Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Beg Bounties (2021)

troyhunt.com

Post reply on HN
Print view View original

111–120 of 174 posts

Re: Beg Bounties (2021)

#111

Post by plugin-baby »

pilchard123 wrote: post #110
plugin-baby wrote: post #108

Earlier quoted context omitted.

> If a house is unlocked and you go in to prove it's unlocked, maybe leave a helpful note, you're still breaking in. What jurisdiction? I would think this was just trespass.

IIRC some jurisdictions consider any force at all - such as pushing an already-open door further open - to be sufficient to make it B&E rather than simply trespassing.

Force isn’t even required in some places, apparently!

This page expands on the differences in a few countries: https://en.m.wikipedia.org/wiki/Burglary

Canada

> Breaking and entering is defined as breaking into a place with intent to commit another indictable offence

England & Wales

> A person is guilty of burglary if they enter any building or part of a building as a trespasser with intent to steal, inflict grievous bodily harm or do unlawful damage to the building or anything in it.

New Zealand

> burglary is a statute offence under section 231 of the Crimes Act 1961. Originally this was a codification of the common law offence, though from October 2004 the break element was removed from the definition and entry into the building (or ship), or a part of it, now only needed to be unauthorised.

Re: Beg Bounties (2021)

#112

Post by Etheryte »

oliwarner wrote: post #80

I understand the problem, beggars add noise to an important contact signal point… But this idea that people ' did actually already do the "work" for free' so don't deserve remuneration… isn't great. Lot's of people do spec work to try and get paid, or to get more work. The recipient is free to negotiate, rebuff or simply ignore it, but this idea that time sunk is valueless is unhelpful. Not defending "Hammad" here. I…

This makes no sense. Imagine someone shows up at your house, paints the fence and then asks you for compensation. They already did the work, but you never even asked for it. The same thing is happening here.

Re: Beg Bounties (2021)

#113

Post by onionisafruit »

geek_at wrote: post #93
waihtis wrote: post #90

Earlier quoted context omitted.

No criticism because teenagers do dumb things, but for anyone else it should be assumed that if you break into a system without permission, benignly or not, you run the risk of getting prosecuted for it.

Oh yes. In 2011 I got raided by the police because I clicked a link someone sent me over IRC [1]. You don't even need to be destructive to become a target for prosecution sometimes. Being stupid or incautious is enough. [1] https://blog.haschek.at/2015-that-not-so-awesome-time-the-po...

After reading your story, the image at the bottom stands out. I never thought about the fact that you can’t really trust that what is returned to you is the same as what they took. No telling if they added any malware to those drives intentionally or not.

Re: Beg Bounties (2021)

#114

Post by bluedino »

> Want to be a bounty beggar? It's dead simple, you just use tools like Qualys' SSL Labs, dmarcian or Scott Helme's Security Headers, among others. Easy point and shoot magic and you don't need to have any idea whatsoever what you're doing

You've described 90% of our cybersecurity department.

Re: Beg Bounties (2021)

#116

Post by unforgivenpasta »

Reading the accompanying cloudpets article is very similar to my experience with reporting exploits.

Found a XSS vulnerability on a very popular danish website and 0 contact since reporting. The vulnerability still exists and even found a few less severe bugs

Re: Beg Bounties (2021)

#117

Post by ChrisMarshallNY »

tptacek wrote: post #16

I don't really understand the point of making a big stink about Beg Bounty Hunters. They're invariably people in developing countries, for whom occasional SPF or Clickjacking payouts will be meaningful. And there's an unbounded supply of them. They're not going away. All you can control is the way you respond to them; lashing out at them in public seems like a pretty unhealthy response. Not for them; who cares? There…

That's one of the reasons that I don't play with scammers, anymore.

Most of them live fairly miserable lives of poverty.

That doesn't excuse them, but I don't feel it does me any good, to pile further misery on them, when it's just easier to walk away.

Re: Beg Bounties (2021)

#118

Post by ipython »

tptacek wrote: post #16

I don't really understand the point of making a big stink about Beg Bounty Hunters. They're invariably people in developing countries, for whom occasional SPF or Clickjacking payouts will be meaningful. And there's an unbounded supply of them. They're not going away. All you can control is the way you respond to them; lashing out at them in public seems like a pretty unhealthy response. Not for them; who cares? There…

Another thought on this, coming from someone whose phone number has ended up on some large number of scammer lists, to the point where I would have about 1000 scam calls per month around open enrollment time (think targeting seniors):

You are advocating for feeding the troll. The troll will not be satisfied with table scraps. Larger trolls will see the opportunity and scale up.

I get what you’re saying. I don’t have a solution to the inequality you point out. But rewarding the bad behavior doesn’t help rectify the inequality, it just makes more bad behavior.

Re: Beg Bounties (2021)

#119

Post by ipython »

ChrisMarshallNY wrote: post #117
tptacek wrote: post #16

I don't really understand the point of making a big stink about Beg Bounty Hunters. They're invariably people in developing countries, for whom occasional SPF or Clickjacking payouts will be meaningful. And there's an unbounded supply of them. They're not going away. All you can control is the way you respond to them; lashing out at them in public seems like a pretty unhealthy response. Not for them; who cares? There…

That's one of the reasons that I don't play with scammers, anymore. Most of them live fairly miserable lives of poverty. That doesn't excuse them, but I don't feel it does me any good, to pile further misery on them, when it's just easier to walk away.

The problem is that they do have real consequences for others. It is a kind of zero sum game where their gains come from the loss of others. I have no sympathy for them.

If you want to help them, why not just send them $$?

Re: Beg Bounties (2021)

#120

Post by ChrisMarshallNY »

ipython wrote: post #119
ChrisMarshallNY wrote: post #117

Earlier quoted context omitted.

That's one of the reasons that I don't play with scammers, anymore. Most of them live fairly miserable lives of poverty. That doesn't excuse them, but I don't feel it does me any good, to pile further misery on them, when it's just easier to walk away.

The problem is that they do have real consequences for others. It is a kind of zero sum game where their gains come from the loss of others. I have no sympathy for them. If you want to help them, why not just send them $$?

I don’t want to help them.

Not wanting to hurt people deliberately, is not the same thing as wanting to help them, or supporting them.

When we engage in retaliatory behavior, it can have negative consequences on our own psyche. This is something I know well.

Post reply on HN