15 ms·
Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting
- LordAtlas 5y agoDupe: https://news.ycombinator.com/item?id=28866805 https://news.ycombinator.com/item?id=28866805
- aaroninsf 5y agoI understand the mistake of being born in MO. I understand the mistake of settling there long ago. I have minimal sympathy for those who have chosen to stay recently. I have contempt for those who would move there now, or seek out business there.
- kyleblarson 5y agoThis reminds me of the US senator demanding that FB commit to ending 'finsta'. He clearly had no idea what that term means. https://www.youtube.com/watch?v=TGt1Ukg7q4Y https://www.youtube.com/watch?v=TGt1Ukg7q4Y
- PennRobotics 5y agohttps://news.ycombinator.com/item?id=28866805 https://news.ycombinator.com/item?id=28866805
- throwawaymanbot 5y agoa little odd to have this stance No? Its almost as if hes punishing the reporter for the discovery .. which makes me wonder was it being siphoned politically beforehand and hes trying to direct the story away from whoever may have been siphoning it..to the false story of ... the reporter discovering the siphoning.
- WarOnPrivacy 5y agoMissouri Gov. Mike Parson (R) .. vowed his administration would seek to prosecute and investigate .. anyone who aided the publication in its "attempt to embarrass the state and sell headlines for their news outlet." Embarrassing governments is the natural outcome of the press doing it's job. This is what the extra constitutional protections are for.
- silexia 5y agoThis governor needs to face a recall election or civil lawsuits for this idiotic threats and lies.
- rumblestrut 5y agoWe don’t do recall elections in Missouri. Also, sorry about Governor Hee Haw. We know he’s an embarrassment.
- _3u10 5y agoThere’s no extra constitutional protections. It’s all under free speech. Everyone is equal.
- mmcdermott 5y agox1000 this. The freedom of the press is a right granted to all citizenry of the United States, not a specialized permission granted to an elite caste.
- Retric 5y agoThe freedom of the press isn’t about cast, but it is about context. For example based on Chaplinsky v. New Hampshire it’s constitutional to prohibit “fighting words.” Which would mean some things are fine in print but you can’t say to someone’s face because they would provoke violence.
- WarOnPrivacy 5y agoReally appreciate this example.
- lkrubner 5y agoIt was added as an amendment, therefore it is an extra constitutional protection. Some people (a broad coalition that included both Federalists and anti-Federalists) were concerned that the Constitution, as originally written, did not ensure a protection of human rights. That's why they pushed through the Bill Of Rights.
- geerlingguy 5y agoOh hey, my home state is on Hacker News! Oh... sigh.
- hangonhn 5y agohugs My home state is Florida. It will be alright.
- tombert 5y agoAs a fellow Florida-raised human, I feel your pain.
- dylan604 5y agoBeing from Texas, I feel like Texas and Florida are in a race to wherever it is they think they are going. I feel like there needs to be a state level rivalry like colleges. Brings a new meaning to Texas State vs Florida State. Maybe they can have halftime shows too. I also think state laws should be copyrightable so that when other states copy their asinine laws, the originating state gets royalties.
- tombert 5y agoJust to make sure that I got both experiences, I also lived in Texas for three years after leaving Florida.
- dylan604 5y agoYou are a glutten for punishment! I moved out of Texas and moved to the west coast for a bit. I then eventually moved back to Texas for family reasons. Moving back was much worse of culture shock. Yes, I knew what to expect, but after being away from it and then dropped back in just reminds you of how bad different it is. Kind of like a boiling frog growing up, but then being the lobster as an adult.
- busterarm 5y ago
- snicker7 5y agoApparently, the SSNs were all embedded directly in the HTML file. Like … what?
- plainnoodles 5y ago</tr><!--- {{ str(row) }} ---> I don't find it TOO much of a stretch.... (I don't know what it actually looked like in the html, just saying I could see it happening pretty easily)
- Bluecobra 5y agoWhen I was a student at DeVry University (a national for-profit college with 40 campuses) your SSN was your student ID. This wasn’t corrected until 2002 or 2003. :(
- nostrademons 5y agoYour SSN was your driver's license number in 29 states until 2004, when Bush outlawed the practice. Many, many institutions in the USA are built on it being a high-trust society. Now that it's falling into a low-trust state, we can expect those institutions to fail, and perhaps the state to as well.
