Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Responsible Disclosure Policy

github.com

Post reply on HN
Print view View original

81–85 of 85 posts

Re: Responsible Disclosure Policy

#81

Post by Karunamon »

ig1 wrote: post #79
Karunamon wrote: post #75

Earlier quoted context omitted.

>the compromise of an account not held by him puts him clearly into the "black-hat" category. That's not what "black-hat" means.

Yes it does. Gain unauthorized access to an account and using it falls under pretty much any standard definition of "black-hat" and in practical terms breaks computer security laws in pretty much all legal jurisdictions which have them.

    >Gain unauthorized access to an account and using it
Screw the motivations or the ends! The means are ALWAYS bad!

Re: Responsible Disclosure Policy

#82

Post by ig1 »

Karunamon wrote: post #81
ig1 wrote: post #79

Earlier quoted context omitted.

Yes it does. Gain unauthorized access to an account and using it falls under pretty much any standard definition of "black-hat" and in practical terms breaks computer security laws in pretty much all legal jurisdictions which have them.

>Gain unauthorized access to an account and using it Screw the motivations or the ends! The means are ALWAYS bad!

If you steal a loaf of bread to feed your family it's still a crime.

Regardless of whether or not you think what he did was justified it's still illegal. And there's very few serious crimes for which "publicity stunt" will generally be regarded as a good reason.

Re: Responsible Disclosure Policy

#83

Post by Karunamon »

ig1 wrote: post #82
Karunamon wrote: post #81

Earlier quoted context omitted.

>Gain unauthorized access to an account and using it Screw the motivations or the ends! The means are ALWAYS bad!

If you steal a loaf of bread to feed your family it's still a crime. Regardless of whether or not you think what he did was justified it's still illegal. And there's very few serious crimes for which "publicity stunt" will generally be regarded as a good reason.

> it's still illegal.

Screw the law. Thinking that right/moral == legal is a very naive view of the world.

Re: Responsible Disclosure Policy

#84

Post by celer »

nknight wrote: post #53
prophetjohn wrote: post #44

Earlier quoted context omitted.

It's not like this is a little known pitfall with Rails. Anyone who has read Hartl's Rails tutorial knows about it[1]. It's very commonly mentioned in basics for Rails security. And I say all this someone who has never professionally developed for Rails. My experience with Rails consists of a couple half-done toy projects. I find it pretty surprising that Github makes this mistake. But I don't think they should be bu…

I'm frankly amazed at how optimistic HN seems to be about "professional" coding practices. To this day I find "professional" developers writing fresh SQL injection vulnerabilities with some frequency.

People who read HN tend to be better coders than those who don't. Fizzbuzz exists because it is needed.

Re: Responsible Disclosure Policy

#85

Post by chalst »

kragen wrote: post #54

The problem I see with this blog post is something I haven't seen mentioned in the comments. It's not GitHub's place to set policy on what kind of disclosure is or isn't "responsible". Egor Homakov's responsibility is not to GitHub; his responsibility is to other users. His moral duty upon finding a security vulnerability is to act in such a way that other users will be minimally hurt. It appears that he has fulfille…

This is beautifully put.
Post reply on HN