Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID

bobdahacker.com

Post reply on HN
Print view View original

31–40 of 109 posts

Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID

#31

Post by antonvs »

BobDaHacker wrote: post #2

Registered on FIFA's public Agent Platform with my ID, got added to their Microsoft Entra tenant, and found the Angular app only checked roles client-side. The backend APIs served everything: RTMP ingest URLs and stream keys for every live World Cup 2026 camera feed across all five angles. Confirmed live in VLC. An attacker could have pushed arbitrary video to the ingest endpoints and replaced broadcast feeds on TV w…

> Hire me (just kidding... unless?)

Would you really want to work for one of the world’s most notoriously corrupt organizations?

Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID

#32

Post by patates »

SXX wrote: post #28
pqs wrote: post #21

Earlier quoted context omitted.

These comments don't help much. AI is here, not everybody can write well, AI is gonna be used.

I'd wish we come to a day where people would just post the prompt. Then I can decide what story to generate from it.

Look I don't like to see a wall of AI slop as much as the next person (see: https://news.ycombinator.com/item?id=48551462), but "just post the prompt" is also too dismissive. AI had access to information that we don't have and all you see here is probably a compilation of multiple prompts, edits and various sources (like author's notes) for context.

We can adjust our expectations for people to take some time to make the output theirs.

OTOH, and this is me arguing against myself, maybe this is not too different than the million web sites we saw using the unmodified default bootstrap theme.

I guess my opinions as well as the response of the community are still evolving.

Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID

#34

Post by TeMPOraL »

SXX wrote: post #28
pqs wrote: post #21

Earlier quoted context omitted.

These comments don't help much. AI is here, not everybody can write well, AI is gonna be used.

I'd wish we come to a day where people would just post the prompt. Then I can decide what story to generate from it.

- It's called "writing in bullet points"

- Normies frown upon it

Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID

#35

Post by divan »

rectang wrote: post #26

> Client says "access denied" > Server says "here's everything" hahahaha > Hire me (just kidding... unless?) FIFA is a legendarily awful organization. In my weaker moments reading your piece I thought to myself how nice it would have been if someone more ruthless than you had been made an example of them.

To be fair FIFA is one of the best international federations in terms of good governance. Dutch sport think-tank Play The Game has an assestment methodology and the project called "Sports Governance Observer" and did asses FIFA in 2018 [1]

FIFA gets disproportionate amount of attention and, ofc, high-level corruption scandals, but I would say it's more like a by-product of the sheer scale of the football, and not a problem with FIFA itself. I believe most sports federations in the world are very far from FIFA in terms of governance, but also from facing problems that FIFA has.

[1] https://www.playthegame.org/publications/sports-governance-o...

Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID

#36

Post by curiousgal »

This is honestly one of the only instances where I am like "you're an idiot for reporting this". The amount of reach, provided the feeds can indeed be overriden, is absolutely insane. Paired with how shitty of an org FIFA is, I personally would have just leaked this.

Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID

#37

Post by jdw64 »

willdr wrote: post #27
jdw64 wrote: post #23

I don't understand why people obsess over LLM(AI)format. The content is interesting, but they dismiss it just because the format is an issue. All of this content is worth reading and is good. And it's about security.

The content is rendered unreadable by the LLMs sentence construction. Secondly, it's insulting. If you didn't care enough to write it, why should I care enough to read it?

I saw the this post. Wasn't it a capture of something that actually happened? So it just described a real story. I can doubt the authenticity of all of it whether it's really true or not. but the content itself was interesting enough.

What I don't understand is this: 'Show sincerity'—that is, a human value. If it were AI-generated, stitched-together false content, I'd understand, but I see quite a few interesting points.

Whenever I see things like this, I always think of Sturgeon's law: 90% is bad, and only 10% is interesting. I get that most AI-generated content is AI slop. But even back when only humans could write, there were plenty of clickbait articles.

I agree that GEN AI spam content is generally bad, and I also agree that some of it may lack effort. But honestly, I'm not sure this content is completely meaningless.

Regardless of the packaging, if the content inside is interesting and valuable enough, I think that's what matters. I guess we just see things quite differently.

So what I'm saying is, I don't agree with the idea that he didn't care at all.

Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID

#38

Post by dawnerd »

willdr wrote: post #27
jdw64 wrote: post #23

I don't understand why people obsess over LLM(AI)format. The content is interesting, but they dismiss it just because the format is an issue. All of this content is worth reading and is good. And it's about security.

The content is rendered unreadable by the LLMs sentence construction. Secondly, it's insulting. If you didn't care enough to write it, why should I care enough to read it?

Or even believe it. Hard to believe a story if it’s right from an llm.

Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID

#39

Post by thrdbndndn »

This happens more often than you would think.

During COVID, lots of live shows (concerts, etc.) in Japan moved to streaming (and most of them stuck, so thanks to that, lots of large concerts today have real-time streaming, which is great for foreign fans).

Out of 10+ platforms, more than half have vulnerabilities that allow you to access the content freely (sometimes including the rehearsals, because they are also streamed internally), and on a handful, you can access the admin panel and, as the author said, stream whatever you want.

Most of them have been patched over the years (some are just the byproduct of them changing the backend/SaaS provider, though), but there remain some major providers where you can get content for free.

Re: I Could've Rickrolled the FIFA World Cup. All I Needed Was My ID

#40

Post by Oranguru »

gspr wrote: post #30
pqs wrote: post #21

Earlier quoted context omitted.

These comments don't help much. AI is here, not everybody can write well, AI is gonna be used.

> AI is here, not everybody can write well, AI is gonna be used. I don't know about you, but I'd love to read a fascinating story written by a relatively poor writer. But if they can't be bothered to write, I assume the story can't be that good.

But this isn't a story, literature, or a fancy piece of art; it's merely a technical blog post that discloses a security vulnerability. Here, the writing serves only as a vehicle to convey a message. Once you've received it, its purpose has been fulfilled. I would agree with you if the writing were an important part of the message, but here it is not. Not everybody can write well, and this guy clearly had something to tell, and that is what matters.
Post reply on HN