- Infernal 5y ago> Many, many institutions in the USA are built on it being a high-trust society. Now that it's falling into a low-trust state, we can expect those institutions to fail, and perhaps the state to as well. Not enough people understand this, but I'm encouraged whenever I hear from those who do.
- jkepler 5y agoThis raises the question of how we start planning now to build more appropriate institutions to avoid societal failure.
- 5y ago
- diegorbaquero 5y agoMissouri Gov. Mike Parson (R) said fixing the flaw could cost the state $50 million Talk about waste of resources.
- elliekelly 5y agoI would absolutely love to know who provided that estimate and how they arrived at that number. I understand that issues are often far more complex than they appear but this just seems ridiculous.
- kizer 5y agoI know right. An immediate fix shouldn’t cost anything, right? Just don’t send social security numbers to the browser.
- handrous 5y agoTurns out a bunch of other systems rely on this bug to fetch information, and no-one's entirely sure where they are, who's responsible for them, or what they do. Also the page is auto-generated though some arcane CMS such that it's really hard to figure out how to get the data off that page while keeping it other places where it needs to be, without restructuring the whole thing. Also deployment is manual and you'll need to go back and forth with some unrelated department for months to make it happen. Also there's no testing environment, no information about how to get it running—let alone any useful scripts or config/deployment management—is in the repo or otherwise available at all, and there are no tests. And it's all written in an unholy combination of ASP.NET and Java server pages. And the "database" is a standards-nonconforming CSV. (pure speculation)
- tppiotrowski 5y agoCheap solution: put a proxy in front like Cloudworker/Lambda and modify the HTML before it gets sent to client.
- ClumsyPilot 5y ago
- zzzeek 5y ago> “And then to react in this way where you don’t say ‘thank you’ but actually turn on the reporter and researchers and go after them…it’s just weird.” it's not "weird", it's an elected official trying to deflect from being exposed as completely endangering the PII of state employees. while trying to bring charges here is ridiculous, it might not be the case in a few years as we watch the continued crumbling of institutions, where bad faith arguments made up on the fly by anyone in power become excuses to do anything. like trying to extort the government of Ukraine to work on behalf of the official's personal reelection campaign, for example.
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- CivBase 5y agoIt's kind of weird. After all, it's not like the governor is directly responsible for the flaw. Even if his opposition could have indirectly linked his administration to the flaw, his response has certainly done far more damage to his reputation than that ever could.
- weatherlight 5y agoMost likely voters don't understand how computers work. I'm not sure it'll matter much.
- treeman79 5y agoI’m fairly sure he doesn’t understand. Language used makes it sounds he has no clue how html works. Back in 90s, I was constantly being accused of hacking things just for knowing how to build a website. This was also the era of when the news would run phone polls on whether the Internet should be allowed or not. I learn to keep my mouth shut about what I could do unless I was sure it was a tech savvy crowd. This dude brings back a lot of those memories
- deleted 5y ago[deleted]
- masswerk 5y agoIs this the beginning of the War on Developer Tools?
- austincheney 5y agoNot likely. More likely the start of law suits against information technology owners who provide insecure access and threaten people.
- tombert 5y agoThis is so idiotic. Does Missouri really want to discourage people from reporting security vulnerabilities? It sounds like this reporter did the responsible thing and alert all affected parties. I can almost guarantee that if a decent person found this, a dozen less-decent people did too. If a decent person is afraid to report a security issue, even more less-decent folks are going to have access to this information.
- wrs 5y agoDon’t try to bring logic, reason, and/or prudence into it — this is politics, which is a whole other thing.
- ficklepickle 5y agoI wonder if the page in question is cached in the internet archive.
- tibbydudeza 5y agoIt is like pipes.
