this point.

I agree this is a problem, but there are also problems everywhere. The US doesn’t have a monopoly on stupid. We’ve lasted through dumb, inept government before.

Yep, Brazil comes to mind.

Re: Gov Parson pushes to prosecute reporter who found security flaw in state site

#474

Post by tweetle_beetle » Thu, Oct 21, 2021, 7:41 PM UTC

sour-taste wrote: post #358

jonathanwallace wrote: post #144

I served in the Georgia legislature during a portion of a similar story. Without a doubt, the calculations throughout the story were political not technical. In the Georgia version, the technical details of the exposed information in the Secretary of State's office were facepalmingly simple (misconfigured apache directives) yet the story dragged on politically for years. Quickly, a hired security researcher for a cor…

That's insane, thank you for your work. It reminds me of this story in Iowa, where pentesters were arrested and charged with felonies for breaking into a courthouse they were hired to infiltrate: https://darknetdiaries.com/episode/59/

I'm not an expert in this area, but was interested in that story when it happened. Reading commentary from others in the industry suggested that they were, at best, naive in their handling of that contract. Yes charging them was a political act to save face, but they put themselves in that position through ignorance. Quite a different situation from a reporter and responsible disclosure in my opinion.

Re: Gov Parson pushes to prosecute reporter who found security flaw in state site

#475

Post by fighterpilot » Thu, Oct 21, 2021, 7:42 PM UTC

jawns wrote: post #470

fighterpilot wrote: post #175

Earlier quoted context omitted.

The left has its fair share of growing anti-science sentiment. I agree it's quite a bit worse with Republicans but it is growing in both directions, which is a concern. People pick their science a la carte as long as it confirms what they want. - Denial of the science of sex differences - Denial of the science of intelligence differences, the relevance of intelligence in life outcomes and how heritable it is - Belief…

Most of my friends are politically and socially liberal, whereas I'm liberal on some issues, conservative on others, and have a decent number of views that are hard to categorize on a liberal/conservative spectrum. One thing I've noticed about the friends who are dyed in the wool liberals is that they seem to be more susceptible than average to pseudoscientific practices such as reiki, crystals, homeopathy, etc. And…

Yes, there's a niche part of the left - the new age/hippie types, very high in openness and very low in conscientiousness - that is profoundly anti-science (or perhaps just ignorant of it). They tend to buy into woo-woo of all sorts and buy into science denialism around GMOs and synthetic pesticides. They would also never accept the tentative evidence that marijuana damages the brains of teenagers.

Re: Gov Parson pushes to prosecute reporter who found security flaw in state site

#476

Post by jonathanwallace » Thu, Oct 21, 2021, 7:42 PM UTC

TheCondor wrote: post #428

jonathanwallace wrote: post #144

I served in the Georgia legislature during a portion of a similar story. Without a doubt, the calculations throughout the story were political not technical. In the Georgia version, the technical details of the exposed information in the Secretary of State's office were facepalmingly simple (misconfigured apache directives) yet the story dragged on politically for years. Quickly, a hired security researcher for a cor…

Thank you for your service. The other giant thread here made it more directly partisan, this just sounds crazy though. On what rational grounds do you attempt to prosecute or make such things illegal? Is it simply trying to save immediate expenditure of money in a myopic fashion? Or is it more akin to they don't believe it's the state's responsibility to put that data online in the first place so f-it-all-to-hell and…

I'll take your biggest question first.

> In your opinion, is there a way to fix this sort of thing?

Yes, it requires patient, reasonable, intelligent people operating in good faith to sacrifice personal comfort, etc. and get involved in politics.

Politics is literally a zero-sum game when it comes to voting as it is currently structured in most of the United States.*

But when people with the above characteristics get involved, it literally moderates the extremism that we decry. No matter the level (local, state, or federal), whether you decide to run for office, helps others run for office, get involved with a party, or find a particular issue, being involved makes a difference. You may not be able to easily quantify, but it does make an impact. You may also be bringing a critical perspective in short supply to the political process too.

> On what rational grounds do you attempt to prosecute or make such things illegal?

I heard four reasons for the 2017-2018 SB 315 bill.

1. To ensure the next time someone shared a vulnerability that made the state look bad, that a D.A. would have the choice to bring a criminal case (which would obviously color perception of the story). 2. To bring the law into parity with Federal criminal statutes. 3. To give the Attorney General a "tough on cyber crime" campaign plank. 4. The banks were asking for help prosecuting criminals.

Here's the final text of the bill that passed the legislature, https://www.legis.ga.gov/api/legislation/document/20172018/1.... The most relevant text are lines 12-14 and the subsection carve outs on line 16-20.

For further context, voter rolls were already public information and can be acquired via a request to the SoS office.

The larger red flags were the default usernames and passwords in the instructional pdfs for the election systems.

