Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found a vulnerability. they found a lawyer

dixken.de

Post reply on HN
Print view View original

441–450 of 466 posts

Re: I found a vulnerability. they found a lawyer

#441

Post by kortilla »

godelski wrote: post #391
kortilla wrote: post #370

Earlier quoted context omitted.

How do you explain the low quality of software coming out of all of the other countries you have mentioned with protected titles? The software is happening regardless of title and you haven’t given any examples of the value of where kissing the ring to get the certification has been critical to Canada/Germany/Switzerland producing better software.

Are all programmers called engineers in these countries? You've made such a wild assumption that I'm convinced you're more interested in fighting then discussing

No, im looking for literally any evidence that the quality of software that comes from areas that require the protected name is better than something like the NASA coding guidelines.

Re: I found a vulnerability. they found a lawyer

#442

Post by kortilla »

pjmlp wrote: post #392
kortilla wrote: post #370

Earlier quoted context omitted.

How do you explain the low quality of software coming out of all of the other countries you have mentioned with protected titles? The software is happening regardless of title and you haven’t given any examples of the value of where kissing the ring to get the certification has been critical to Canada/Germany/Switzerland producing better software.

There are engineers, and there are brick layers. You mean Android's great quality, or Chrome CVEs by the way?

I mean the quality of people following NASAs C style guidelines.

Where is there any evidence that people using the protected title are producing higher quality software than companies in equivalent industries in the US?

Re: I found a vulnerability. they found a lawyer

#443

Post by kortilla »

pjmlp wrote: post #428
joe_mamba wrote: post #394

Earlier quoted context omitted.

Just because you have an engineering degree doesn't mean your code is of better quality and security than someone without an engineering degree. Signed, someone with an CS engineering degree.

It surely means one has the responsibility to be one as such, having had the education that others have not.

No it doesn’t. Getting an engineering degree does not allow you to use the protected title.

The protected titles are gate kept by associations and are not tied to knowledge.

Re: I found a vulnerability. they found a lawyer

#444

Post by kortilla »

1970-01-01 wrote: post #372
kortilla wrote: post #364

Earlier quoted context omitted.

That’s not how it works. You are not ethically responsible to hack every company you interact with.

No, that's exactly how it works when you're Certified. https://www.giac.org/policies/ethics/ "I will protect confidential and proprietary information with which I come into contact."

No it’s not. Unless you’re certified by the government that carries no weight.

That’s no different than “sovereign citizens” claiming they have rights to drive without licenses.

Re: I found a vulnerability. they found a lawyer

#445

Post by habinero »

DANmode wrote: post #437
habinero wrote: post #432

Earlier quoted context omitted.

That's still not your concern or your problem. You're not internet Batman. Opening up yourself to criminal liability for someone else's site is insane.

Lots of good white and grey hats have used anonymity to report for this exact reason. Whether or not you feel it’s your concern (or “problem”) depends on your thoughts on moral responsibility to others in your society.

Yeeeeah, that's not how it works lol. Anyone who does offensive security for more than 5 minutes understands how little protection they have. And true anonymity is much, much harder than you think.

If you act in certain ways, you will probably not get in trouble but I have a lawyer on retainer for a reason lol

The harsh truth is you aren't protecting anything by doing this, because you can't control how (or if!) they fix the problem. All you're doing by accessing the data is for-real committing a felony, and that is an incredibly stupid thing to do.

Re: I found a vulnerability. they found a lawyer

#446

Post by DANmode »

SpicyLemonZest wrote: post #213
DANmode wrote: post #203

Earlier quoted context omitted.

Showing up without a PoC complicates things.

I understand why the author thought that way, but showing up with private data that the company is obligated to protect complicates things quite a lot more. I've dealt with security issues a number of times over my career, and I'm genuinely unsure what my legal obligations would be in response to an email like this. He says the company has committed "multiple GDPR violations"; is there something I need to say in resp…

> is there something I need to say in response to preserve any defenses the company may have or minimize the fines?

