4 ms·
Unfortunately, this is the top comment and it has led to a lengthy discussion about the ethics of altering a url to retrieve a resource you should not have acce
by jameshart 5y ago
Unfortunately, this is the top comment and it has led to a lengthy discussion about the ethics of altering a url to retrieve a resource you should not have access to.
Which is a fascinating discussion, but has nothing to do with the case at hand which is where the underlying html on a publicly accessible search result page contained SSNs of the teachers returned in the search.
All the analogies about ‘it’s like asking the IRS for another document’ are all wonderfully applicable to this comment, but not remotely applicable to the actual article.
- deleted 5y ago[deleted]
- woodruffw 5y agoThis entire thread is a great microcosm of how difficult it actually is to talk precisely and intelligibly about "hacking", permissions, intended access, etc!
- michael_michael 5y agoI am now questioning the wisdom of having shared this story, and I apologize for derailing the discussion.
- jameshart 5y agoIt’s a relevant comment, and people evidently found it interesting.
- wslack 5y agoIt's a good story and relevant. Not your fault the internet got spun up in a totally other direction with it.
- nyczomg 5y agoYours is an interesting story. And very relevant. It just isn’t applicable to one interesting aspect of the article being discussed which is that the sensitive data was sent to every user but was “hidden” by html. But the shoot the messenger aspect of reporting vulnerabilities is also very relevant. It’s just the nature of forums like this that some things bubble up to the top and dominate the discussion. Hard to say it’s your fault for retelling a story.
- bob_roberts 5y agofwiw, I found it relevant. It's obviously not _exactly_ the same thing, but "sending an HTTP GET request to a URL" is similar to "viewing HTML source" in that both are totally normally things to expect from a user, so it's hard to see how either could count as "hacking".
- askvictor 5y agoOn the other hand, to a non-techie person, where do you draw the line? Accessing the HTML of a public webpage is trivial to you and me. But what about decompiling or extracting strings from an .apk? Almost exactly the same thing as pressing F12 in the browser, but a tad more 'active'. It is relevant to this article, as it asks what hacking is OK, and what isn't
- alpaca128 5y agoI wouldn't call any of your examples hacking, at least not in the "hacking other people's systems" sense. It's accessing information the other party actively sent to users. The fault lies with the one distributing and potentially exposing sensitive information through negligence.
- aufhebung 5y agoI would say that finding and reporting exploits is ok in every circumstance. I would draw the line at using those exploits for malicious purposes.
- jameshart 5y agoIf someone distributed a .apk that contained plaintext SSNs of their employees, I don't think I would call someone who noticed a 'hacker'.
- datavirtue 5y agoURLs are not secrets. End of discussion.
- jameshart 5y agoEnd of a different discussion than the one this news article warrants.
- blacksmith_tb 5y agoYes, it looks like it was built to search educator SSNs[1], so the devs just... put them all in the js. How's that for caching? Ouch. 1: https://web.archive.org/web/20210428154433/https://apps.dese.mo.gov/HQT/CredentialListerChecker.aspx https://web.archive.org/web/20210428154433/https://apps.dese...
- deleted 5y ago[deleted]