Found and *exploited*. Hence belongs behind bars.
Governor vows criminal prosecution of reporter who found flaw in state website
631–640 of 705 posts
Re: Governor vows criminal prosecution of reporter who found flaw in state website
#632Earlier quoted context omitted.
> The politicians are awful, but in a democracy, the fault for that lies 100% with the people. Democracy is a convenient way for the ruling class to hand-pick the people who are allowed to run for office and blame the voters for any bad results. There's research showing that there's very little correlation between the policy goals of the voting public and policy outcomes, but there's a strong correlation between poli…
seems tautological. If you accept that there is such a thing as a 'ruling class', then presumably the only way to define them is 'the people who get their policy goals accomplished'. Because that's what 'ruling' means.
It seems awfully naive to pretend there isn't a class that generally is catered to by government. They're typically some or all of these:
- in the top .1% of net worth
- in executive leadership positions
- attend elite universities
- frequently possessing generational wealth
I hope this helps.
Re: Governor vows criminal prosecution of reporter who found flaw in state website
#633Earlier quoted context omitted.
Analogies are never helpful for things like this. We don't need to reach for analogies to observe that while the theoretical ideal is to report it after just one false access, that no significant damage was done by accessing just a few more via human manipulation of the browser URL, with no recording or sharing of the results. From a human perspective, no damage was done. Whether that legally crosses a line involves…
There's no evidence from the original comment that anyone invoked any legal lines. Instead, they seem to be upset that the person they reported the incident to asked them questions about exactly what they did rather than being effusively grateful.
I added it, anticipating future comments.
Re: Governor vows criminal prosecution of reporter who found flaw in state website
#634Earlier quoted context omitted.
But this is assuming that the server has more agency than it does. No, it merely assumes the server is acting on authority of the organization identified by the domain name. It doesn't assume agency, only representation.
Which also seems nuts. Like they’re servers. How anyone assumes that some Ruby code can be acting as an authoritative representative of the government is silly.
Yes, how could anyone assume that the ATM down the street can be acting as an authoritative representative of your bank when you insert your card? That's just silly.
/s
Re: Governor vows criminal prosecution of reporter who found flaw in state website
#635After the Affordable Care Act went into effect I signed our company up for our state's marketplace. While browsing our plan options, I noticed the url used a scheme like marketplace.org/employers/341/plans.aspx. Of course, I tried changing the number in the url to 342 to see what happened. To my astonishment, it loaded up the next company's plans, including a list of employee names, ages, plan cost, and SSNs. After I…
People have gone to jail for incrementing integers in URLs like that (most famously, weev).
in some public transport company ticket ordering website, someone discovered that the ticket's price parameter is coming from the client side. he decided to bought a very cheap one, then reported the incident. next day the National Terror Defence knocked on his door.
Re: Governor vows criminal prosecution of reporter who found flaw in state website
#636One time I walked down a little-used alley and noticed my neighbor had left his garage door open. The open door was not visible from the street but anyone who happened to walk down the alley would have seen it. I called the neighbor to tell him he might want to close his garage door. He accused me of burglary and called the cops. No this didn't actually happen but it's the analogy that came to mind.
It’s more like your neighbor put his social security number on a big sign in his window and then another sign that said “please don’t look at the other sign.”
Re: Governor vows criminal prosecution of reporter who found flaw in state website
#637Quote from the St Louis Post Dispatch article is even more groan-worthy: "In the letter to teachers, Education Commissioner Margie Vandeven said “an individual took the records of at least three educators, unencrypted the source code from the webpage, and viewed the social security number (SSN) of those specific educators.” I guess webpages are kinda like encryption for idiots.
I feel like not understanding basic things like that should get you fired. The Education Commissioner and Governor of the State of Missouri have demonstrated a lack of understanding of basic technologies. At this point, that means they lack core competencies to do their job, and should be fired.
I would totally not expect an old white guy politician to be up on web protocols. No worries about that.
He either has staffers who told him the real issues and he discounted them to score points, or hired incompetent staffers who gave him B.S., or he hasn’t found anyone to give him the real info. Those are the disqualifiers.
Memories of Mitt Romney appearing to actually dig into tunneling and adhesives during an investigation of Big Dig flaws in Massachusetts. He might have been posturing but at least it was the right posture.
Re: Governor vows criminal prosecution of reporter who found flaw in state website
#638Re: Governor vows criminal prosecution of reporter who found flaw in state website
#639Re: Governor vows criminal prosecution of reporter who found flaw in state website
#640Earlier quoted context omitted.
Which also seems nuts. Like they’re servers. How anyone assumes that some Ruby code can be acting as an authoritative representative of the government is silly.
Yes, how could anyone assume that the ATM down the street can be acting as an authoritative representative of your bank when you insert your card? That's just silly. /s
But that’s exactly right! It’s not. If the machine has a bug and reports the wrong balance or gives you too much or not enough money on withdrawals it’s explicitly not authoritative and you can get it corrected by an actual representative of the bank.