Company should have SOPs for this.

Re: I found a vulnerability. they found a lawyer

#447

Post by spixy »

nicce wrote: post #227
vaylian wrote: post #226

Earlier quoted context omitted.

How do you generate the email addresses? Do you run your own e-mail server or do you use a third-party service?

Own the domain put catch-all for that domain. No need to generate anything.

How did you solve problem, when your emails are put into spam folder in gmail?

Re: I found a vulnerability. they found a lawyer

#448

Post by masswerk »

karagenit wrote: post #433
masswerk wrote: post #347

Earlier quoted context omitted.

For clarification, here's the actual quote from the article describing the process: > I verified the issue with the minimum access necessary to confirm the scope - and stopped immediately after. No notion of a script, "every password" out of a set of a single default password may be open to interpretation, no mention of data downloads (the wording suggests otherwise), no mention of actual number of accesses (the text…

True, but the article also says: > That's it. No rate limiting. No account lockout. To me, if he confirmed that there’s no rate limiting on the auth API, this implies a scripted approach checking at least tens (if not more) of accounts in rapid succession.

Granted. I guess, unless it's applied very aggressively, assessing the existence of rate limiting may require some sort of automation (and probably some heuristics – how much data points do you actually need? do you have to retrieve any data at all, while looking for a single signal? The article doesn't tell.) Same goes for lockout.

On the other hand, as mentioned already, all that's required is really looking for a return code and not for any data. Is accessing an API endpoint the same as retrieving data? Is there proof or evidence of intent of the latter? I guess, there remains much to be defined. Especially, if it's not so much about protecting reputation than it is about protecting data and ensuring trust, and the intent is to protect and secure this in the first place.

Re: I found a vulnerability. they found a lawyer

#449

Post by deaux »

paulryanrogers wrote: post #341
deaux wrote: post #324

Earlier quoted context omitted.

They'll just be incorporated in Ireland who are more than happy to be a haven for such criminals.

Where can I read more about this?

Just based on my comment the search query "Ireland compliance haven" would work, but for a more specific one, "ireland DPC big tech before:2026". The "before" is needed because else you'll only get news from a week ago exuberantly claiming that they're changing their behaviour.

Handling of their cases [0]. Suing the EU when it instructs them to investigate Meta's breaches, rather than doing the investigation [1].

> Former Meta lobbyist Niamh Sweeney will co-lead the Irish Data Protection Commission from mid-October. [2]

> A corporate lawyer who has worked for Big Tech played a key role in picking [her].

The DPC is the one responsible for going after GDPR violations. On the level of "Saudi Aramco lobbyist will co-lead the Environmental Protection Board". A lobbyist for the single worst offender in the entire world. You couldn't make it up. If you put it in a movie people would say it's too on the nose.

[0] https://noyb.eu/en/project/dpa/dpc-ireland

[1] https://iapp.org/news/a/court-upholds-edpb-s-authority-after...

[2] https://www.politico.eu/article/big-tech-lawyer-key-in-picki...

Re: I found a vulnerability. they found a lawyer

#450

Post by DANmode »

habinero wrote: post #445
DANmode wrote: post #437

Earlier quoted context omitted.

Lots of good white and grey hats have used anonymity to report for this exact reason. Whether or not you feel it’s your concern (or “problem”) depends on your thoughts on moral responsibility to others in your society.

Yeeeeah, that's not how it works lol. Anyone who does offensive security for more than 5 minutes understands how little protection they have. And true anonymity is much, much harder than you think. If you act in certain ways, you will probably not get in trouble but I have a lawyer on retainer for a reason lol The harsh truth is you aren't protecting anything by doing this, because you can't control how (or if!) they…

> And true anonymity is much, much harder than you think.

You take steps that match the threat model - if it’s important enough to you.

Not everything found is.

Some things are.

Post reply on HN