Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

I “found” the database of a college app (2018)

yoginth.com

Post reply on HN
Print view View original

91–100 of 107 posts

Re: I “found” the database of a college app (2018)

#91

Post by wildrhythms »

empath75 wrote: post #50

I’m not familiar with Firebase, but is it unusual for end users to have direct access to a database at all? Why isn’t there a web front end there?

Firebase has a "rules" feature where you set up security/authorization rules on your database:

https://firebase.google.com/docs/database/security#section-a...

There's a "development" mode you can enable on your database that simply ignores all of the rules. The college app either 1) has no/unsafe rules set up, or 2) left their Firebase database in development mode.

Re: I “found” the database of a college app (2018)

#92

Post by yardstick »

aitchnyu wrote: post #87
yardstick wrote: post #53

Earlier quoted context omitted.

What sort of bad weather are we talking about here? Also, is this due to the commute becoming difficult/impossible in the weather, or because the facilities/lecture theatres are leaky/poorly constructed, or something else?

For Kerala, its heavy rains. Flooded roads with open drains and deep potholes, bad electricity poles and transformers, lines touching trees etc. Engineering and business college norms require sturdy buildings and a few AC rooms.

Interesting, thanks!

Re: I “found” the database of a college app (2018)

#93

Post by treis »

nfoz wrote: post #81
powercf wrote: post #60

Earlier quoted context omitted.

The car analogy would be: He saw a car He tried the doors until he found one that was open He climbed in and searched everywhere until he found personal information about other users of the system Even though the security of this system was poor, he still (probably) broke the law. There are plenty of opportunities for people with some knowledge of IT to abuse their power, but it's our responsibility not to do so.

He looked in the window of a car and saw tons of users' personal information -- visible through the window! Any criminal could walk by and copy the info, privately, without anyone knowing. Maybe some criminals already have. I think the important thing we miss with car/physical crime analogies is that cybercrime can be so invisible. Nothing is missing, nothing is taken... but users private data is lost. So if an organ…

>He looked in the window of a car and saw tons of users' personal information -- visible through the window!

The information was still behind a door that you had to unlock. They just unwittingly sent keys to everyone.

Re: I “found” the database of a college app (2018)

#94

Post by rnotaro »

yoginth wrote: post #62
throwaway527694 wrote: post #58

Did someone verify any of this? If I recall correctly this `yoginth` is a known fraudster. See: https://twitter.com/sindresorhus/status/1015873644377935874 or https://twitter.com/natfriedman/status/1059865722904440833

Hey, that is too old and I have done it without knowledge, it's my mistake and I apologized for all of them personally and publicly! Here this app belongs to my college, it's my attendance and work is mine!

Even his other blog post are plagiarizing this Github Blog post.

GH: https://github.blog/2018-03-01-ddos-incident-report/

Yoginth: https://archive.is/EfMFq

Re: I “found” the database of a college app (2018)

#95

Post by manfredo »

MRD85 wrote: post #33

The media would have a field day and say that he hacked his school database. It's crazy how so many institutions are doing the digital equivalent of leaving an unlocked car in a bad neighbourhood and no one holds them accountable. Most people understand the concept of an unlocked car, not many understand that he didn't do anything special to hack his school db. He just strolled right in.

He downloaded the apk and extracted the database key from it. This is probably beyond the means of >98% of people of people. To be fair there have been instances were literally just editing the route on a URL to view a different document has resulted in hacking charges, I wouldn't go to such great lengths to defend this guy.

If you go up to someone's house and look under their welcome mat and find a key, is it okay to unlock the door and stroll in with the rationale that the poor security counts as consent to enter?

Re: I “found” the database of a college app (2018)

#96

Post by tastroder »

ajross wrote: post #88
pbhjpbhj wrote: post #83

Earlier quoted context omitted.

I think this is where analogies between physical theft/trespass and digital access break down. Pressing the handle down, maybe even opening a door, but not walking in and not taking anything. No theft, no trespass. AFAIK in my local laws trespass requires entry and theft requires carrying-off. Indeed -- apparently -- you're legally allowed to enter abandoned properties if you don't break-in. That to me is equivalent…

> When it becomes immoral is when you use that data, or make it available for use by others. That's logically consistent but shockingly permissive. And to be frank, I don't believe for a second this is really a principled opinion on your part, it's an excuse. You'll get behind the hacker linked on HN out of solidarity or for some other personal reason (maybe you hate schools, or java). You'd never forgive someone for…

> Be real.

This is apparently a curious student that discovered a vulnerability and, judging by the way that blog post is written, is unsure how to properly disclose it. If this was your Facebook analogy, they'd have a relatively visible path to disclose that. Here, they have to potentially fear being reprimanded or criminally charged.

Under the premise that yes, granted, all that might technically qualify for some criminal act: The aspect of intent and malice are, imho, important in these discussions and should be for the corresponding laws. They found a vendor negligently handling student data, instead of dumping it somewhere, making a fuzz in the press or using it for something they try to disclose it (at least I'd hope so). It's not like the author abused that data, they tried out a proof of concept to see if access to other users could be gained. Not just out of solidarity that's something we should applaud and shield, instead of branding it as criminal behaviour.

