76 ms·
Gov Parson pushes to prosecute reporter who found security flaw in state site
- hyperpape 5y agoThis is a decent article, but it would’ve been so much better if it clearly explained how easy it is to see the “HTML source code”. If the article said “anyone who right clicks the web page in Chrome and selects view source could see social security numbers” it would clarify things for the majority of the population that doesn’t know what “HTML source code” is.
- nick238 5y agoViewing source is hacking! /s I got sent to the principal's office (years ago...) for opening a command line and trying to ping a printer that said it was offline but was sitting right next to my station and looked happy. Most people are probably like my former teacher, who will wind up on a jury.
- totalfaggot 5y agoI'm a liberal cock-sucking FAGGOT! I LOVE COVID! I LOVE TO SUCK COCK! I LOVE TO SUCK PENIS TOO! Covid, Cock-Sucking, and Ass-Licking - Can't forget to lick some ass. Where's Fauci? I'd love for him to fuck me in the ass again. I still have cum dripping down my chin.
- dreyfan 5y agoThe US is so completely and utterly fucked I think it's beyond redemption at this point.
- bpodgursky 5y agoWait until you see the rest of the world.
- breckenedge 5y agoI agree this is a problem, but there are also problems everywhere. The US doesn’t have a monopoly on stupid. We’ve lasted through dumb, inept government before.
- indig0g0 5y agoYep, Brazil comes to mind.
- walrus01 5y agoAmerica is a third world country wearing a gucci belt.
- deleted 5y ago[deleted]
- thehappypm 5y agoThe South is a crazy place.
- Ancapistani 5y agoPerhaps, but we do not claim Missouri.
- danbmil99 5y agoSo is the south of France. My cousin moved to Paris because his kids were going to school with Marine Le Pen supporters
- thehappypm 5y agoThat is a pretty unhealthy reaction to living near people with a different political viewpoint.
- tombert 5y agoObviously America has problems that should be addressed, but I tend to think these "blame the US for everything cuz it's irredeemable" are doing a pretty big disservice all around. If we could singularly find these problems to be a uniquely American thing, that would be great! That means we've identified the problems and conceivably we could change the US to suddenly fix it. I think the reality is that it's not that simple. History has shown us that people across basically every nationality are vulnerable to demagoguery, and I seriously don't think the US is unique in electing a bunch of blowhards as leaders. There are lots of things about the US I would change (socialized healthcare being the obvious thing in my mind), but I don't think that we should delude ourselves by saying that the US is beyond redeemable.
- adrr 5y agoIt all depends. If one side believes the election was stolen and proceeds to rig elections in their favor in retaliation. America is done. We're at a point where fact don't matter. This is story illustrates that. Fact that SSN were sent out publicly doesn't matter. Fact that any security expert would say this wasn't hacking doesn't matter. Experts no longer matter. Whether they are doctors, scientists, etc.
- deleted 5y ago[deleted]
- tombert 5y agoI agree that the lies about election fraud and whatnot are dangerous, but I fail to see how that's uniquely American. Conspiracy theories exist all over the place, and predate anyone alive today. I will agree that the acceptance of conspiratorial thinking in conservative circles is especially harmful (I wrote more detail about that in a sister thread), but you don't have to look very far in European history to find them electing demagogues too.
- eointierney 5y agoAh here, steady on. I know it's commonplace to wail on the USA because of all the shite that seems to be getting shittier but there is _so much_ goodness in the USA. The systems are a bit broken. The constitution needs modernization, access to and application of the laws need to be made measuably fair, and the economic model requires reformulation. Racism, sexism, and perverse idolatry need to be educated out of the standard models of discourse. But. The USA is still a paradigm of democratic republicanism. It's still full of amazing humans, many of whom work hard to improve other people's lives. It is seething with debate, invests hugely in technology, and still reacts quickly to changes of circumstances. It's fucked, but not irredeemably so. Mainly it needs to focus on education and healthcare, especially by removing pernicious, profit-seeking, short-term motivations. Also, stop voting Retardicans. To be fair, Demoticrats are a pretty shoddy bunch of disorganised and intellectually confused herd of kittens, but they at least _try_ to improve the lot of other humans. The Retardicans are big business first and all else after, with a whole heap of contempt for thought on the side.
