Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting

krebsonsecurity.com

Post reply on HN
Print view View original

91–100 of 144 posts

Re: Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting

#91

Post by tppiotrowski »

handrous wrote: post #75
elliekelly wrote: post #19

Earlier quoted context omitted.

I would absolutely love to know who provided that estimate and how they arrived at that number. I understand that issues are often far more complex than they appear but this just seems ridiculous.

Turns out a bunch of other systems rely on this bug to fetch information, and no-one's entirely sure where they are, who's responsible for them, or what they do. Also the page is auto-generated though some arcane CMS such that it's really hard to figure out how to get the data off that page while keeping it other places where it needs to be, without restructuring the whole thing. Also deployment is manual and you'll…

Cheap solution: put a proxy in front like Cloudworker/Lambda and modify the HTML before it gets sent to client.

Re: Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting

#92

Post by dragontamer »

vipa123 wrote: post #39
jrs235 wrote: post #37

Earlier quoted context omitted.

This is why my outlook on the future is growing dim. Politicians are threatening revenge, using the power and purse of the state, against people who embarrass them.

This is as old as the country itself, the constitution is stronger than these thugs.

Alien and Sedition acts argue otherwise.

I do believe the 2nd President successfully jailed journalists for this for years, leading to the Supreme Court deciding to you know, do something about it.

Things are only as strong as the political will believes they are strong. There was a period in the 1800s where the Supreme Court was ignored for example. The Supreme Court of the late 1700s did want to protect the 1st Amendment and they did win the political battle vs Adams. But under different circumstances, a different result could have very much happened.

Re: Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting

#93

Post by mikeyouse »

Gunax wrote: post #52

This is exactly what happened to weev. He found that information that was intended to be private was made publicly available by AT&T. Weev went to prison for typing in URLs that he should not have. They were criminal URLs, just loke thess.

Kind of... The AT&T data wasn't public, Weev & Co. had to build a script to generate plausible ICCIDs which they then 'challenged' the AT&T servers with the URL containing the ICCID. If it was a valid iPad ICCID and registered with AT&T, the server would reply with the email address registered to it.

That seems materially different to just F12ing a website and seeing plaintext Social Security numbers.

Re: Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting

#94

Post by lostcolony »

tshaddox wrote: post #89
WarOnPrivacy wrote: post #4

Missouri Gov. Mike Parson (R) .. vowed his administration would seek to prosecute and investigate .. anyone who aided the publication in its "attempt to embarrass the state and sell headlines for their news outlet." Embarrassing governments is the natural outcome of the press doing it's job. This is what the extra constitutional protections are for.

And suppressing opposition is the natural outcome of the government doing its job. The problem isn’t whether one group or another is “doing its natural job.” The problem is that what the reporter is doing is good, and what the government is doing is bad.

"And suppressing opposition is the natural outcome of the government doing its job. " - no it isn't. It's the natural outcome of shitty people being elected. The JD isn't "jackboots on necks" or whatever.

Re: Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting

#95

Post by giaour »

> there was no option to decode Social Security numbers for all educators in the system all at once

Sure, but this was an application where you could search for any licensed educator and get their social security number in the response. This is about as bad a PII leak as can happen to a state government.

Re: Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting

#96

Post by RIMR »

cortesoft wrote: post #61
jrs235 wrote: post #37

Earlier quoted context omitted.

This is why my outlook on the future is growing dim. Politicians are threatening revenge, using the power and purse of the state, against people who embarrass them.

Politicians are always threatening revenge for stuff like this, for as long as there has been politics. It is only concerning if the threat is successful.

The only thing that would lead it to being successful is if people are convinced that the attempt itself isn't alarming, and don't act aggressively to do something about it.

Re: Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting

#97

Post by denton-scratch »

handrous wrote: post #67
treeman79 wrote: post #41

Earlier quoted context omitted.

I’m fairly sure he doesn’t understand. Language used makes it sounds he has no clue how html works. Back in 90s, I was constantly being accused of hacking things just for knowing how to build a website. This was also the era of when the news would run phone polls on whether the Internet should be allowed or not. I learn to keep my mouth shut about what I could do unless I was sure it was a tech savvy crowd. This dude…

> This was also the era of when the news would run phone polls on whether the Internet should be allowed or not. Clearly, people answered those polls incorrectly. It should definitely not be allowed.

I agree. Only elites should be allowed to use stuff like LSD, computers and the internet. This can be arranged simply by criminalising it; along with a social convention that elites don't get prosecuted. /s

Re: Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting

#98

Post by prepend »

Infernal wrote: post #78

> “hacker took the records of at least three educators, decoded the HTML source code, and viewed the social security number of those specific educators.” There's so much wrong here - am I to understand that if the state sends you SSNs in plaintext and you read them, _you're_ at fault?

Only if you decode the plaintext with your eyes.

Re: Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting

#99

Post by tshaddox »

lostcolony wrote: post #94
tshaddox wrote: post #89

Earlier quoted context omitted.

And suppressing opposition is the natural outcome of the government doing its job. The problem isn’t whether one group or another is “doing its natural job.” The problem is that what the reporter is doing is good, and what the government is doing is bad.

"And suppressing opposition is the natural outcome of the government doing its job. " - no it isn't. It's the natural outcome of shitty people being elected. The JD isn't "jackboots on necks" or whatever.

> no it isn't. It's the natural outcome of shitty people being elected.

Okay, well it's the outcome of literally every government of non-trivial size and duration.

Re: Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting

#100

Post by dd36 »

vipa123 wrote: post #39
jrs235 wrote: post #37

Earlier quoted context omitted.

This is why my outlook on the future is growing dim. Politicians are threatening revenge, using the power and purse of the state, against people who embarrass them.

This is as old as the country itself, the constitution is stronger than these thugs.

Media used to have more dry powder for fights before Facebook and Google intermediated everything.
Post reply on HN