- dylan604 5y agoor tubes
- mgamache 5y agoThis is embarrassing, so lets pretend it's a crime for the reporter to report the truth. This tactic might work for the NSA, but I hope it doesn't work here.
- Gunax 5y agoThis is exactly what happened to weev. He found that information that was intended to be private was made publicly available by AT&T. Weev went to prison for typing in URLs that he should not have. They were criminal URLs, just loke thess.
- mikeyouse 5y agoKind of... The AT&T data wasn't public, Weev & Co. had to build a script to generate plausible ICCIDs which they then 'challenged' the AT&T servers with the URL containing the ICCID. If it was a valid iPad ICCID and registered with AT&T, the server would reply with the email address registered to it. That seems materially different to just F12ing a website and seeing plaintext Social Security numbers.
- kizer 5y agoI think the governor ought to resign. He’s taking something that is, ultimately, HIS fault and trying to pin it of course on “the media”. The SSN numbers were in the page; they were in the source code. “View source” is not decrypting a webpage. God, I know he just has no technical understanding but even then he should be smart enough to get the details and realize they weren’t “hacked”. This person clearly doesn’t understand what a free press is —- they could have legally ran the story without even alerting the state agency, but they did the right thing and this idiot governor is still trying to deflect blame.
- c-swa 5y agoAs a citizen of the pitiful state, we tried to vote him out last election cycle. He wasn’t even elected before this, something along the lines of Nixon’s transfer of power to Ford is what happened in my state. Yet he was re-elected.
- tomrod 5y agoDupe Seriously though, it deserves to be said again. The website operators are negligent, IMO.
- Infernal 5y ago> “hacker took the records of at least three educators, decoded the HTML source code, and viewed the social security number of those specific educators.” There's so much wrong here - am I to understand that if the state sends you SSNs in plaintext and you read them, _you're_ at fault?
- afrcnc 5y agoduplicate: https://news.ycombinator.com/item?id=28866805 https://news.ycombinator.com/item?id=28866805
- 234023048230948 5y agohttps://itwire.com/security/infosec-researchers-slam-ex-wapo-man-krebs-over-doxxing.html https://itwire.com/security/infosec-researchers-slam-ex-wapo...
- giaour 5y ago> there was no option to decode Social Security numbers for all educators in the system all at once Sure, but this was an application where you could search for any licensed educator and get their social security number in the response. This is about as bad a PII leak as can happen to a state government.
- justinzollars 5y agoflagged as duplicate @dang
- YeBanKo 5y agoThey gave notice and waited until the offending pages were taken down. The article does not specify what the original html looked like, it could be a simple artifact from testing, when someone dumped the entire object into a template for debugging or maybe they actually were using this as a sort of a data field and then used it, for example, in a js call call to served. But the response from the AG shows they have no idea how internet works: “They had no authorization to convert or decode, so this was clearly a hack.” Bigger questions: Who developed the system? Was it a contractor or in-house? If it was a contractor, are they gonna lose government contracts? Because, it sounds like they should. If it was in-house, are they gonna get training or some procedure in place to audit things going forward?
- rndmind 5y agoThis type of response by a high level public official is not excusable in 2021, maybe in 2005 or 2010, but it's 2021 now.
- busymom0 5y ago> fixing the flaw could cost the state $50 million Ummmmm how does something need that much money for a bug fix???
- Bilal_io 5y agoI'd be happy to fix it for half.
- theunraveler 5y ago$50m to fix? Seems a little ridiculous…
- justshowpost 5y ago> for reporting Fake news. The progressive crook wanted for exploiting and disclosing the data, not for reporting. Actually, Krebs-on-security should know where a line drawn.
- thread_id 5y agoHow on earth in any reasonable estimate of what it costs to solve this problem does he come up with a crazy wack-a-doodle estmate of 50 Million? Also if they just fixed the problem when notified (prior to releasing the story) and kept a low profile we would be less likely to be reading about it. What a moron!!!! Also, if the owners of the web site had spent a couple of dollars on a Pen-Test they would have found this low hanging fruit long before it got into production.