Live data from Hacker News

Governor vows criminal prosecution of reporter who found flaw in state website

missouriindependent.com

701–705 of 705 posts

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#701

Earlier quoted context omitted.

"push" means the data is pushed. as in without a request from you. it's mind boggling how you are not getting this. exchange is an example of this - you get email pushed to a listener on your mail client, without requesting that data. if you use pop3 however, you request the data and receive a response. you are arguing a request - a GET - the literal opposite of a push, is a push. this is something anyone who has use…

We don't have to continue the discussion but I'll wrap this up regardless for the peanut gallery. As I've mentioned, my metaphor is request, response. This additional data is included, unsolicited, piggybacking on the response. I think this is clear. Regarding the crime, no, this is completely incorrect. It sounds like you're referencing 18 USC § 1030. This law cannot apply whatsoever to this situation because there…

But where are you getting your whole "piggybacking" idea from? The original story was that the user "verified" that he could get anyone's data by changing an integer in the URL. Typing a new URL into his browser makes it, in Web terms, a new request, not anything "piggybacking" on an old one.

So the data was pushed, very much solicited, as part of a new access. That the user's browser held an authorization (cookie?) for a previous access to the user's own data doesn't quite, AFAICS, mean that this new access to other data was also actually authorized.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#702

Earlier quoted context omitted.

You lost me at "maliciously". What harm was done by someone comparing prices? What organization lost money? Who got worse health service? "Unethical" and malicious is the current, profit-driven health insurance system. I know you're coming at it from an absolutist perspective, but I disagree entirely with passing judgement. Furthermore, the fact that you seem more upset with the person who glanced at a few plan price…

>What harm was done by someone comparing prices? It removes the information asymmetry, which protect the profits of the seller.

Exactly. So, no harm to any real people.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#703
post #352

Quote from the St Louis Post Dispatch article is even more groan-worthy: "In the letter to teachers, Education Commissioner Margie Vandeven said “an individual took the records of at least three educators, unencrypted the source code from the webpage, and viewed the social security number (SSN) of those specific educators.” I guess webpages are kinda like encryption for idiots.

We live in a world where everyone thinks they understand computers and have an expectation of security and privacy, but they don't realize how hard it is to build these systems correctly. The best security appears to be invisible to the consumer, but requires a lot of thought by the implementer. This is the same reason why I think most of the general public don't understand how much data social media apps can collect…

> it would be interesting if iOS provided a service that allowed data to never leave the phone

But it would probably be even more interesting if you could send out, say, the adress of a Web page you wanted to see in your browser.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#704
To be frank, I believe this is one of the factors driving people with such skills into black-hat hacking. If they're going to get slammed for using their skills, they may as well get paid in the process.

It's a damn shame such political dinosaurs have such a major impact in hacking.

Re: Governor vows criminal prosecution of reporter who found flaw in state website

#705

Earlier quoted context omitted.

Option+Command+U :)

Three steps! What hacker could envision such an elaborate plan?

Don't worry. A listener for contextmenu with a good ol' preventDefault() will stop those pesky hackers!
Post reply on HN