- h2odragon 5y agoI'd hope that a court would (quickly!) find the truth of the matter, and the Gov further humiliated. If there is in fact a legal violation to stick here then there's even more of a public service done in highlighting that stupidity as well. This is what newspapers are supposed to do innit?
- MisterBastahrd 5y agoHe would simply declare that his victory was stolen by special interests in the judiciary, and over 50% of his state would nod and agree.
- mcguire 5y agoThe Post-Dispatch needs to act to force the State Police investigation forward, or the whole incident will shortly be forgotten, except for the allegations. Perhaps a daily column with updates on it. Perhaps a libel case?
- comrh 5y agoI agree, I know it's a high bar but doesn't this fit the purpose of libel laws? "Under United States law, libel generally requires five key elements: the plaintiff must prove that the information was published, the plaintiff was directly or indirectly identified, the remarks were defamatory towards the plaintiff's reputation, the published information is false, and that the defendant is at fault." Seems to fit all of these. I imagine there is some protection because these words are coming from a PAC but the governor has said the same stuff in news conferences.
- deleted 5y ago[deleted]
- datavirtue 5y agoThere isn't even any blame to deflect! Like, why is this a thing? Does Parson have an axe to grind with that publication? Just stop displaying social security numbers ffs.
- dekhn 5y agoah, the old "double down when wrong" strategy.
- officialchicken 5y agoCan't be wrong, can only be wrong-ed
- Bhilai 5y agoHere is a potentially dumb idea: Before someone can declare candidacy for a public office, they should pass an exam that tests them on general and basic knowledge on a wide variety of topics that proves that the person has some level of general awareness of tech that is so ubiquitous.
- davidw 5y agoThis sort of thing was used in the past to keep Black people from voting. https://en.wikipedia.org/wiki/Literacy_test#Voting https://en.wikipedia.org/wiki/Literacy_test#Voting
- colpabar 5y agoVery true. Just like gifted programs in schools. We should keep the bar as low as possible so that no one can ever claim we're racist.
- davidw 5y agoThis isn't about claiming anything. It was very much used in practice for many years in southern states, to keep people who had the "wrong" colored skin from voting. It's great to have high standards for public office, but it's the voters who should hold their elected officials to those, not an arbitrary test imposed by the government.
- joncrane 5y agoThe OP is saying the test is for holding office, not voting. There absolutely should be a higher bar for holding office than for voting.
- thehappypm 5y agoNope. Imagine a 99% white town where a Black man wants to run for mayor. Sorry pal, you failed the literacy test.
- erulabs 5y agoIt's a strange and very Double-Speak response to frame this as a political attack by the newspaper who found the flaw - and in particular the individual journalist. The idea that a journalist is "attacking" by finding an issue worth bringing up _must_ be cognitive dissonance, right? Otherwise all investigation would be a form of assault? Either someone with an IQ below 80 became governor or this is purely a strategic response. Strategy being? This prosecution will never hold up in court, and we all think the governor is an idiot. So the accomplished goal seems clear: Everyone is now saying this governors name.
- elliekelly 5y agoIt also has a chilling effect on journalism (and free speech generally). Even the threat of prosecution for a non-crime serves to discourage others from publicly discussing his administration’s errors. This situation is arguably the reason we have the first amendment: so the government can’t bully you into silence and submission when you’ve embarrassed them. When they’ve embarrassed themselves, really.
- erulabs 5y agoI hear what you're saying, but since there is such a zero chance this results in the journalist going to prison - I'm not entirely sure it has any effect - honestly if I was trying to become well-known as a journalist, I'd very much want to be in this spotlight - I'd be trying to find another mess up on Missouri's part to become part of this story. It very possibly has the opposite effect (the "Streisand effect"). The only _known_ effect is that this becomes a hot story and we're all outraged one way or the other.
