Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How to send DMs on Twitter without permission

homakov.blogspot.com

Post reply on HN
Print view View original

41–50 of 60 posts

Re: How to send DMs on Twitter without permission

#41

Post by derefr »

drewcrawford wrote: post #28
md224 wrote: post #19

Earlier quoted context omitted.

Of course you understand it, but do you agree with it? If you seek out bugs in a company's code with the expectation that you'll be rewarded for it, and then the company fails to reward you, I can see that it might be perceived as unfair, especially if the company indicated that such an expectation was reasonable. If you happen across a bug in a company's code, and then publicize it because they aren't going to pay y…

Well given that homakov has found this bug, there are a few possibilities: A. Homakov could do nothing. This leaves Twitter in the same state that it is now, but it if everybody did this, it is likely that nefarious people would find and exploit bugs in Twitter B. Homakov could donate his time, as a skilled and highly-trained professional consultant, to a $32bn publicly-traded company C. Homakov could practice full d…

> B. Homakov could donate his time, as a skilled and highly-trained professional consultant, to a $32bn publicly-traded company

This is probably the best option, but only if you approach it the same way most contractors do when offering a discount/free service for a client.

When you do free work, don't say it's free -- instead, say that you're offering a 100% discount. Sent your client an invoice for the price you'd regularly charge for such a thing, with the entire price deducted off at the bottom. Include a note saying that this is an offering of goodwill, and that you hope this will help in building a relationship with them in the future.

Leave the client to decide for themselves whether this means that your future vulnerability reports will come without this discount, and see what they say in response.

Re: How to send DMs on Twitter without permission

#42

Post by hnriot »

derefr wrote: post #41
drewcrawford wrote: post #28

Earlier quoted context omitted.

Well given that homakov has found this bug, there are a few possibilities: A. Homakov could do nothing. This leaves Twitter in the same state that it is now, but it if everybody did this, it is likely that nefarious people would find and exploit bugs in Twitter B. Homakov could donate his time, as a skilled and highly-trained professional consultant, to a $32bn publicly-traded company C. Homakov could practice full d…

> B. Homakov could donate his time, as a skilled and highly-trained professional consultant, to a $32bn publicly-traded company This is probably the best option, but only if you approach it the same way most contractors do when offering a discount/free service for a client. When you do free work, don't say it's free -- instead, say that you're offering a 100% discount. Sent your client an invoice for the price you'd…

what a dumb idea! I can't even tell if you're being serious.

Re: How to send DMs on Twitter without permission

#43

Post by homakov »

hnriot wrote: post #42
derefr wrote: post #41

Earlier quoted context omitted.

> B. Homakov could donate his time, as a skilled and highly-trained professional consultant, to a $32bn publicly-traded company This is probably the best option, but only if you approach it the same way most contractors do when offering a discount/free service for a client. When you do free work, don't say it's free -- instead, say that you're offering a 100% discount. Sent your client an invoice for the price you'd…

what a dumb idea! I can't even tell if you're being serious.

Never tried it but obviously it wont work. It is easier to start with actions than with dialog here.

Re: How to send DMs on Twitter without permission

#44

Post by bigiain »

drewcrawford wrote: post #28
md224 wrote: post #19

Earlier quoted context omitted.

Of course you understand it, but do you agree with it? If you seek out bugs in a company's code with the expectation that you'll be rewarded for it, and then the company fails to reward you, I can see that it might be perceived as unfair, especially if the company indicated that such an expectation was reasonable. If you happen across a bug in a company's code, and then publicize it because they aren't going to pay y…

Well given that homakov has found this bug, there are a few possibilities: A. Homakov could do nothing. This leaves Twitter in the same state that it is now, but it if everybody did this, it is likely that nefarious people would find and exploit bugs in Twitter B. Homakov could donate his time, as a skilled and highly-trained professional consultant, to a $32bn publicly-traded company C. Homakov could practice full d…

And:

D. He could have sold the discovery to someone who'll pay him for it, then have them go on to abuse it to send DM spam to twitter users.

I have no doubt at all that homakov could have sold his discovery for at least as many dollars as any of the well known bug bounties would have rewarded him - if his motivations were purely mercenary…

Re: How to send DMs on Twitter without permission

#45

Post by username223 »

sillysaurus2 wrote: post #22
md224 wrote: post #19

Earlier quoted context omitted.

