Uber Paid Hackers to Delete Stolen Data on 57M People

Sorry, no.

It's not like Uber did one bad thing. Uber has been a fountain of terrible things for years and years. You even admit that Uber's market-dominant position has been been achieved through those terrible things. And those are only the terrible things that we've discovered despite Uber's energetic attempts to cover things up. Lord knows what horrors you're still hiding.

Until Uber loses their ill-gotten lead, I won't even consider using them.

Some times, i don't code programs. I know that's a typical of someone perceived as a hacker, but my techniques have always been a typical. For instance, it might surprise readers to know that all of the widely publicized hacks I was involved in - let's call that the "Adrian Classic" period :p - were done using a web browser and Notepad, on dialup, on Windows 98.

If you stop to think about it, this is really a true meta-hack. People who ask to learn how to hack are generally told to install Linux, learn how to code, and experiment with various hacking tools. Much how network administrators learning to secure their systems tend to get the same certifications, read many of the same books. This results in activity that's really more like jousting than hacking - a predefined pattern of attack taking place against a predefined pattern of defense. When i started Hacking, I learnt how to code, I learned to read code, and I learned how programmers thought, which assumptions they tended to make, and what mistakes their common training tended to cause them to make in common across completely different systems. One example of this is writing access code with the assumption that if failure = no then access = yes. On many systems, I found that by simply removing a username or password field, access would be automatically granted - because there had been no username or password failure, since there had been none to fail, so access was granted.

Because my methods were and are unorthodox, they are rarely detected by intrusion detection systems. They don't resemble common attacks because they aren't common attacks. I often make them up on the spot. Which is why the question "teach me to hack" is so frustrating. This is particularly emphasized by a meme pic I got a Google Alert for this morning: I always give readers free Access to reach me for all kinds of Hacking Issues though : compositehacks@gmail.com

I'm in charge of security at a large e-commerce company. I do not play golf. I mostly live in fear.

No sensible person would sign up for the CSO position if they risked jail time when their company gets hacked. You can't really control it. A random engineer could make a mistake that gets hackers a step closer. Or it could be a zero-day vulnerability that nobody knows how to protect against.

There are millions of motivated adversaries out there and a finite number of employees at your company to outsmart them. It's a game you can't win. The larger your company becomes, the broader your attack surface becomes, and the higher value a target you become.

You just have to hope that when you get hacked, it is a "forgiveable" hack like a zero-day or highly targeted attack.

If CSO's are to be personally accountable for the malicious actions of others, it needs to be due to clear negligence on their part and the responsibilities need to be clearly defined.

> In the EU, data protection rules mean they must delete all user data on request. That means every day I'm a new customer and get $20 off my first ride of $22. One day, they'll wise up and stop making such silly deals.

The behavior described here is extremely selfish and amoral. It amounts to gaming the system. Additionally, the cost of exploiting a loophole such as this will be passed on to other customers before the company stops offering a losing deal. Those customers will not be reimbursed when the offer is rescinded.

The antisocial behavior of the company would not excuse the antisocial behavior of a user acting in this way.

Good, it's important to judge a company of 10k people on one person's story. That's usually a great strategy.

I'm not defending uber, but this kind of attitude is exactly what got Trump elected. You can't generalize and demonize entities based on one person's view.