4 ms·
>A few years ago I remember finding a very obvious, easily fixable XSS vulnerability across all of the Department of Homeland Security sites... I think if I we
by rev_bird 11y ago
>A few years ago I remember finding a very obvious, easily fixable XSS vulnerability across all of the Department of Homeland Security sites...
I think if I were in this situation today, I just wouldn't say anything. Being ignored would be one of the good outcomes; I'd be terrified of getting chucked into court for being a "HACKER AGAINST HOMELAND SECURITY."
- chris_wot 11y agoDisclosing the vulnerability - what law could they prosecute you under?
- Ntrails 11y agoDepends how you found/testes/found it. In general it's a case of being uncertain what they could do if they decided to.
- chris_wot 11y agoHoly Typo Batman!
- rmc 11y agoIn order to find the vulnerbility you almost certainly have to try it out. Even for an XSS, you'd have to make a JS alert box popup for yourself. And then you've technically broken the law, since you hacked the website.
- coldpie 11y agoThe CFA is so broad that basically doing anything to a server that the server operator didn't anticipate is a violation. And since it was written to protect major companies' infrastructure in the 80s and 90s, the penalties are incredibly harsh.