6 ms·

So his issue was not that you discovered the bug. His issue was that after discovering it, you went on to view a bunch of other people's data. What you did wa

So his issue was not that you discovered the bug. His issue was that after discovering it, you went on to view a bunch of other people's data. What you did was walk down the block, pull on the doors of random houses, and if you found one unlocked, went in and took a look around. If you found my door unlocked and left me a note, I would be grateful. If you went in and took a look around, then did it to all of my neighbors, we would have you arrested. The bug here is an unlocked door. It being unlocked is a security risk, and people are thankful if you let them know. If after identifying the security risk you proceed to commit a crime, you're surprised people aren't "grateful?" >difficult to hold yourself accountable isn't it though... >are malicious actors so you.

Talanes 5y ago
It's a public website. If we have to use the doors analogy, these are doors at City Hall, not people's houses.
- vadfa 5y ago
  And it's a public street. It's what inside the houses (URLs) that is not public.
  - drdeca 5y ago
    Doors (holes-become-walls / walls-become-holes) are for controlling whether things can go through. URLs are for letting things through. A url is not a door, but an archway, or possibly a door frame.
    - soylentnewsorg 5y ago
      ..and you're not allowed to walk into someone's house if they only have a door frame instead of a locked door. they are for preventing criminals from forcefully breaking in. but you don't have to break in to commit the crime. that's why it's called "breaking and entering" - there are two criminal acts committed.
      - drdeca 5y ago
        An arch is not something that merely isn’t locked, but something that isn’t meant to even be closed.
- Spivak 5y ago
  Yeah you still can't just walk into the Mayor's office just because it's unlocked. Access isn't authorization.
  - Talanes 5y ago
    And yet if I do just open the door to the Mayor's office and it's unlocked and I wander in, that's still not the same sort of trespass as entering someone's home. And, if I'm in City Hall, the mechanism that keeps me from entering the Mayor's office should be the security guards and key-cards, not my disinclination to open a door.
    - soylentnewsorg 5y ago
      And if you walk in there, realize it's a restricted area, and start opening up file cabinets and reading confidential documents, you're now in jail. the security guard being there or not makes zero legal difference - things not being locked or blocked does not give you rights to them. thank you for proving yourself wrong. you mistakenly wandering in is not illegal. however your strawman is not what the OP did. it's a paragraph of text for crying out loud. please at least read the story before commenting.
MrOrelliOReilly 5y ago
Wow. The parent comment did not state they then sifted around for personal data. They checked if there was a bug and found it. For all we know the personal data is front and center, so this rudimentary check also revealed personal information. It’s not like they said they downloaded the SSNs. Good job a miming the ignorance and bad faith of the nameless bureaucrat the parent comment mentioned though, maybe this is just satire and I’m missing it..
- rendall 5y ago
  > After I shopped a few other companies to see how our plans compared... You might have missed this part. I did, too, on first reading. They did sift around.
- deleted 5y ago
  [deleted]
- soylentnewsorg 5y ago
  Wow. You are missing it. You are missing where they explicitly stated they sifted around for personal data, numerous times, and you are missing that sifting being what the company was complaining about. Personal as in insurance plans other people have. He explicitly states he did that after he found the bug. You're missing reading most of the post actually. If that company decided to file charges against him, this HN post is an admission of guilt for a crime.
ljm 5y ago
There's too much moralising and too much metaphor here. It's really a lot more simple: > After I shopped a few companies to see how our plans compared This isn't white-hat, it's grey-hat at best. Found the vuln, and then used it. I don't agree with the dramatic reading that I'm responding to.
__float 5y ago
"malicious actors" is quite a strong statement, for someone who was not really aiming to harm anyone or get much personal gain from it.
deleted 5y ago
[deleted]
deleted 5y ago
[deleted]
plainnoodles 5y ago
I think that's a PRETTY uncharitable analogy and interpretation of the OP's actions. I would say it's more like: You are walking down the street, and notice that there is a public noticeboard. It has a list of names, yours among them, associated with a number of steps each. It instructs you to walk a certain number of steps down the street, and then look up at the paper taped to the sidewalk that many steps down. So, you do, and upon looking down, you see some personal information about yourself! You are a little perplexed, since this doesn't seem very secure. So you take one step back, and look down. Wow, yep, not very secure, there's information there too! Being a human, you are naturally a little nosy and curious, and as these are publicly posted, after all, you glance through a couple more before finally regaining control of your better sense of civic duty, and report to the owner of the notice board that there is a problem with their "security". I think this is a better analogy because: * browsing to a web page is NOT the same thing as going into someone's house. * the internet is public. * there was CLEARLY no malicious intent. The OP clearly didn't harm or intend to harm anyone here, even if perhaps he should have immediately stopped when he began to suspect the website had a flaw and he shouldn't be able to see this information. I see no evidence of malice here. I do agree that in general, just because a system responds 200 OK, you're not necessarily clear to do anything you want when when you're doing is obviously wrong. But at the same time, we should NOT be prosecuting or blaming people when they're able to access more than they're supposed to be able to PLAINLY due to the software's design insufficiencies and there's otherwise clearly no intent to cause harm. We really need to take a more even-handed approach to this. And, we REALLY need some kind of a professional bar in software engineering. I would expect a student in their final year of CS to be able to produce a more secure system than what the OP described, so the fact that it exists in a quasi-government website is a complete fucking joke, if you'll pardon my language.
