Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found a vulnerability. they found a lawyer

dixken.de

Post reply on HN
Print view View original

71–80 of 466 posts

Re: I found a vulnerability. they found a lawyer

#71

Post by janalsncm »

Three thoughts from someone with no expertise.

1) If you make legal disclosure too hard, the only way you will find out is via criminals.

2) If other industries worked like this, you could sue an architect who discovered a flaw in a skyscraper. The difference is that knowledge of a bad foundation doesn’t inherently make a building more likely to collapse, while knowledge of a cyber vulnerability is an inherent risk.

3) Random audits by passers-by is way too haphazard. If a website can require my real PII, I should be able to require that PII is secure. I’m not sure what the full list of industries would be, but insurance companies should be categorically required to have an cyber audit, and laws those same laws should protect white hats from lawyers and allow class actions from all users. That would change the incentives so that the most basic vulnerabilities are gone, and software engineers become more economical than lawyers.

Re: I found a vulnerability. they found a lawyer

#72

Post by famouswaffles »

anonymous908213 wrote: post #57
gchamonlive wrote: post #49

Earlier quoted context omitted.

> This is an LLM-generated article, for anyone who might wish to save the "15 min read" labelled at the top. Recounts an entirely plausible but possibly completely made up narrative of incompetent IT, and contains no real substance. Nothing in the original message refers to it being clickbait, the core complaint is the LLM-like tone and the lack of substance, which you also just threw it there without references iron…

It is not based on guesswork. For whatever it's worth, I have gotten 7 LLM accounts banned from HN in the past week based on accurately detecting and reporting them to moderation[1]. Many of these accounts had between dozens and 100 upvotes, some with posts rated to the top of their threads that escaped detection by others. I have not once misidentified and reported an account that was genuinely human. I am aware tha…

Those are a lot of words to say you guessed. And the banning comment is nice I guess but pretty meaningless. Does moderation really always report back to you when you make such an accusation ? Who's to even say all the banned accounts were LLMs ? You know what would happened if i got banned because someone accused me of being a LLM ? Nothing. I'd take it as a sign to do other things.

Let's say you are the LLM detecting genius you paint yourself to be. Well guess what? You're human and you're going to make mistakes, if you haven't made a bunch of them already. So if you have nothing better to add to a post than to guess this, you probably shouldn't say anything at all. Like you said, it's not even against the rules.

Re: I found a vulnerability. they found a lawyer

#73

Post by frederikvs »

pavel_lishin wrote: post #59
stevage wrote: post #42

Since the author is apparently afraid to name the organisation in question, it seems the legal threats have worked perfectly.

Or maybe in the diving community, "Maltese insurance company for divers" is about as subtle as "Bird-themed social network with blue checkmarks".

I'm a diver, DAN is the only company I can name that specialises in diving insurance.

Huh, apparently they're registered in Malta, what a coincidence...

Re: I found a vulnerability. they found a lawyer

#74

Post by czbond »

paxys wrote: post #69

When you are acting in good faith and the person/organization on the other end isn't, you aren't having a productive discussion or negotiation, just wasting your own time. The only sensible approach here would have been to cease all correspondence after their very first email/threat. The nation of Malta would survive just fine without you looking out for them and their online security.

Agree - yet, security researchers and our wider community also needs to recognize that vulnerabilities are foreign to most non-technical users.

Cold approach vulnerability reports to non-technical organizations quite frankly scare them. It might be like someone you've never met telling you the door on your back bedroom balcony can be opened with a dummy key, and they know because they tried it.

Such organizations don't kmow what to do. They're scared, thinking maybe someone also took financial information, etc. Internal strife and lots of discussions usually occur with lots of wild specualation (as the norm) before any communication back occurs.

It just isn't the same as what security forward organizations do, so it often becomes as a surprise to engineers when "good deed" seems to be taken as malice.