Both of these symptoms (and more) spoke to a woefully underfunded or poorly run office w/r/t to IT.

Getting more funds to have properly, well-secured systems takes political capital and there's not a lot of return of that type of political capital expenditure.

The current SoS has an engineering background and I've been seeing much better public facing systems put in place during their tenure.

*. Please, please, please can we get approval based voting?

Re: Gov Parson pushes to prosecute reporter who found security flaw in state site

#477

Post by jonathanwallace » Thu, Oct 21, 2021, 7:47 PM UTC

opwieurposiu wrote: post #446

jonathanwallace wrote: post #144

I served in the Georgia legislature during a portion of a similar story. Without a doubt, the calculations throughout the story were political not technical. In the Georgia version, the technical details of the exposed information in the Secretary of State's office were facepalmingly simple (misconfigured apache directives) yet the story dragged on politically for years. Quickly, a hired security researcher for a cor…

Wow that is a great story. I am glad there was at least one rep (you) who understood apache configuration.

Heh, understanding apache configuration files just made me facepalm harder and wasn't really critical to seeing the impact on the cybersecurity industry if people aren't able to responsibly disclose.

The important thing was to take the time, speak to the bill's author, speak to my colleagues, build a coalition of lobbyists from industry (big companies, startups, etc.), and not stop fighting the bill even after it passed the legislature.

Re: Gov Parson pushes to prosecute reporter who found security flaw in state site

#478

Post by Domenic_S » Thu, Oct 21, 2021, 7:49 PM UTC

indig0g0 wrote: post #466

MisterBastahrd wrote: post #41

Earlier quoted context omitted.

I've got plenty of life experience that proves that people in power who employ technologically competent people often refuse to listen to expert advice because might makes right. You don't have to be malicious to be incompetent.

Or you don't have to be incompetent to be malicious.

Right, but if they passed the exam that removes their ability to feign ignorance on the record, leaving malice as the de facto motivation (again on the record)

Re: Gov Parson pushes to prosecute reporter who found security flaw in state site

#479

Post by VRay » Thu, Oct 21, 2021, 7:56 PM UTC

sam0x17 wrote: post #447

dang wrote: post #392

Earlier quoted context omitted.

Please do not take HN threads into flamewar, including partisan flamewar. We got intense flamewar hell as a direct result of what you posted, and that's not what this site is for—regardless of how wrong other people are or you feel they are. https://news.ycombinator.com/newsguidelines.html

You might want to update the guidelines (or your reaction to these types of situations) to be consistent, dang. > unless they're evidence of some interesting new phenomenon. This scenario clearly meets those criteria. > Please don't use Hacker News for political or ideological battle. It tramples curiosity. The OP specifically said he wanted to have an intellectual discussion about how anti-intellectuality has recent…

I don't think that's true. We can see in the comments that there was almost no useful discussion. It just immediately devolved into personal attacks with tons of upvotes.

Re: Gov Parson pushes to prosecute reporter who found security flaw in state site

#480

Post by sillysaurusx » Thu, Oct 21, 2021, 7:58 PM UTC

sam0x17 wrote: post #447

dang wrote: post #392

Earlier quoted context omitted.

Please do not take HN threads into flamewar, including partisan flamewar. We got intense flamewar hell as a direct result of what you posted, and that's not what this site is for—regardless of how wrong other people are or you feel they are. https://news.ycombinator.com/newsguidelines.html

You might want to update the guidelines (or your reaction to these types of situations) to be consistent, dang. > unless they're evidence of some interesting new phenomenon. This scenario clearly meets those criteria. > Please don't use Hacker News for political or ideological battle. It tramples curiosity. The OP specifically said he wanted to have an intellectual discussion about how anti-intellectuality has recent…

(Things like this are probably better suited to email. Dan’s team is quite responsive.)

My feeling is that Dan’s decision here is conclusive proof that HN’s mod team is unbiased. I was genuinely concerned that this thread wouldn’t be penalized, because it was political flamewar dressed up as intellectual conversation. It was delightful to see HN’s spirit shine through in spite of political divisions.

Curiosity is a fragile thing. The original comment was entirely ineffective at fostering curiosity, and it’s interesting to analyze why. I think framing has a lot to do with it. There was no attempt made at asking questions, for example. Asking questions in earnest is the hallmark of curiosity.

I don’t think that broadcasting personal feelings to a wide audience was necessary to foster curiosity, either. Quite the opposite: it detracts from the discussion. It’s tricky to express feelings in a way that isn’t divisive, and it’s important for HN comments to become more substantive as the topic becomes more heated.

And you’d be hard-pressed to disagree that the topic became heated, I think. It was a lot match in a gas-filled room, and the explosive subthread was an entirely predictable, deterministic outcome.