Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found a vulnerability. they found a lawyer

dixken.de

Post reply on HN
Print view View original

311–320 of 466 posts

Re: I found a vulnerability. they found a lawyer

#311

Post by jimnotgym »

ChrisMarshallNY wrote: post #305
jimnotgym wrote: post #285

Earlier quoted context omitted.

A lot of responses below talking about what a 'certified' or 'chartered' engineer should be able to do. I thought it would be noteworthy to talk about another industry, accountancy. This is how it works in the UK, but it is similar in other countries. They are called 'Chartered Accountants' here, because their institute has a Royal Charter saying they are the good guys. To become a Chartered Accountant has no prerequ…

I’m big on increasing accountability and responsibility for software engineering, but I’ve learned about SEI CMMI, and worked in an ISO 9001 shop. In some cases, these types of structures make sense, but in most others, they are way overkill. It’s a conundrum. One of the reasons for the crazy growth of software, is the extreme flexibility and velocity of development, so slamming the brakes on that, would have enormou…

> but in most others, they are way overkill.

As an accountant I am able to enforce an accounts regime appropriate to my entity, with concepts like 'materiality' to help. I'm not sure about ISO9001, I'm more familiar with PCIDSS, and I found it to be very proscriptive, and 'all or nothing', compared with accounting standards. For instance in a small company, it is perfectly reasonable to state verbally to your auditor that your control over something is that you are close enough to the transactions to see misstatements by other people sat in the same room. Or even that you have too few people to exercise segregation of duties controls. In a larger company it is not ok. I don't see that same flexibility in other kinds of standards

Re: I found a vulnerability. they found a lawyer

#312

Post by boesboes »

penyaev wrote: post #245

I truly don’t understand why you decided to take the stance of setting them deadlines and disclosing the vulnerability if they miss them. I understand you had good intentions, but I also can see how this can look like unnecessary escalation and even like blackmail to someone outside the industry, like an insurance manager or a lawyer. I agree that disclosing a vulnerability in a major web browser or in a protocol mak…

I truly don’t understand how you can be so naive xox

Re: I found a vulnerability. they found a lawyer

#313

Post by flexagoon »

firtoz wrote: post #260
bpavuk wrote: post #88

Earlier quoted context omitted.

checks out with both Perplexity[0] and top Google results [0]: https://www.perplexity.ai/search/maltese-scuba-diving-insura...

Interesting that perplexity takes a random Redditor comment as fact...

Even better, one that specifically says "I don't know if that's it for sure"

Re: I found a vulnerability. they found a lawyer

#314

Post by miki123211 »

the_hoffa wrote: post #150
godelski wrote: post #133

Earlier quoted context omitted.

In other industries there are professional engineers. People who have a legal accountability. I wonder if the CS world will move that way, especially with AI. Since those engineers are the ones who sign things off. For people unfamiliar, most engineers aren't professional engineers. There are more legal standards for your average engineer and they are legally obligated to push back against management when they think…

You'd be surprised how many SE's would love for this to happen. The biggest reason, as you said, being able to push back. Having worked in low-level embedded systems that could be considered "system critical", it's a horrible feeling knowing what's in that code and having no actual recourse other than quitting (which I have done on few occasions because I did not want to be tied to that disaster waiting to happen). I…

The problem with software is that it's all so, so decentralized.

If you're building a bridge in South Dakota, there's somebody in South Dakota building that bridge. That person has to follow South Dakota laws, and those laws can require whatever South Dakota regulators want, including sign-offs by professional engineers.

If you're a South Dakota resident signing up for a web portal, the company may have no knowledge of your jurisdiction specifically (and it would be a huge loss for the world if we moved to a "geo-block every single country by default until you clear it with your lawyers" regime). That portal may very well be hosted in Finland by a German hosting company, with the owners located in Sweden, running Open Source software primarily developed in Britain. It's possible that no single person affiliated with that portal's owner ever stepped food in your jurisdiction.

Re: I found a vulnerability. they found a lawyer

#315

Post by birb07 »

nilslindemann wrote: post #116

AFAIK, what this dude did - running a script which tries every password and actually accessing personal data of other people – is illegal in Germany. The reasoning is, just because a door of a car which is not yours is open you have no right to sit inside and start the motor. Even if you just want to honk the horn to inform the guy that he has left the door open. https://www.nilsbecker.de/rechtliche-grauzonen-fuer-et…

where did they mention a script to try passwords? all accounts apparently have the same default password

Re: I found a vulnerability. they found a lawyer

#316

Post by crispyambulance »

yellers wrote: post #282
skrebbel wrote: post #276

Earlier quoted context omitted.