Re: I found a vulnerability. they found a lawyer

#76

Post by nsteel »

thenewnewguy wrote: post #25
circuit10 wrote: post #10

Earlier quoted context omitted.

How do you know? Some of the text has a slightly LLM-ish flavour to it (e.g. the numbered lists) but other than that I don’t see any solid evidence of that Edit: I looked into it a bit and things seems to check out, this person has scuba diving certifications on their LinkedIn and the site seems real and high-effort. While I also don’t have solid proof that it’s not AI generated either, making accusations like this b…

Not them but the formatting screams LLM to me. Random "bolding" (rendered on this website as blue text) of phrases, the heading layout, the lists at the end (bullet point followed by bolded text), common repeats of LLM-isms like "A. Not B". None of these alone prove it but combined they provide strong evidence. You can also see the format and pacing differs greatly from posts on their blog made before LLMs were mains…

Hang on, they used a computer to help them create the post content?! Outrageous.

Re: I found a vulnerability. they found a lawyer

#77

Post by magicalhippo »

dwedge wrote: post #51
magicalhippo wrote: post #33

Earlier quoted context omitted.

> Wanna trash the site's design, you should open a top level thread instead. Or better, don't[1]: Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting. [1]: https://news.ycombinator.com/newsguidelines.html

Being impossible to read is not common

Get a better browser I'd say. Firefox Reader mode makes short work of such sites, including the submission. I use it very often, so I can enjoy the content rather than get frustrated over styling issues.

Re: I found a vulnerability. they found a lawyer

#78

Post by vablings »

kazinator wrote: post #36

Why does someone with a .de website insure their diving using some company based in Malta? Based on this interaction, you have wonder what it's like to file a claim with them.

Absolutely horrible according to DIVE TALK

https://www.youtube.com/watch?v=O7NsjpiPK7o

Insurance company would not cover a decompression chamber for someone who has severe decompression sickness, it is a life-threatening condition that requires immediate remediation.

The idea that you possible neurological DCS and you must argue on the phone with an insurance rep about if you need to be life-flighted to the nearest chamber is just.... Mind blowing

Re: I found a vulnerability. they found a lawyer

#79

Post by janalsncm »

desireco42 wrote: post #5

I think the problem is the process. Each country should have a reporting authority and it should be the one to deal with security issues. So you never report to actual organization but to the security organization, like you did. And they would be more equiped to deal with this, maybe also validate how serious this issue is. Assign a reward as well. So you are researcher, you report your thing and can't be sued or bul…

Does it have to be a government? Why not a third party non-profit? The white hat gets shielded, and the non-profit has credible lawyers which makes suing them harder than individuals.

The idea is to make it easier to fix the vulnerability than to sue to shut people up.

For credit assignment, the person could direct people to the non profit’s website which would confirm discovery by CVE without exposing too many details that would allow the company to come after the individual.

This business of going to the company directly and hoping they don’t sue you is bananas in my opinion.

Re: I found a vulnerability. they found a lawyer

#80

Post by Buttons840 »

I've said before that we need strong legal protections for white-hat and even grey-hat security researchers or hackers. As long as they report what they have found and follow certain rules, they need to be protected from any prosecution or legal consequences. We need to give them the benefit of the doubt.

The problem is this is literally a matter of national security, and currently we sacrifice national security for the convenience of wealthy companies.

Also, we all have our private data leaked multiple times per month. We see millions of people having their private information leaked by these companies, and there are zero consequences. Currently, the companies say, "Well, it's our code, it's our responsibility; nobody is allowed to research or test the security of our code because it is our code and it is our responsibility." But then, when they leak the entire nation's private data, it's no longer their responsibility. They're not liable.

As security issues continue to become a bigger and bigger societal problem, remember that we are choosing to hamstring our security researchers. We can make a different choice and decide we want to utilize our security researchers instead, for the benefit of all and for better national security. It might cause some embarrassment for companies though, so I'm not holding my breath.

Post reply on HN