Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found a vulnerability. they found a lawyer

dixken.de

Post reply on HN
Print view View original

41–50 of 466 posts

Re: I found a vulnerability. they found a lawyer

#41

Post by roywiggins »

p0w3n3d wrote: post #26
anonymous908213 wrote: post #13

Earlier quoted context omitted.

The headers alone are a huge giveaway. Spams repetitive sensatational writing tropes like "No X. No Y. No Z." and "X. Not Y" numerous times. Incoherent usage of bold type all throughout the article. Lack of any actually verifiable concrete details. The giant list of bullet points at the end that reads exactly like helpful LLM guidance. Many signals throughout the entire piece, but don't have time to do a deep dive. I…

I wonder if there's any probabilistic analyser that could confirm that the article is generated, or show which parts might have been generated

Pangram[0] thinks the closing part is AI generated but the opening paragraphs are human. Certainly the closing paragraphs have a bit of an LLM flavor (a header titled "The Pattern", eg)

[0] https://www.pangram.com

Re: I found a vulnerability. they found a lawyer

#43

Post by cptskippy »

alphazard wrote: post #39
projektfu wrote: post #19

Another comment says the situation was fake. I don't know, but to avoid running afoul of the authorities, it's possible to document this without actually accessing user data without permission. In the US, the Computer Fraud and Abuse Act and various state laws are written extremely broadly and were written at a time when most access was either direct dial-up or internal. The meaning of abuse can be twisted to mean re…

Instead of understanding all of this, and when it does or does not apply, it's probably better to disclose vulnerabilities anonymously over Tor. It's not worth the hassle of being forced to hire a lawyer, just to be a white hat.

Part of the motivation of reporting is clout and reputation. That sounds harsh or critical but for some folks their reputation directly impacts their livelihood. Sure the data controller doesn't care, but if you want to get hired or invited to conferences then the clout matters.

Re: I found a vulnerability. they found a lawyer

#44

Post by gchamonlive »

magicalhippo wrote: post #33
gchamonlive wrote: post #28

Earlier quoted context omitted.

Because you are highjacking a thread. Wanna trash the site's design, you should open a top level thread instead.

> Wanna trash the site's design, you should open a top level thread instead. Or better, don't[1]: Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting. [1]: https://news.ycombinator.com/newsguidelines.html

Exactly, thanks

Re: I found a vulnerability. they found a lawyer

#46

Post by bubblewand »

refulgentis wrote: post #9
xvxvx wrote: post #2

I’ve worked in I.T. For nearly 3 decades, and I’m still astounded by the disconnect between security best practices, often with serious legal muscle behind them, and the reality of how companies operate. I came across a pretty serious security concern at my company this week. The ramifications are alarming. My education, training and experience tells me one thing: identify, notify, fix. Then when I bring it to leader…

> These are the sort of things that are supposed to lead to commendations and promotions. Maybe I live in fantasyland. I had a bit of a feral journey into tech, poor upbringing => self taught college dropout waiting tables => founded iPad point of sale startup in 2011 => sold it => Google in 2016 to 2023 It was absolutely astounding to go to Google, and find out that all this work to ascend to an Ivy League-esque emp…

I've seen into some moderately high levels of "prestigious" business and government circles and I've yet to find any level at which everyone suddenly becomes as competent and sharp as I'd have expected them to be, as a child and young adult (before I saw what I've seen and learned that the norm is morons and liars running everything and operating terrifically dysfunctional organizations... everywhere, apparently, regardless how high up the hierarchy you go). And actually, not only is there no step at which they suddenly become so, people don't even seem to gradually tend to brighter or generally better, on average, as you move "upward"... at all! Or perhaps only weakly so.

Whatever the selection process is for gestures broadly at everything, it's not selecting for being both (hell, often not for either) able and willing to do a good job, so far as what the job is apparently supposed to be. This appears to hold for just about everything, reputation and power be damned. Exceptions of high-functioning small groups or individuals in positions of power or prestige exist, as they do at "lower" levels, but aren't the norm anywhere as far as I've been able to discern.

Re: I found a vulnerability. they found a lawyer

#47

Post by tokyobreakfast »

viccis wrote: post #18

This is somewhat related, but I know of a fairly popular iOS application for iPads that stores passwords either in plaintext or encrypted (not as digests) because they will email it to you if you click Forgot Password. You also cannot change it. I have no experience with Apple development standards, so I thought I'd ask here if anyone knows whether this is something that should be reported to Apple, if Apple will do…

>whether this is something that should be reported to Apple, if Apple will do anything

Lmao Apple will not do anything for actual malware when reported with receipts, besides sending you a form letter assuring you "experts will look into it, now fuck off" then never contact you again. Ask me how I know. To their credit, I suspected they ran it through useless rudimentary automated checks which passed and they were back in business like a day later.

If your expectation is they will do something about shitty coding practices half the App Store would be banned.

Re: I found a vulnerability. they found a lawyer

#48

Post by undebuggable »

> the portal used incrementing numeric user IDs

> every account was provisioned with a static default password

Hehehe. I failed countless job interviews for mistakes much less serious than that. Yet someone gets the job while making worse mistakes, and there are plenty of such systems on production handling real people's data.

Re: I found a vulnerability. they found a lawyer

#49

Post by gchamonlive »

anonymous908213 wrote: post #38
gchamonlive wrote: post #30

Earlier quoted context omitted.

HN's comment section new favourite sport, trying to guess if an article was generated by LLM. It's completely pointless. Why not focus on what's being said instead?

[flagged]

> This is an LLM-generated article, for anyone who might wish to save the "15 min read" labelled at the top. Recounts an entirely plausible but possibly completely made up narrative of incompetent IT, and contains no real substance.

Nothing in the original message refers to it being clickbait, the core complaint is the LLM-like tone and the lack of substance, which you also just threw it there without references ironically.

> What, exactly, is the problem with disclosing the nature of the article for people who wish to avoid spending their time in that way?

It's alright as long as it's not based on faith or guesswork.

Re: I found a vulnerability. they found a lawyer

#50

Post by dwedge »

gchamonlive wrote: post #28
dwedge wrote: post #16

Earlier quoted context omitted.

[flagged]

Because you are highjacking a thread. Wanna trash the site's design, you should open a top level thread instead.

Ah then I deserve it. I didn't notice from the app I was using that it wasn't all the way to the left
Post reply on HN