Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to own an airline in 3 easy steps and grab the TSA nofly list along the way

maia.crimew.gay

Post reply on HN
Print view View original

351–360 of 677 posts

Re: How to own an airline in 3 easy steps and grab the TSA nofly list along the way

#351

Post by dclowd9901 »

calvinmorrison wrote: post #13
ericpauley wrote: post #10

Earlier quoted context omitted.

Maybe we should or shouldn't, but the potential victims of this aren't just some greedy corporation. Leaking the no fly list could cause irreparable harm to individuals whose names are on it or even similar, causing discrimination by employers and other organizations.

Top secret stazi lists should absolutely be shared. It's why we have 'we have right to know' laws, so the government can't just lock people up in a jail and disappear them.

And then, what, some hapless person on there gets doxxed and some red neck asshole rolls up on their house and shoots them cause ‘Merica? After 9/11 we had these idiots killing brown people left and right just because “they could be terrorists.”

Don’t be so naive. Lists of people are almost inherently dangerous things. I don’t like that a no-fly list exists in the first place but it would be completely irresponsible to just publish it and wash your hands of it.

Re: How to own an airline in 3 easy steps and grab the TSA nofly list along the way

#352

Post by gcbirzan »

ec109685 wrote: post #282

While VPN's shouldn't be the only device, it seems like that should be part of any competent security posture. E.g. Jenkins should only be accessible from known VPN endpoint IP addresses. Administrative IAM's should be IP restricted as well: https://aws.amazon.com/premiumsupport/knowledge-center/iam-r...

And the s3 buckets/dynamodb/whatever other data you store should be vpc restricted. Ours are like this by default, for exceptions (like aws services that run in some internal vpc that's not exposed) you can make an exception per role.

Re: How to own an airline in 3 easy steps and grab the TSA nofly list along the way

#353

Post by niemandhier »

kazinator wrote: post #330
karmaMeansCool wrote: post #289

Earlier quoted context omitted.

It's not good that you are uncomfortable when it asks you to talk about it with its preferred pronouns. It's 2023, it's about time you try to do what it ask you to do. When it tells you its preferred pronouns, try as hard as you can to follow it.

My pronouns are you/your. Whatever you have to say, say it to my face, and not in third person behind my back.

We are a first person singular we user, to celebrate our freedom from the aristocratic yoke.

Re: How to own an airline in 3 easy steps and grab the TSA nofly list along the way

#354

Post by niemandhier »

arp242 wrote: post #225
easrng wrote: post #129

Earlier quoted context omitted.

it isn't a guy and it uses it/its pronouns.

This is downvoted, but the homepage really does say "hello i am maia arson crimew (it/she)". I'd feel uncomfortable referring to anyone as "it" though, as there are some connotations with that :-/

I can understand that feeling.

When English got rid of ‘thou’ and “thine” those were replaced by referring to everyone with the more polite “you“, that surly helped adoption.

Re: How to own an airline in 3 easy steps and grab the TSA nofly list along the way

#355

Post by TheDong »

lamontcg wrote: post #308
woooooo wrote: post #205

Earlier quoted context omitted.

She had only shared it with known journalists that she had a relationship at time of writing, and seems pretty bright. Hypothetically she might get scammed by someone and irresponsibly disclose but let's not condemn her for it yet.

You have an incredibly naive understanding of the propensity for people to divulge secrets. "Three can keep a secret if two of them are dead"

We're talking about a no fly list which every airline in the world has a copy of. There's at the very least hundreds, if not 10s of thousands, of employees of airlines alone that have access to this list.

If people had such an innate propensity to divulge secrets, surely the employees who setup that faulty jenkins server would have already sent you a copy of the no fly list, right?

Re: How to own an airline in 3 easy steps and grab the TSA nofly list along the way

#356

Post by gggggg5 »

tastysandwich wrote: post #200

As a software engineer even I sometimes can't help romanticising hacking in my imagination. But so many times it turns out to be just like some company left the front gate wide open and the "hacker" walked in and took a look around. Eg when an airline had a public API where you could get someone's passport number and details just from their boarding pass https://mango.pdf.zone/finding-former-australian-prime-minis...

Since when are passport numbers supposed to be sensitive information? This isn't something you could use for identity fraud in any normal circumstances.

Re: How to own an airline in 3 easy steps and grab the TSA nofly list along the way

#357

Post by gambiting »

dehrmann wrote: post #325
distortionfield wrote: post #235

Earlier quoted context omitted.

If they ask for it :shrug: also their tld is literally .gay so I think they’re pretty aware of what they’re asking for with their pronoun preference.

If it asks for it.

The page literally says the pronouns are "it/she" so you can call her "she" and no one should be offended, correct?

Re: How to own an airline in 3 easy steps and grab the TSA nofly list along the way

#358

Post by Rebelgecko »

Miner49er wrote: post #279
ericpauley wrote: post #7

This is clearly on the darker side of gray-hat. Hate to be preachy but anyone seeking to emulate this sort of attack-finding should consider their ethical obligations as a computer scientist and follow best practices for responsible disclosure. It appears this was completely ignored here, including sharing stolen sensitive data of normal people with whoever can plead a case.

Maybe I missed it, but what data of normal people was stolen?

>full names, addresses, phone numbers, passport numbers, pilot's license numbers, when their next linecheck is due and much more

Re: How to own an airline in 3 easy steps and grab the TSA nofly list along the way

#359

Post by thaumasiotes »

arp242 wrote: post #225
easrng wrote: post #129

Earlier quoted context omitted.

it isn't a guy and it uses it/its pronouns.

This is downvoted, but the homepage really does say "hello i am maia arson crimew (it/she)". I'd feel uncomfortable referring to anyone as "it" though, as there are some connotations with that :-/

> the homepage really does say "hello i am maia arson crimew (it/she)".

> I'd feel uncomfortable referring to anyone as "it" though

In Five Children and It (published in 1902), the "It" of the title is a magical creature. However, one of the characters is a human baby who is always referred to with the pronoun "it". I glossed right over that reading the book as a child, but I found it pretty disturbing rereading as an adult.

However, once rereading the book had called the phenomenon to my attention, I noticed that it's not uncommon for me to want to refer to a generic child as "it". I wouldn't refer to a specific child that way.

So referring to a person as "it" is sometimes the normal thing to do. (And, of course, intensely inappropriate at other times.) On the other hand, the intro appears to specify that maia arson crimew wants people to use "she", an exclusively subject pronoun, as the object pronoun for she. That is deeply unnatural and virtually nobody will be able to comply; it's much worse than using "it" for a person.

Re: How to own an airline in 3 easy steps and grab the TSA nofly list along the way

#360

Post by Rebelgecko »

f1refly wrote: post #335
karaterobot wrote: post #39

Earlier quoted context omitted.

Here's an indictment from 2019 for similar activities. It's a crime in the U.S., thus prosecutable in the U.S. The question is whether Swiss authorities cooperate, not the jurisdiction. https://www.justice.gov/usao-wdwa/pr/swiss-hacker-indicted-c...

The jurisdiction is quite questionable. If someone in north Korea would decide I'm guilty of breaking some bizarre law, I couldn't care less. Why would a Swiss citizen care about what the united states think is a crime?

It's easier to get extradited to the US than to North Korea

In fact I don't think any countries will extradite you to North Korea. There's plenty (including many in the neighborhood of Switzerland) that extradite to the US for at least some crimes.

Post reply on HN