41–49 of 49 posts
Be super careful with this, you had innocent intent, but that doesn’t mitigate the fact that you potentially broke the law (and regardless of whether you did or not, that won’t stop feds busting in the door). Some places will take reports like that gratefully, others will do everything in their power to make you out to be the bad guy.
At least they cared. I found an enumeration attack on an Australian referral service where phone numbers were keys and it returned way too much personal information. Responsibly disclosed numerous times, LinkedIn contacted employees. Not even acknowledged and at last check, still open vulnerability.
Earlier quoted context omitted.
Under New Zealand's Crimes Act, all unauthorised access is illegal. This has been used in court to cover places where someone was not pre-approved, rather than just a policy that gives an implied acceptance. It has also been used where someone has accidentally gained access via insecured systems. I would not be so confident in stating that they did not break the law.
Any half-decent VDP will have a safe harbour clause. Otherwise ot isn't a true VDP but rather just contact details.
Earlier quoted context omitted.
PHP was blamed for a good reason: for a long time it did not by default support prepared SQL statements. You could install the mysqli extension to gain such support but that was almost never available on shared web hosts.
And every tutorial you could find on how to use PHP with a database was a tutorial on how to add SQL injection to your site.
And yet similar classes of bugs still pops up today, even with what I would've assumed to be safe defaults? I'm guessing its non-standard databases or DB clients or something?
This case is more just a pure lack of sanitisation, but it's fascinating to see in 2025 still :)
At least they cared. I found an enumeration attack on an Australian referral service where phone numbers were keys and it returned way too much personal information. Responsibly disclosed numerous times, LinkedIn contacted employees. Not even acknowledged and at last check, still open vulnerability.
Australia and New Zealand are insanely careless with personal data. I was shocked when I was asked to write my credit card details, including cvv, on a piece of paper in a beachside surfboard rental shop
I used a freshly generated virtual credit card with payment amount +20$ as a limit (just to be sure).
Earlier quoted context omitted.
Under New Zealand's Crimes Act, all unauthorised access is illegal. This has been used in court to cover places where someone was not pre-approved, rather than just a policy that gives an implied acceptance. It has also been used where someone has accidentally gained access via insecured systems. I would not be so confident in stating that they did not break the law.
Any half-decent VDP will have a safe harbour clause. Otherwise ot isn't a true VDP but rather just contact details.
Australia and New Zealand are insanely careless with personal data. I was shocked when I was asked to write my credit card details, including cvv, on a piece of paper in a beachside surfboard rental shop
Pine Gap is the world’s largest network tap, after all, invalidating the human rights of close to 2 billion people, every single second of the day.
The nation was bred to be so compliant. Australians are not afraid of licking boots if it means cheap avocados can be smashed.