Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I found Prezi's source code

blog.shubh.am

Post reply on HN
Print view View original

71–80 of 266 posts

Re: I found Prezi's source code

#71

Post by davorak »

err4nt wrote: post #37
eli wrote: post #21

Earlier quoted context omitted.

Legally, I don't think there's much "gray" in stealing source code that doesn't belong to you.

I doubt it could have been called 'stealing' if he only accessed what was posted publicly by the authors themselves at the time. Until he contacted Prezi, how could he be certain beyond any doubt that they weren't already aware of it? Could you explain that to me?

Using login in credentials that are not your own found in a public place to take source code is like finding someones house key on a park bench and coping their secret invention designs or trade secrets.

Re: I found Prezi's source code

#72

Post by girvo »

eranation wrote: post #33

So let me get it straight, someone, aware of their bounty program or not, found their closed SOURCE CODE, and is getting a T-Shirt? How much do you value your own source code? at least 10,000$ right? ;) (probably much, much more) who cares about the scope, if someone found my wallet on the street which had 10,000$ in it, I would give them a bit more than a T-Shirt, I would buy them a whole wardrobe. Think if someone…

If you found Adobes source code, they'd probably sic the cops onto you.

Re: I found Prezi's source code

#73

Post by edem »

My problem here is that the OP did not mask the names. Actually he did quite the opposite: he bolded them. This is no good. I can imagine the dev searching for his name in google and finding that post.

Re: I found Prezi's source code

#74

Post by girvo »

Heliosmaster wrote: post #45
err4nt wrote: post #38

Earlier quoted context omitted.

Why is that? Weren't the login credentials posted publicly?

If you leave your door open and someone enters without your knowledge, would you call the police?

Christ I hate that analogy, considering the government applies it like that for us, but not when it comes to them slurping our data.

Re: I found Prezi's source code

#76

Post by darkbot »

This is definitely out of the scope of their "bughunt", although I think the guy should be rewarded anyway.

But I'm also quite upset with the fact that OP is outing the dev. Everybody makes mistakes, no need to out any individual developer because OP is pissed at the company management.

Re: I found Prezi's source code

#77

Post by TillE »

eli wrote: post #54
nowayman wrote: post #27

Earlier quoted context omitted.

Sometimes people and companies have their heads stuck so far in procedures and policies that they can't see the forests from the trees. The Finder provided tremendous value by discovering this issues and reporting it responsibly. He certainly should be rewarded with something more substantial than swag. Would Prezi have preferred that the Finder just not report this issues?

It's not like they got him on some legalistic technicality. The bug bounty clearly doesn't cover the bug he reported. And I don't usually go looking for them, but if I come across a security problem (e.g. someone left login credentials unsecured in bitbucket) I would let them know because it's the right thing to do, not because I expect cash.

It's not a technicality, but you're just saying "well, that's the policy" without considering whether the policy is the best way to accomplish certain goals. That's the point.

Re: I found Prezi's source code

#78

Post by girvo »

Yhippa wrote: post #46

Are bug bounties roughly the market value of security holes in software? I wonder if this guy or less scrupulous developers could make more for them on the black market?

If the exploits are for the right targets, you bet they're worth more on the black market, but with great reward comes great risk: now you're doing something that can possibly get you jail time.

Re: I found Prezi's source code

#79

Post by ganeumann »

6cxs2hd6 wrote: post #16

> "Anyways, they did try and get it right, by emailing me an apology as well as responding to my constructive criticism. This blog post, is by no means attempting to discourage people from participating from Prezi’s bug bounty, but rather just a blog post about how finding Prezi’s source code was not eligible for their bug bounty." Passive aggressive much? I think he should have got a bounty -- if not the official on…

I think he's just being humble: he disagrees with their policy, but isn't claiming that everyone else should just because he does--make your own decision. Fair enough.

Re: I found Prezi's source code

#80

Post by davorak »

Heliosmaster wrote: post #45
err4nt wrote: post #38

Earlier quoted context omitted.

Why is that? Weren't the login credentials posted publicly?

If you leave your door open and someone enters without your knowledge, would you call the police?

It is closer to find someones home key in a public place and deciding to see if it opens their door or not before giving it back.

You did not enter the house you did not explore. You turned the key, the knob, and made sure the door would open a little.

Not something I would recommend, especially since the key had the address and the owner name and address attached to it.

But not as bad as someone entering the home and looking around.

Post reply on HN