Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lobsters bug allows unauthorized email access

lobste.rs

Post reply on HN
Print view View original

1–9 of 9 posts

Re: Lobsters bug allows unauthorized email access

#3

Post by sargstuff »

Guess the 'how do I post to lobsters?' secret is out[0]. aka snarf the mail distribution list. send out to mail distribution list. If worthy enough article, sent email gets posted/archived on site.

[0] : "But yak shaving is fun" : https://news.ycombinator.com/item?id=48555838

Re: Lobsters bug allows unauthorized email access

#7

Post by opem »

Cpoll wrote: post #6

The poster was banned for "Irresponsible disclosure and threatening users privacy to advertise a startup." Unless the post was edited, is the moderator referring to their mention of HN?

I guess not! From pushcx's (mod) comment:

> Between the threats in this post, this user only using their account to post this, their inviter (employer?) only using their account to promote their AI security scanner, I've gone ahead and handed out some user and domain bans here.

Re: Lobsters bug allows unauthorized email access

#8

Post by JdeBP »

Cpoll wrote: post #6

The poster was banned for "Irresponsible disclosure and threatening users privacy to advertise a startup." Unless the post was edited, is the moderator referring to their mention of HN?

No. The poster didn't communicate the bug per the posted instructions at https://github.com/lobsters/lobsters/blob/main/SECURITY.md ; the poster actually exploited the flaw to scrape personal data of users which xe then threatened to post; and the company being promoted was nothing to do with Hacker News at all, but was a company that sells software security stuff, with which which two lobste.rs accounts were connected.
Post reply on HN