- elliekelly 5y agoHaving criminal charges brought against you can ruin your life. Even if you’re completely and entirely vindicated in court it takes a serious toll on your mental, physical, and financial health. And that’s assuming you (can afford to) have a competent attorney and your boss is understanding of the situation enough not to fire you.
- arresthimnow 5y agoNIH admits Fauci lied to congress and FUNDED COVID-19 https://www.zerohedge.com/markets/fauci-lied-knowingly-willfully-and-brazenly-interview-dr-richard-ebright https://www.zerohedge.com/markets/fauci-lied-knowingly-willf...
- zschuessler 5y agoThis kind of politics makes my heart hurt. Parson wants to control the situation and is doing everything he can to do that, no matter the cost to the tax payers of my home state, or lives he impacts. I'm genuinely sad people like this are in power. The disclosure by the reporter was fair. The reporter waited to disclose the story until the department of education reviewed the matter. I don't see a court convicting from that fact, this is all for show on reelection. What I'd like to see is Parson respond to community questions in a townhall and be held accountable for his words. Namely, can we see the line item breakdown of how we got to $50 million? That is _five_ times the cost it took to build Missouri's great Arch..
- Acutulus 5y agoI find the article title kind of curious, given that it states Parson has "doubled down" which suggests that the video the article references is an active effort on Parson's part. It then goes on to state that the video was produced by a PAC Parson created but doesn't give direct input to. Comes off as unnecessarily inflammatory to me I suppose. Having said that, this situation in particular really tests my willingness to assume good faith on the part of the governor and his body of advisors. Is he legitimately without a single person close to him that could inform him of how misguided this line of aggression is, and how fortunate it was that the individual who identified the security problem acted in such a helpful manner? On top of that he assigned the Missouri State Highway Patrol to investigate, because given his perceived severity of the situation that's the best agency at his disposal? It all just seems bananas. I try not to assume that totally inane actions from elected officials are exclusively the result of political calculus, and I suppose I don't have any evidence to assume that's the case here either. But I'm at a loss as to how this situation could blossom into something so ridiculous.
- UncleOxidant 5y ago> is he legitimately without a single person close to him that could inform him of how misguided this line of aggression is I would not be surprised if that is the case. Or if he does have such a person he is only hearing what he wants to hear.
- deleted 5y ago[deleted]
- notreallyserio 5y agoIt sounds like he’s part of the Strong Man party and cannot be allowed to be wrong. I don’t think it’s purely political, some people just can’t be reasoned with.
- inetknght 5y ago> some people just can’t be reasoned with. It's been eye opening to see and recognize such people on the internet over the past 10 years or so. It's been a lot more scary to be able to recognize the same character flaw in real people I'm physically around.
- tragictrash 5y agoIsn't this defamation? Would the reporter in question have a case against the Governor here? IANAL, would love an explanation of how I'm wrong by someone more knowledgeable.
- perihelions 5y agoProbably no, because all the important alleged facts appear to be public. Expressing opinions (including wrong ones) is not defamatory in the US, and an inference based on disclosed, public facts is an opinion. "X broke the law" isn't a fact in this narrow sense; rather it's an inference drawn from a set of facts. e.g. (Volokh) https://www.washingtonpost.com/news/volokh-conspiracy/wp/2014/05/16/libel-law-and-inferences-from-disclosed-facts/ https://www.washingtonpost.com/news/volokh-conspiracy/wp/201... /not-a-lawyer
- Miner49er 5y agoCalling someone a hacker when they are clearly not remotely hacking, and saying they exposed private info when in fact it was the government, both seems like things that could be defemation to me.