- gwd 5y ago
  > You are walking down the street, and notice that there is a public noticeboard. It has a list of names, yours among them, associated with a number of steps each. It instructs you to walk a certain number of steps down the street, and then look up at the paper taped to the sidewalk that many steps down. Or perhaps, "Here's a binder with numbered pages; turn to page 345 for your information." You wonder what's on page 346, so you turn the page, and lo and behold, someone else's information.
slim 5y ago
You seem to be implying that accessing a competitors pricing is immoral. Do you think a company pricing should be private information in the same sense that your house is private ?
sbarre 5y ago
This was not an "unlocked door". This was going to the doctor's office, and while sitting in the room with your files, seeing a bunch of other patient files just left on the desk in eyesight. Not in an unlocked filing cabinet, not in an envelope, but in the open. Changing a URL is not "malicious use" nor is it considered doing something you're not supposed to. As a web client, I should be able to change or manipulate the URL to my heart's content, it is 100% the server's job to restrict my access and make sure that I cannot access resources I shouldn't. This is entirely the fault of the operators, not the user, and they were mad at them because they _allowed_ the user to access things they should not.
- throwaway09223 5y ago
  It's even worse than that. I think a better analogy would be that you've requested the doctor mail you your records and instead the doctor ships you his entire filing cabinet with your folder taped to the top and a note saying "read this one." (but no mention about why the filing cabinet is there too) They weren't just in the open. A copy of these records were pushed, unsolicited, to the user's device and the user simply looked at what was sent to them.
  - soylentnewsorg 5y ago
    > instead the doctor ships you his entire filing cabinet with your folder taped to the top and as soon as you get this data and you read all that information sent to you by mistake instead of seeing it's not yours and stopping, you have committed a crime. what exactly is it that you don't understand here? what the op did is literally against the law. >pushed you should look up how http works. the request to get the data comes from the client browser. it's called a GET. the op requested to GET someone else's records from the server, after knowing the GET request he sent to the server would get him this information. so again I ask - what is it that you don't GET here? The OP very literally committed a crime. a crime being very easy to commit, does not make it legal.
    - throwaway09223 5y ago
lsaferite 5y ago
Asking the web server to give you information without lying or falsifying any of your request data should in no way equate to walking into random houses that are unlocked.
- soylentnewsorg 5y ago
  you are falsifying what customer you are. the guy literally said he put in different customer IDs into the URL after he discovered what part of the string was a customer ID. It would equate to a guy walking to your door, saying he's from the electric company, then reading the medical documents on your desk after you let him in.
- unyttigfjelltol 5y ago
  The proper analogy is-- you visit a public clerk and make a formal request via a form, receive the requested document from the clerk. Then, while you're at the clerk's counter you notice a menu up high above, like at a fast food restaurant, listing random commands with no explanation. Curiously, you call one out to the clerk and see what happens. The clerk returns with a crushed can. You call out another. The clerk dumps a roll of pennies on the counter. That's not fraud, it's negligent supervision and stupid design.
- namdnay 5y ago
  I guess the argument would be that changing the number in the URL is lying, as you are providing an ID that was not assigned to you (Playing devil’s advocate here)
heavyset_go 5y ago
This analogy isn't apt. What the OP did was the equivalent of asking, "Can you share these files with me?" and the other party going, "Sure, here they are!"
- soylentnewsorg 5y ago
  It's interesting you completely omit the part where he figures out the string in the URL that's a company's ID, and uses that to request a file. In your example it would be "I'm this other person, can you share my own files with me?" Except he's lying, and he's not the other person. Tell me, what happens if you, heavyset_go, send an invoice to Apple, and the invoice says you're "Cisco" and they pay it. Do you get to keep the money, or does the prison get to keep you?
  - heavyset_go 5y ago
    > It's interesting you completely omit the part where he figures out the string in the URL that's a company's ID, and uses that to request a file. In your example it would be "I'm this other person, can you share my own files with me? The OP was already authorized and authenticated on their own company account. They never falsified their authorization or their identity, they just requested documents at a specific URL and the other party had no problem replying with said documents.

