Wow this more like in US. Didn't know Malta is so lawyered.
I found a vulnerability. they found a lawyer
191–200 of 466 posts
Re: I found a vulnerability. they found a lawyer
#192Earlier quoted context omitted.
Who compensates them for the risk?
What risk? It sounds to me like the worst they could get is a subpoena to produce the identity of the reporter Besides, it's usually governmental organizations that do this sort of thing
The risk of lawsuits like the ones threatened to be filed against this researcher.
Re: I found a vulnerability. they found a lawyer
#193Earlier quoted context omitted.
Regarding your 2), in other industries and engineering professions, the architect (or civil engineer, or electrical engineer) who signed off carries insurance, and often is licensed by the state. I absolutely do not want to gatekeep beginners from being able to publish their work on the open internet, but I often wonder if we should require some sort of certification and insurance for large businesses sites that hand…
It's kinda wild that you don't need to be a professional engineer to store PII. The GDPR and other frameworks for PII usually do have a minimum size (in # of users) before they apply, which would help hobbyists. The same could apply for the licensure requirement. But also maybe hobbyists don't have any business storing PII at scale just like they have no business building public bridges or commercial aircraft.
GDPR doesn't have any minimum size before applying. There's a household exemption for personal use, but if you have one external user, you're regulated.
Re: I found a vulnerability. they found a lawyer
#194> No exploits, no buffer overflows, no zero-days. Just a login form, a number, and a default password that was set for each student on creation. ai;dr This is AI slop. Use your own words! I would rather read the original prompt!
Presuming nobody had found this exploit previously, it actually is a zero-day.
Re: I found a vulnerability. they found a lawyer
#195Earlier quoted context omitted.
Hopefully no criminals turn up to do the illegal thing.
You don't need to retrieve other people's data to demonstrate the vulnerability. It's readily evident that people have an account with a default password on the site for some amount of time, and some of them indefinitely. You know what data is in the account (as the person who creates the accounts) and you know the IDs are incremental. You can do the login request and never use the retrieved access/session token (or…
> You don't need to retrieve other people's data to demonstrate the vulnerability.
If you’re reporting to a nontechnical team…which sometimes you are…sometimes you do?
Re: I found a vulnerability. they found a lawyer
#196One way how to improve cybersecurity is let cyber criminals loose like predators hunting prey. Companies needs to feel fear that any vulnerability in their systems is going to be weaponized against them. Only then they will appreciate an email telling them about security issue which has not been exploited yet.
Like re-introducing wolves into Yellowstone.
Re: I found a vulnerability. they found a lawyer
#197Earlier quoted context omitted.
How do you know? Some of the text has a slightly LLM-ish flavour to it (e.g. the numbered lists) but other than that I don’t see any solid evidence of that Edit: I looked into it a bit and things seems to check out, this person has scuba diving certifications on their LinkedIn and the site seems real and high-effort. While I also don’t have solid proof that it’s not AI generated either, making accusations like this b…
Not them but the formatting screams LLM to me. Random "bolding" (rendered on this website as blue text) of phrases, the heading layout, the lists at the end (bullet point followed by bolded text), common repeats of LLM-isms like "A. Not B". None of these alone prove it but combined they provide strong evidence. You can also see the format and pacing differs greatly from posts on their blog made before LLMs were mains…
In addition to being irrelevant, these accusations aren't competent.
Re: I found a vulnerability. they found a lawyer
#198Earlier quoted context omitted.
> This is an LLM-generated article, for anyone who might wish to save the "15 min read" labelled at the top. Recounts an entirely plausible but possibly completely made up narrative of incompetent IT, and contains no real substance. Nothing in the original message refers to it being clickbait, the core complaint is the LLM-like tone and the lack of substance, which you also just threw it there without references iron…
It is not based on guesswork. For whatever it's worth, I have gotten 7 LLM accounts banned from HN in the past week based on accurately detecting and reporting them to moderation[1]. Many of these accounts had between dozens and 100 upvotes, some with posts rated to the top of their threads that escaped detection by others. I have not once misidentified and reported an account that was genuinely human. I am aware tha…
This looks like complete fabrication by an AI agent.
Re: I found a vulnerability. they found a lawyer
#199Earlier quoted context omitted.
It is not based on guesswork. For whatever it's worth, I have gotten 7 LLM accounts banned from HN in the past week based on accurately detecting and reporting them to moderation[1]. Many of these accounts had between dozens and 100 upvotes, some with posts rated to the top of their threads that escaped detection by others. I have not once misidentified and reported an account that was genuinely human. I am aware tha…
This looks like complete fabrication by an AI agent.
[flagged]
Re: I found a vulnerability. they found a lawyer
#200Earlier quoted context omitted.
Literally found the same issue in a password system, on top of passwords being clear text in the database... cleared all passwords, expanded the db field to hold a longer hash (pw field was like 12 chars), setup "recover password" feature and emailed all users before End of Day. My own suggestion to anyone reading this... version your password hashing mechanics so you can upgrade hashing methods as needed in the futu…
If you are needing to version your password hashes, then you are likely doing them incorrectly and not using a proper computationally-hard hashing algorithm. For example, with unsuitable algorithms like sha256, you get this, which doesn't have a version field: import hashlib; print(f"MD5: {hashlib.md5(b'password').hexdigest()}") print(f"SHA-256: {hashlib.sha256(b'password').hexdigest()}") MD5: 5f4dcc3b5aa765d61d8327d…
It's not a leading colon: It is a colon separator between the username and password, and the command used has the username as an empty string.