5 ms·

I don't read anything about an extortion attempt (in this account), what am I missing? I guess it is normal for a security firm to hope to gain some business b

by Tichy 16y ago

I don't read anything about an extortion attempt (in this account), what am I missing? I guess it is normal for a security firm to hope to gain some business by exposing security flaws (hey, we found a hole in your site, hire us to fix it). As this incident shows, it is not an easy business to be in...

nailer 16y ago
That's true, the guy might just post the data to be an asshole, rather than asking for money. Either way, the guy who was cracked is saying if the cracker posts the stolen data, he will post the cracker's contact details to every account. Which is completely reasonable.
- Tichy 16y ago
  I didn't read anything about him posting the stolen data. I think he specifically wrote that he didn't even steal any data. I don't know whose account is true, but I don't think it is reasonable to threaten somebody who approaches you with information about a security hole, just in case that somebody has evil intentions. In general it seems reasonable in human interactions to not issue death threats upon the first encounter.
  - nailer 16y ago
    > I didn't read anything about him posting the stolen data. Read the post again - the owner of the site is saying he will publish the guys details if he posts the data. If he doesn't post people's personal data, fine. The site owner won't publish his address. If he does, then fair enough.
    - Tichy 16y ago
      Hi, nice to meet you. Btw, try anything funny on me, and I'll set the Russian mob on you. How to explain? Yes, strictly logically speaking it is "OK" (no funny actions, no Russion mob). But psychologically I don't think it would be a good approach to human interaction. It establishes an atmosphere of distrust right from the start. You approach somebody and say "you might be a criminal". Or imagine you meet somebody on a party and he says "Hi, my name is soandso. By the way, I carry a gun". How would that make you feel?
      - nailer 16y ago
        I understand what you're saying, but do you have any information that this is how the site owner began the conversation? I imagine we're seeing a small snippet of something larger. I also see the security company guy doesn't dispute that his revelation the site was cracked began with a push for payment to remedy the situation.
        Tichy 16y ago
        No idea, really. It sounds as if Russo denies having any data, in which case I struggle coming up with a good reason for POF to issue the warning. But ultimately, I really only know what is written in the two articles. I guess time will tell.
        nailer 16y ago
        > It sounds as if Russo denies having any data I don't get that impression - I imagine that if he didn't have any data, he'd say so explicitly. If he didn't have data, though, I'd totally agree with your observations. > I guess time will tell. Indeed.

by Tichy 16y ago

nailer 16y ago

That's true, the guy might just post the data to be an asshole, rather than asking for money. Either way, the guy who was cracked is saying if the cracker posts the stolen data, he will post the cracker's contact details to every account. Which is completely reasonable.

Tichy 16y ago
I didn't read anything about him posting the stolen data. I think he specifically wrote that he didn't even steal any data. I don't know whose account is true, but I don't think it is reasonable to threaten somebody who approaches you with information about a security hole, just in case that somebody has evil intentions. In general it seems reasonable in human interactions to not issue death threats upon the first encounter.
- nailer 16y ago
  > I didn't read anything about him posting the stolen data. Read the post again - the owner of the site is saying he will publish the guys details if he posts the data. If he doesn't post people's personal data, fine. The site owner won't publish his address. If he does, then fair enough.
  - Tichy 16y ago
    Hi, nice to meet you. Btw, try anything funny on me, and I'll set the Russian mob on you. How to explain? Yes, strictly logically speaking it is "OK" (no funny actions, no Russion mob). But psychologically I don't think it would be a good approach to human interaction. It establishes an atmosphere of distrust right from the start. You approach somebody and say "you might be a criminal". Or imagine you meet somebody on a party and he says "Hi, my name is soandso. By the way, I carry a gun". How would that make you feel?
    - nailer 16y ago
      I understand what you're saying, but do you have any information that this is how the site owner began the conversation? I imagine we're seeing a small snippet of something larger. I also see the security company guy doesn't dispute that his revelation the site was cracked began with a push for payment to remedy the situation.
      - Tichy 16y ago
        No idea, really. It sounds as if Russo denies having any data, in which case I struggle coming up with a good reason for POF to issue the warning. But ultimately, I really only know what is written in the two articles. I guess time will tell.
        nailer 16y ago
        > It sounds as if Russo denies having any data I don't get that impression - I imagine that if he didn't have any data, he'd say so explicitly. If he didn't have data, though, I'd totally agree with your observations. > I guess time will tell. Indeed.