131–140 of 168 posts
It's Halloween, so you put a bowl of chocolates outside your house with a sign saying "take one". You accidentally dropped your wedding ring in there, and when a reporter digs through the chocolates and sees it, they ring the doorbell to let you know.
What the reporter saw was the base64 encoded contents of the typical .Net "VIEWSTATE" session stuff, that looks like this: Meaning he likely just pasted the contents into a web based base64 decoder. I am totally mystified how a competent DA wouldn't have dropped this immediately.
it is civic duty to report a crime, and within the law to be prosecuted for not reporting a crime.
it is also a crime to make misleading or false statements or acting in a manner that obstructs a legal investigation.
the government of missouri has spun this around, 180 degrees attempting to make someone revealing the matter look like a criminal, and validate government obstruction of legal recourse.
the pot is painting the kettle an offcolour to hide its own.
So it seems Parsons administration decided this is the hill to die on in 2021. he had every opportunity to pump the brakes on this investigation but decided doubling down on a journalist had a better payoff, and a more prominent ability to cast him as a white knight protecting the state of Missouri against fiendish hackers. the 'view source' prosecution strategy is certainly something id hope to keep out of the spotl…
The goal isn't to appear as a white knight protecting the state from hackers, it's to mount a crusade against big-city journalists.
Someone - a particular political party - is attacking the free press and freedom generally. The only answer is to be heard, loudly, and vote them out of office. The cavalry isn't coming - nobody will save us but us. It's not a partisan statement. I'm not saying it to favor one party or another (though unavoidably the other party would benefit - we'd be better off with multiple parties committed to democracy). We agre…
Unfortunately, it's actually both political parties.
The world isn't equal, and both-sidism is a great way to try to divert people from taking action - nobody is wrong or evil, everyone is. We need to distinguish right and from wrong and to act, now. We need to use our free will, our free moral choice, to choose and act right. We will get the consequences we choose and act upon.
Earlier quoted context omitted.
This is Missouri. It might be hard to find a competent DA in the entire state.
I know you're probably saying this half-jesting... But the harsh reality is that if a judge cannot understand the minutiae of "browser requested one thing and the PLANTIFF's server sent personal info, unencrypted", then the precedent that is set is an awful one. I get that the amount of technical stuff that needs to be understood here is beyond what your average NON-hacker-news type might understand... but when it co…
by extension missouri is deliberating a court case that questions the legality of public access to WWW.
Someone - a particular political party - is attacking the free press and freedom generally. The only answer is to be heard, loudly, and vote them out of office. The cavalry isn't coming - nobody will save us but us. It's not a partisan statement. I'm not saying it to favor one party or another (though unavoidably the other party would benefit - we'd be better off with multiple parties committed to democracy). We agre…
I have seen prosecutors act like complete slime balls - from both parties. Intimidating witnesses - misrepresenting evidence - omitting counter-evidence - over-charging defendants - denying timely access to council. If you think this is about politics - you are mistaken. You just haven't seen all the other times defendants have been mistreated in court.
We desperately need a law that says (or at least need people in power to understand that) if your server sends it (as an agent working on behalf of your interests), you decided it was ok for me to receive it! For HTTP this understanding is literally conveyed in the status code (200-OK). Once data is sent to the client, you can't say they are breaking the law by looking at it[0]. Anyone with a text-based browser would…
1) This would require law enforcement, attorneys, judges, and juries to learn how the Internet works. For most people, what a server sent is what you can see in a web page. Concepts like server and client aren't ubiquitous.
2) This doesn't account for vulnerabilities. If I use an open source package that has a security flaw, and that flaw is exploited causing my server to send sensitive data, did I still implicitly authorize this because the server was acting as an agent of my interests? I probably need to be held accountable, but surely the attacker is not innocent. If we agree on this, then how do we craft a law that draws the line between incrementing a query parameter and remote code execution?
Earlier quoted context omitted.
Unfortunately, it's actually both political parties.
You'll have to back that up somehow. I strongly believe that that it is false - for generations, both parties supported the free press and put freedom and democracy first. Even in Watergate, it was a narrow attack on the press and the Republicans eventually turned on Nixon. That is no longer true. The world isn't equal, and both-sidism is a great way to try to divert people from taking action - nobody is wrong or evi…
What more proof do you want?
Also, I don't understand your point. If anything, "they're all bad" should motivate people to take more action.
Earlier quoted context omitted.
I agree that both of those shouldn't be punished. I'm not sure how one would properly define the law tho - for ex. an SQL injection could also be "just a query parameter" and the server would haply reply with a 200.
SQL injection is probably malformed input in lots of cases and should return a 400 Bad Request. If you are returning a 200 maybe you really did want to take SQL (think of Mode or PHPMyAdmin).
The same applies in the real world too. If I perform a social engineering hack and get you to pay a fake invoice, it's still theft (or fraud), even though someone willingly and deliberately sent you money.
Earlier quoted context omitted.
I agree that both of those shouldn't be punished. I'm not sure how one would properly define the law tho - for ex. an SQL injection could also be "just a query parameter" and the server would haply reply with a 200.
It would make the most sense to define software as a legal agent of those who deploy it. If an HTTPS server prints OK and returns a document for a straightforward request, then it's manifestly obvious that the owner's agent intended to give you that information. If the owner did not intend that to happen, the issue is between them and their agent. (Think: a customer service rep who didn't follow policy) Supplying a S…