It's standard practice and it freaks managers the fuck out, esp if they're not familiar with hacker culture. Maybe the standard practice needs some work? I'm not sure, I understand the perspective of security researchers who want to force action on a fix. But I also completely understand how a deadline is perceived as a threat. Don't forget that there's lots of gray hat / black hat hackers out there as well, who will…

If this freaks them out maybe they shouldn’t roll their own SaaS?

They almost certainly did not. They likely just hired a cheap contractor to get their service up, and went with it when "it worked".

The contractor (who was certainly incompetent) probably looked at a bunch of nightmarishly complex identity API's and said "F** it!", combine that with being grossly underpaid and you get stuff like this.

It's a bad situation, of course, and involving threatening lawyers makes it even more ugly. But I can understand how a very small business (knowing nothing about IT other that what their incompetent contractor told them) might get really offended and scared shitless by some rando giving them a 30-day deadline, reporting them to authorities, and demanding that they contact all affected customers.

Re: I found a vulnerability. they found a lawyer

#317

Post by rdtsc »

ThunderSizzle wrote: post #308
thiht wrote: post #300

Earlier quoted context omitted.

Maybe the standard practice sucks. No matter how you turn it around, it does sound like blackmail. Just because you disclose a vulnerability to an org doesn’t mean you have any right or legitimacy to impose a deadline on them, you’re not their boss. This is some vigilante shit and it has not justification whatsoever. Report to the org, report to the authorities as needed and move on.

Without a deadline of some form, when do you escalate to public knowledge so customers can know they might get defrauded in some capacity?

> Without a deadline of some form, when do you escalate to public knowledge so customers can know they might get defrauded in some capacity?

You set a deadline after an initial conversation and urging them to fix it, if they don’t respond. I think the idea would be to escalate slowly. Like the original poster said large tech companies like know how to do this and streamlined the process. But, to someone not familiar with the process it looks like threats and deadlines imposed by a random person.

I am not defending the company just presenting their possible point of view. It’s worth seeing things with their eyes so to speak to try to understand their motivations.

Re: I found a vulnerability. they found a lawyer

#318

Post by jjkaczor »

pjmlp wrote: post #225
godelski wrote: post #133

Earlier quoted context omitted.

In other industries there are professional engineers. People who have a legal accountability. I wonder if the CS world will move that way, especially with AI. Since those engineers are the ones who sign things off. For people unfamiliar, most engineers aren't professional engineers. There are more legal standards for your average engineer and they are legally obligated to push back against management when they think…

In many countries you are only allowed to call yourself a Software Engineer if you actually have a professional title. It is countries like US where anyone can call themselves whatever they feel like that have devalued our profession. I have been on the liability side ever since, people don't keep broken cars unless they cannot afford anything else, software is nothing special, other than lack of accountability.

Exactly this - I had a role in a multinational, US-founded company, however - I was based in Canada - our title had the name "engineer" contained within it. We were NOT by any means certified professional engineers according to any regulatory body - we were great at our jobs, but that was the reality.

We were NOT allowed to refer to our job title when deployed to the province of Quebec, which has strong regulations around the use of the term "engineer". It was fine - we still went, did our jobs, satisfied our customers and fixed their issues.

Re: I found a vulnerability. they found a lawyer

#319

Post by az226 »

paxys wrote: post #69

When you are acting in good faith and the person/organization on the other end isn't, you aren't having a productive discussion or negotiation, just wasting your own time. The only sensible approach here would have been to cease all correspondence after their very first email/threat. The nation of Malta would survive just fine without you looking out for them and their online security.

10000% this

Re: I found a vulnerability. they found a lawyer

#320

Post by kgeist »

Not a security researcher, but I once found an open Redis port without auth on a large portal. Redis was used to cache all views, so one could technically modify any post and add malicious links, etc. I found the portal admin's email, emailed them directly, and got a response within an hour: "Thanks, I closed the port." I didn't need a bounty or anything, so sometimes it may be easier and safer to just skip all those management layers and communicate with an actual fellow engineer directly
Post reply on HN