Of course you understand it, but do you agree with it? If you seek out bugs in a company's code with the expectation that you'll be rewarded for it, and then the company fails to reward you, I can see that it might be perceived as unfair, especially if the company indicated that such an expectation was reasonable. If you happen across a bug in a company's code, and then publicize it because they aren't going to pay y…

Not only that, but if Twitter was feeling cruel, they could drag him through court (if he's based in the US). That would be a nuclear option, but, when your future welfare is on the line, you really shouldn't screw with companies. Twitter obviously wouldn't drag a hacker to court. I'm saying, in general, don't do this, because other companies might. http://en.wikipedia.org/wiki/Randal_L._Schwartz#Intel_case

"when your future welfare is on the line, you really shouldn't screw with companies"

Lie back and think of England.

He's not US-based, so he can freely give them the finger. Good for him.

Re: How to send DMs on Twitter without permission

#46

Post by homakov »

sillysaurus2 wrote: post #38
homakov wrote: post #24

Earlier quoted context omitted.

Hm, are you sure cracking password and writing about a bug which you didn't exploit on other users are the same thing?

Would you like to keep testing whether a prosecutor is daring enough to bring charges against you, especially in this social climate? It's not paranoia. Once you start straying from the path of responsible disclosure, the path to danger is quite short. In this case, I think you're in no real danger since it's Twitter. So don't worry. But if it were some other company, though, you wouldn't be able to rely on goodwill…

everything is possible. Furthermore, in Russia where i used to live, they don't need any charges, they can make them up from nothing.

Re: How to send DMs on Twitter without permission

#48

Post by onedev »

joelandren wrote: post #13
mergy wrote: post #9

Come over to App.net. It will be a while before the masses ruin that. Free invite link >> https://join.app.net/from/fjjgdclsjq

Oh, I don't think you have to worry about the masses ever ruining App.net

I think I'll avoid it as well. I wouldn't want to accidentally ruin it.

Re: How to send DMs on Twitter without permission

#49

Post by yohanatan »

derefr wrote: post #41
drewcrawford wrote: post #28

Earlier quoted context omitted.

Well given that homakov has found this bug, there are a few possibilities: A. Homakov could do nothing. This leaves Twitter in the same state that it is now, but it if everybody did this, it is likely that nefarious people would find and exploit bugs in Twitter B. Homakov could donate his time, as a skilled and highly-trained professional consultant, to a $32bn publicly-traded company C. Homakov could practice full d…

> B. Homakov could donate his time, as a skilled and highly-trained professional consultant, to a $32bn publicly-traded company This is probably the best option, but only if you approach it the same way most contractors do when offering a discount/free service for a client. When you do free work, don't say it's free -- instead, say that you're offering a 100% discount. Sent your client an invoice for the price you'd…

You're missing a key difference. Twitter didn't commission the work performed here. Sending an invoice for work that wasn't requested is not only dumb, it's offensive.

Re: How to send DMs on Twitter without permission

#50

Post by chii »

md224 wrote: post #32
tripzilch wrote: post #25

Earlier quoted context omitted.

> People really shouldn't orient their moral systems around money. Neither do corporations, but whenever you hear anyone say "corporations shouldn't base their moral systems around money", then it's all about "free market", "profit" and "shareholder values". I'm not saying I'd do the same in this case, but it's a bit of a stretch to assume people-people morals apply to people-corporate situations.

> Neither do corporations, but whenever you hear anyone say "corporations shouldn't base their moral systems around money", then it's all about "free market", "profit" and "shareholder values". I'm not sure if you're trying to highlight an aspect of communal hypocrisy, but I will say that I wouldn't be one of the people shouting back stuff about "shareholder values" in response to a call for corporate social responsi…

> If you do something kind for a corporation .... then you're essentially doing something kind for the people that work there.

that is absolutely not true. A person doing a favour for a corporation will not get the result as doing a favour for an individual.

The corporation isn't a group of people - its a group of people under some control of a few. Their common cause is not the common cause of the employees, but that of those few in control. And i said 'is', because the corporation only h as one cause - to make profit, any way possible.

Do not ever place any loyalty, or sympathy for corporations. Do not expect them to behave morally, or altruistically. It will only end badly for you. Try to extract as much value out of a corporation as you can, just as they do to you.

Post reply on HN