For me this is more akin to past cases of people being reprimanded for trying to change URL parameters that are not sufficiently protected, while I see that it might be a philosophical standpoint rather than a legal one, I think the fine in these cases should go to the negligent company, not some curious individual without malicious intent.

Re: I “found” the database of a college app (2018)

#97

Post by prashnts »

throwaway527694 wrote: post #58

Did someone verify any of this? If I recall correctly this `yoginth` is a known fraudster. See: https://twitter.com/sindresorhus/status/1015873644377935874 or https://twitter.com/natfriedman/status/1059865722904440833

Pretty sure it’s the same person from what I could find out from archive.org snapshots. I followed this trail:

- From the tweet you linked, it’s clear that they owned yoginth.ml

- Archive of the homepage links to a gitlab profile [1] which uses the same profile picture and style of writing as their current gitlab profile.

- The page linked to yoginth.ml, and subsequent snapshots of page show it changed to yoginth.com (the current domain).

Additionally, I noticed that they mentioned that they work at “DocsPen”. Quick google linked to a repository with years of history (evident from the migrations page), but everything committed in 2017. Looked up, and it’s essentially another unattributed copy of BookStackApp with licenses changed and s/BookStack/DocsPen.

Unfortunately, it seems its a case of naive plagiarism and not knowing what counts as fraud. I say this because there’s enough information to get their entire identity (I’m not gonna post a link to that) and it’s clearly a school kid who’s misguided enough. If OP reads this, I’d suggest them to reflect upon their actions, (or cover their tracks more carefully). Sooner or later, if authorities get involved it won’t be difficult for them (I just did archive.org search on my phone). I feel a bit more aware of this because I studied at Delhi University and I knew a few people who did/do similar things to get enough attention and build a resume.

[1] https://web.archive.org/web/20180213200624/https://gitlab.co...

[2] https://web.archive.org/web/20190312041322/https://gitlab.co...

[3] https://github.com/DocsPen/DocsPen/tree/master/database/migr...

[4] https://github.com/BookStackApp/BookStack/tree/master/databa...

Re: I “found” the database of a college app (2018)

#98

Post by dang »

surelyyoujest wrote: post #65
yoginth wrote: post #62

Earlier quoted context omitted.

Hey, that is too old and I have done it without knowledge, it's my mistake and I apologized for all of them personally and publicly! Here this app belongs to my college, it's my attendance and work is mine!

You've built an entire online presence by copying everything from other people's work - from your blog theme to your content "without knowing"? Adorable. Also, by briefly reading the docs on the "platform" you are trying to peddle, I'm getting fairly certain you also copied that as well, as it is too well written in comparison to the drivel on your blog.

Please don't gang up on someone like this on HN. It's fine to challenge incorrect information, but not to aggressively humiliate them.

https://news.ycombinator.com/newsguidelines.html

Re: I “found” the database of a college app (2018)

#99

Post by chacha2 »

aianus wrote: post #86
stedaniels wrote: post #49

Earlier quoted context omitted.

This is mind boggling. Failing someone for missing one or two classes is ludicrous, but giving someone a certificate who didn't engage with the course is equally so. University education isn't about the destination/exam it's about the journey.

> University education isn't about the destination/exam it's about the journey. Showing up for lectures is by far the least important part of the journey. It's a passive activity that usually adds zero value versus watching lessons on YouTube or reading the textbook. The real learning (IMO) is in doing the assignments, networking with people in your residence, social activities, internships, etc.

A degree is a class signifier, its only value is that it costs.

Most degrees you'll have to teach yourself and then when you graduate you get to advertise that you were willing to submit mindlessly to the system and do as you were told. Both of which are very valuable to employees.

Re: I “found” the database of a college app (2018)

#100

Post by ssddanbrown »

prashnts wrote: post #97
throwaway527694 wrote: post #58

Did someone verify any of this? If I recall correctly this `yoginth` is a known fraudster. See: https://twitter.com/sindresorhus/status/1015873644377935874 or https://twitter.com/natfriedman/status/1059865722904440833

Pretty sure it’s the same person from what I could find out from archive.org snapshots. I followed this trail: - From the tweet you linked, it’s clear that they owned yoginth.ml - Archive of the homepage links to a gitlab profile [1] which uses the same profile picture and style of writing as their current gitlab profile. - The page linked to yoginth.ml, and subsequent snapshots of page show it changed to yoginth.com…

Yeah, Docspen was a copy of BookStack. Was a really awkward and difficult thing to handle as maintainer with BookStack being my first popular OS project. It was done very purposeful in an odd way. I remember that issues, filed by BookStack users, were being re-created on the docs pen repo by (potentially fake?) docspen maintainers with pretty much the same text.

Yoginth would then commonly create issues on the BookStack repo, many of which would be issues with DocsPen and not BookStack, and would email me asking to deploy new releases. I remember being at-a-loss of how to handle it, I raised my concerns [1] and asked for advice on reddit[2]. The docspen repo then suddenly moved to GitLab before being hidden. Yoginth then deleted all issues and comments made in the BookStack repo, or this may have been just part of a full account deletion.

[1] https://web.archive.org/web/20180130085921/https://github.co... [2] https://www.reddit.com/r/opensource/comments/7v7yl5/advice_n...

Post reply on HN