Talanes 5y ago

It's a public website. If we have to use the doors analogy, these are doors at City Hall, not people's houses.

vadfa 5y ago
And it's a public street. It's what inside the houses (URLs) that is not public.
- drdeca 5y ago
  Doors (holes-become-walls / walls-become-holes) are for controlling whether things can go through. URLs are for letting things through. A url is not a door, but an archway, or possibly a door frame.
  - soylentnewsorg 5y ago
    ..and you're not allowed to walk into someone's house if they only have a door frame instead of a locked door. they are for preventing criminals from forcefully breaking in. but you don't have to break in to commit the crime. that's why it's called "breaking and entering" - there are two criminal acts committed.
    - drdeca 5y ago
      An arch is not something that merely isn’t locked, but something that isn’t meant to even be closed.
Spivak 5y ago
Yeah you still can't just walk into the Mayor's office just because it's unlocked. Access isn't authorization.
- Talanes 5y ago
  And yet if I do just open the door to the Mayor's office and it's unlocked and I wander in, that's still not the same sort of trespass as entering someone's home. And, if I'm in City Hall, the mechanism that keeps me from entering the Mayor's office should be the security guards and key-cards, not my disinclination to open a door.
  - soylentnewsorg 5y ago
    And if you walk in there, realize it's a restricted area, and start opening up file cabinets and reading confidential documents, you're now in jail. the security guard being there or not makes zero legal difference - things not being locked or blocked does not give you rights to them. thank you for proving yourself wrong. you mistakenly wandering in is not illegal. however your strawman is not what the OP did. it's a paragraph of text for crying out loud. please at least read the story before commenting.

MrOrelliOReilly 5y ago

Wow. The parent comment did not state they then sifted around for personal data. They checked if there was a bug and found it. For all we know the personal data is front and center, so this rudimentary check also revealed personal information. It’s not like they said they downloaded the SSNs. Good job a miming the ignorance and bad faith of the nameless bureaucrat the parent comment mentioned though, maybe this is just satire and I’m missing it..

rendall 5y ago
> After I shopped a few other companies to see how our plans compared... You might have missed this part. I did, too, on first reading. They did sift around.
deleted 5y ago
[deleted]
soylentnewsorg 5y ago
Wow. You are missing it. You are missing where they explicitly stated they sifted around for personal data, numerous times, and you are missing that sifting being what the company was complaining about. Personal as in insurance plans other people have. He explicitly states he did that after he found the bug. You're missing reading most of the post actually. If that company decided to file charges against him, this HN post is an admission of guilt for a crime.

ljm 5y ago

There's too much moralising and too much metaphor here. It's really a lot more simple: > After I shopped a few companies to see how our plans compared This isn't white-hat, it's grey-hat at best. Found the vuln, and then used it. I don't agree with the dramatic reading that I'm responding to.

__float 5y ago

"malicious actors" is quite a strong statement, for someone who was not really aiming to harm anyone or get much personal gain from it.

deleted 5y ago

[deleted]

deleted 5y ago

[deleted]

plainnoodles 5y ago

I think that's a PRETTY uncharitable analogy and interpretation of the OP's actions. I would say it's more like: You are walking down the street, and notice that there is a public noticeboard. It has a list of names, yours among them, associated with a number of steps each. It instructs you to walk a certain number of steps down the street, and then look up at the paper taped to the sidewalk that many steps down. So, you do, and upon looking down, you see some personal information about yourself! You are a little perplexed, since this doesn't seem very secure. So you take one step back, and look down. Wow, yep, not very secure, there's information there too! Being a human, you are naturally a little nosy and curious, and as these are publicly posted, after all, you glance through a couple more before finally regaining control of your better sense of civic duty, and report to the owner of the notice board that there is a problem with their "security". I think this is a better analogy because: * browsing to a web page is NOT the same thing as going into someone's house. * the internet is public. * there was CLEARLY no malicious intent. The OP clearly didn't harm or intend to harm anyone here, even if perhaps he should have immediately stopped when he began to suspect the website had a flaw and he shouldn't be able to see this information. I see no evidence of malice here. I do agree that in general, just because a system responds 200 OK, you're not necessarily clear to do anything you want when when you're doing is obviously wrong. But at the same time, we should NOT be prosecuting or blaming people when they're able to access more than they're supposed to be able to PLAINLY due to the software's design insufficiencies and there's otherwise clearly no intent to cause harm. We really need to take a more even-handed approach to this. And, we REALLY need some kind of a professional bar in software engineering. I would expect a student in their final year of CS to be able to produce a more secure system than what the OP described, so the fact that it exists in a quasi-government website is a complete fucking joke, if you'll pardon my language.

