Live data from Hacker News

18yo arrested for reporting a bug in the new Budapest e-Ticket system

blog.marai.me

321–329 of 329 posts

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#321

Earlier quoted context omitted.

Depends on the country, I guess. Come visit Ukraine - there is almost nothing hidden regarding those agendas here. One question, tho - if they are so incompetent and mismanaged, how come they're your government?

Ah, you are from Ukraine. This explains your bitterness. There are differences between Eastern-Europe and Eastern-Europe. Ukraine is in a whole different dimension regarding corruption, than Hungary.

Yeah, you're right, as the guy from Ukraine I'm probably preconceived quite a bit. But as an IT guy, I still do not believe that everything is clear with those 4 years and 9 million euro.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#322
post #318
post #305

Earlier quoted context omitted.

[deleted]

> The thing is that PiS, Kukiz and TVP have normalized and brought into daily life in Poland extremely aggressive language and rhetoric. Same thing as with Trump. It's because literally nothing else works today against self-righteous leftists. You said in another comment that majority of Poles would rather leave EU than deal with the Islamic mess. AFAIK the most credible opposition to the current government is still…

[deleted]

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#323
post #265

Earlier quoted context omitted.

Not having much experience on this subject, I have to ask: would you not get your developers to verify that the vulnerability is there and fix it while the legal department is doing its thing? The vulnerability is already out there, and the sooner it's fixed the better. While would they forward everything to their lawyers first thing?

If the email contains code or something that looks like code, or otherwise looks like it is discussing technical things it is not unusual to run it through legal before letting any engineers see it. That's because companies routine receive unsolicited product proposals, ideas for new features or enhancements, and the like. Often these overlap with things they have been working on internally but that are not known to…

Aw gee, that makes sense, yes. Never worked for a company big enough to need this. Also, I'm in Italy, so some things might work differently here.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#324
post #32

"if you just typed in the url (shop.bkk.hu), the site just wouldn't appear. At first I thought they've taken it offline, but it turns out that they just didn't set up the http -> https redirection. And it was left like that for days. If you just heard about it, you couldn't use it. You had to click a link (normal users won't figure out to put an https in front of the host name, even I didn't think of it)." I'd really…

Not having an http site doesn't help in a MITM scenario as the attacker will happily serve up an http site even if you don't.

HSTS helps for this.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#325
post #15

Earlier quoted context omitted.

I'm not aware of any actual mafia. They were almost certainly metaphorical and they must have been just bashing the local government. Because what they do is really a shame. One of the lines is de facto in a life threatening condition. Trains caught fire multiple times. Instead of being replaced, the 40 year old cars are being refurbished/modernized. This has something to do with the EU (they gave money for this, but…

Actually yes, the EU some money for refurb, not new trains. The Russians didn't magically win the tender, i think it was realpolitik. They manufactured them originally in the first place, they have the means to do the work, and without knowing if the proposals were technically equivalent, Hungary needs to maintain a good relation not only to its neighbors, and fellow EU members, but to Moscow. Also the trains are not…

Well, only if you want to explain away the fact that the Estonians should have won the tender based on the official scoring and criteria. In other words, you are rationalizing. There's a reason why tenders always have a fixed scoring system. And this is it.

Maintaining good relationships with the Russians wasn't part of it, of course. We'll pay them enough for Pask2 (awarded without tendering). But even if not, because enough does not exist, more is always better, if this is the price of a 'good relationship' then we already have a bad relationship with them. I.e. they are blackmailing us. (Of course, it's not the case, but they are probably more willing to pay back than the Estonians...)

No, these problems are not like other problems, though Siemens and Alstrom were also both involved in corruption cases (I mean outside of Hungary), these are more serious and didn't happen with the others. It's not simply only integration problems.

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#326
post #90
post #9

Earlier quoted context omitted.

Yep, a few people were frowning, especially since the democracy is in pretty bad shape in Hungary right know. However, in this case it works: it will be seen and remembered longer this way. Also, there were quite heated discussions on facebook, the case received a lot of attention even from non-tech people, the guy will be represented by the lawyers of a human rights association, etc. And actually there will be a pro…

"democracy is in pretty bad shape in Hungary right know" I thought that Hungary has a democratically elected government. Did I miss something?

Yes, you probably missed a few lessons in high school. When I went there, I was taught that separation of powers is an important element, amongst others. This clearly does not apply to Hungary anymore, as the highest juridical power is an inner circle person (Tunde Hando), other important positions have also been filled with Fidesz's (the ruling party) people without any consensus with the opposition. This includes the constitutional court, the president of the republic (wait, what? Hungary is not even a republic anymore :) ). The police got and executed on direct commands from the PM.

But if you don't like that, here's a short excerpt from Wikipedia: "No consensus exists on how to define democracy, but legal equality, political freedom and rule of law have been identified as important characteristics."[1]

We don't have any of these. Or, to put it in an easier to digest way: all of these have been regularly (and increasingly) violated by the govt.

As probably a fellow Hungarian who likes (is emotionally attached to) this government, I understand you are OK with it, but it doesn't make the current system any more democratic. Fun fact: the Kadar system called itself democratic too. But it's judged from the outside, for obvious reasons.

[1]: https://en.wikipedia.org/wiki/Democracy#Characteristics

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#328
post #283

In my country, the laws are draconian and totally against this kind of responsible disclosure. But being a good guy, whenever I find something I write a strongly worded email explaining why the company's IT department messed up, how to test said mess-up, and how they can hire my company to ensure these kinds of stupid things don't happen again. I've reported several of these issues, sometimes all I get is single repl…

How do you embed beacons into your emails?

https://my.server.net/beacon-uuid.png" height=1 width=1 />

Re: 18yo arrested for reporting a bug in the new Budapest e-Ticket system

#329

Not just reporting it, but having actually exploited it to confirm before reporting it, even if just to test. That was the wrong move. What should have been done was the second he had the thought that such a vulnerability could exist, he should have notified them that he believes that there is a possibility for one to alter the site code locally to gain unfair pricing, and to ask them if either he could check for the…

How do you know if the server validates the price or not, without testing it?

Do you report every site that uses HTML forms for being insecure?

Post reply on HN