4 ms·

Language cheapens itself when spoken cheaply. Abusing over the top terminology on minute areas of controversy will ultimately lesson the impact of your outrage

Language cheapens itself when spoken cheaply. Abusing over the top terminology on minute areas of controversy will ultimately lesson the impact of your outrage when something actually bad comes along. Someone browsing healthcare plans available to other employees of different companies is not something that should win you the label “malicious actor” and come associated with other implications. This data leaking harms literally nobody other than perhaps the company offering the worst coverage to its employees. Your response is the real problem here: If I had done this, reported it, and then been called a “malicious actor” on a forum titled “Hacker News” my knee jerk response would just be to shut up about it next time.

bawolff 5y ago
I used the word "malicious". Its not like i used the word "murderer" or "evil overlord". I'm not saying OP should go to jail or anything. All i'm saying is if you find an exploit, and after you verify it works, you contunue to use it for your own personal ends, you're no longer benign and you shouldn't expect a warm welcome from the security team. The line is when you start to use exploits on computers not owned by yourself for your own ends instead of for the purpose of verifying and reporting the vuln. Sure you could cross that line a little bit or a lot, but you're not innocent if you're over it.
- gffrd 5y ago
  > you contunue to use it for your own personal ends I think this is what people may have been missing from your original post: at some point things can go from innocent to malicious. "Crime of convenience" is the most common type, after all. "I'm not the type to steal, but the cash was left on the counter, and …"
- dymax78 5y ago
  > ... and you shouldn't expect a warm welcome from the security team. The appropriate response from the security team (after verification) is to pull the site down or immediately patch the vulnerability, if possible. Making an outbound call to a third-party is pointless and irresponsible.
  - bawolff 5y ago
    I imagine having an assertion that the person didn't keep any of the data might be important to legal. (Ianal)

bawolff 5y ago

I used the word "malicious". Its not like i used the word "murderer" or "evil overlord". I'm not saying OP should go to jail or anything. All i'm saying is if you find an exploit, and after you verify it works, you contunue to use it for your own personal ends, you're no longer benign and you shouldn't expect a warm welcome from the security team. The line is when you start to use exploits on computers not owned by yourself for your own ends instead of for the purpose of verifying and reporting the vuln. Sure you could cross that line a little bit or a lot, but you're not innocent if you're over it.

gffrd 5y ago
> you contunue to use it for your own personal ends I think this is what people may have been missing from your original post: at some point things can go from innocent to malicious. "Crime of convenience" is the most common type, after all. "I'm not the type to steal, but the cash was left on the counter, and …"
dymax78 5y ago
> ... and you shouldn't expect a warm welcome from the security team. The appropriate response from the security team (after verification) is to pull the site down or immediately patch the vulnerability, if possible. Making an outbound call to a third-party is pointless and irresponsible.
- bawolff 5y ago
  I imagine having an assertion that the person didn't keep any of the data might be important to legal. (Ianal)