10 ms·
Is this that different than publicizing bugs? He tested it for a small amount of time, noticed a real security vulnerability (he could collect leads), and publi
by cm2012 8y ago
Is this that different than publicizing bugs? He tested it for a small amount of time, noticed a real security vulnerability (he could collect leads), and publicized his findings knowing Google would likely punish him for it.
It's mildly unethical at worse, considering he could have happily done profitable leadgen at scale and it would have likely never been caught if he kept quiet.
- thedonkeycometh 8y agoHe didn't set up a test site, he collected live users information without their consent and invaded the legitimate privacy of his competitors, stole industrial information. Then bragged about it. This blog post is most likely more of a "see, it was just a test" cover post in case the feds come in the same way a bigot professes abuse as just a joke.
- londons_explore 8y agoExcept he would have been caught by a few of his users. If I notice a scummy page impersonating Google, I'm gonna alert Google so they can do something about it. (For example add the page to the safebrowsing list)
- cm2012 8y agoGoogle very very rarely does anything with individual complaints sent in with their automated systems. You'd have to get a post to the top of HN.
- dejanseo 8y agoThat's exactly right. Google has already punished me once for exposing a flaw (which they still haven't fixed): https://news.ycombinator.com/item?id=4748094 https://news.ycombinator.com/item?id=4748094
- TheForumTroll 8y ago"Years" "Small amount of time" ?!?