gwd 5y ago
> You are walking down the street, and notice that there is a public noticeboard. It has a list of names, yours among them, associated with a number of steps each. It instructs you to walk a certain number of steps down the street, and then look up at the paper taped to the sidewalk that many steps down. Or perhaps, "Here's a binder with numbered pages; turn to page 345 for your information." You wonder what's on page 346, so you turn the page, and lo and behold, someone else's information.

slim 5y ago

You seem to be implying that accessing a competitors pricing is immoral. Do you think a company pricing should be private information in the same sense that your house is private ?

sbarre 5y ago

This was not an "unlocked door". This was going to the doctor's office, and while sitting in the room with your files, seeing a bunch of other patient files just left on the desk in eyesight. Not in an unlocked filing cabinet, not in an envelope, but in the open. Changing a URL is not "malicious use" nor is it considered doing something you're not supposed to. As a web client, I should be able to change or manipulate the URL to my heart's content, it is 100% the server's job to restrict my access and make sure that I cannot access resources I shouldn't. This is entirely the fault of the operators, not the user, and they were mad at them because they _allowed_ the user to access things they should not.

throwaway09223 5y ago
It's even worse than that. I think a better analogy would be that you've requested the doctor mail you your records and instead the doctor ships you his entire filing cabinet with your folder taped to the top and a note saying "read this one." (but no mention about why the filing cabinet is there too) They weren't just in the open. A copy of these records were pushed, unsolicited, to the user's device and the user simply looked at what was sent to them.
- soylentnewsorg 5y ago
  > instead the doctor ships you his entire filing cabinet with your folder taped to the top and as soon as you get this data and you read all that information sent to you by mistake instead of seeing it's not yours and stopping, you have committed a crime. what exactly is it that you don't understand here? what the op did is literally against the law. >pushed you should look up how http works. the request to get the data comes from the client browser. it's called a GET. the op requested to GET someone else's records from the server, after knowing the GET request he sent to the server would get him this information. so again I ask - what is it that you don't GET here? The OP very literally committed a crime. a crime being very easy to commit, does not make it legal.
  - throwaway09223 5y ago

lsaferite 5y ago

Asking the web server to give you information without lying or falsifying any of your request data should in no way equate to walking into random houses that are unlocked.

soylentnewsorg 5y ago
you are falsifying what customer you are. the guy literally said he put in different customer IDs into the URL after he discovered what part of the string was a customer ID. It would equate to a guy walking to your door, saying he's from the electric company, then reading the medical documents on your desk after you let him in.
unyttigfjelltol 5y ago
The proper analogy is-- you visit a public clerk and make a formal request via a form, receive the requested document from the clerk. Then, while you're at the clerk's counter you notice a menu up high above, like at a fast food restaurant, listing random commands with no explanation. Curiously, you call one out to the clerk and see what happens. The clerk returns with a crushed can. You call out another. The clerk dumps a roll of pennies on the counter. That's not fraud, it's negligent supervision and stupid design.
namdnay 5y ago
I guess the argument would be that changing the number in the URL is lying, as you are providing an ID that was not assigned to you (Playing devil’s advocate here)

heavyset_go 5y ago

This analogy isn't apt. What the OP did was the equivalent of asking, "Can you share these files with me?" and the other party going, "Sure, here they are!"

soylentnewsorg 5y ago
It's interesting you completely omit the part where he figures out the string in the URL that's a company's ID, and uses that to request a file. In your example it would be "I'm this other person, can you share my own files with me?" Except he's lying, and he's not the other person. Tell me, what happens if you, heavyset_go, send an invoice to Apple, and the invoice says you're "Cisco" and they pay it. Do you get to keep the money, or does the prison get to keep you?
- heavyset_go 5y ago
  > It's interesting you completely omit the part where he figures out the string in the URL that's a company's ID, and uses that to request a file. In your example it would be "I'm this other person, can you share my own files with me? The OP was already authorized and authenticated on their own company account. They never falsified their authorization or their identity, they just requested documents at a specific URL and the other party had no problem replying with said documents.