- deleted 5y ago[deleted]
- atty 5y agoThis feels like the reaction of a child who was embarrassed in front of their friends on the playground, too upset to understand that doubling down just makes it look worse. Sad to see that sort of behavior coming from one of the ~100 most powerful elected individuals in the country. Bad look for Missouri. I also am incapable of understanding how this could be twisted into even vaguely being described as hacking. That’s like if I called myself a hacker for opening up the dev tools in my browser.
- bcrosby95 5y agoUnfortunately society generally seems to think its okay for adults to act like children, but it's not okay for children to act like children.
- bogwog 5y agoThis is like perfect viral content for our demographic. It's in the "rage" category (the most engaging type of content), and it is a black-and-white situation with no gray area whatsoever.
- tdhz77 5y agoWhen I lived in Missouri 10 years ago it would never have elected such an idiot. A state that brought decent thinking people like Thomas Hart Benton, President Truman, Roy Blunt and Claire McCaskill. There was a saying what goes Missouri so goes the nation.. this will never be true again. Thinking is secondary to outrage in this state. They have been outraged since Obama was elected.
- hindsightbias 5y ago> There was a saying what goes Missouri so goes the nation.. this will never be true again. Actually, that might explain a lot of things.
- ascendantlogic 5y agoElecting a black president permanently enraged a lot of hateful people across the country. We're going to be dealing with the fallout for a long time. To be clear I'm not saying we shouldn't have, but I think we underestimated just how many people in this country would react very badly to that from a political standpoint.
- indig0g0 5y ago> There was a saying what goes Missouri so goes the nation. That should scare every American. I can hop on a plane and be back in my country in about 5 hours, but what are you going to do if the whole country keeps trending the way that state is?
- voidwtf 5y agoThis attitude is how you attract the attention of many grey/black hat types willing to make you look foolish. I'm curious how long before someone accepts this as a challenge to expose truly damaging security missteps in the state government sites.
- moron4hire 5y agoThe most likely thing is that there are many trivial security issues such as this, they are actively being exploited, and the exploiters don't report because they can make more money just staying quiet and selling the data on the black market.
- abvdasker 5y agoI'll risk making this a partisan issue and say the anti-intellectual and anti-science bent seems increasingly prevalent among Republicans like Mike Parson and their constituencies. One of the most shocking statistics I've seen recently is the Pew poll which shows that in the space of 2 years Republican attitudes about higher education saw a 20-point swing such that that most Republican voters now believe college is net detrimental to society. To me the attacks on journalism, technology and science feel like part of a larger trend, especially given the COVID denialism we've seen. https://www.pewresearch.org/social-trends/2019/08/19/the-growing-partisan-divide-in-views-of-higher-education-2/ https://www.pewresearch.org/social-trends/2019/08/19/the-gro...
- leephillips 5y agoI don’t observe that to be generally true. Each party has its favorite science facts to deny. Republicans tend to invent controversies in climate science and evolution in order to misstate the types of uncertainties that exist in those fields. Democrats, increasingly, like to deny the basic reality of embryonic development and sex in humans, that can be found in any basic biology textbook.
- indig0g0 5y agoAs an immigrant from a country where we generally believe that science made the US what it is, it's unbelievable the stance the Republican party has taken with regards to science. To the extent that under Trump, there was an overt push to "take science out of the EPA". How is that even acceptable in a country like this?
- anovikov 5y agoI consider myself a liberal, and i agree with the point that college is net detrimental to society. It makes people waste their best years, teaches them mainly, useless stuff, barely breaks even in terms of lifetime earnings, and makes people bitter because they feel they are not valued by society the way they believe they should. This world needs a lot more new plumbers than new liberal arts majors. It is the society's fault that people feel compelled to go to college having little chance to make anything out of it.
- smoyer 5y agoI don't see this mentioned anywhere but the HTML page the journalist visited is public so there's no CFAA/DMCA violation there. Once the HTML page (data) is cached by the journalist's browser, they're free to do anything they want with the data. The journalist ran "his hacker tools" against his own computer which is also not a crime. Like others, I'm sad to see such a technically illiterate response when there should at least be advisors capable of explaining this. I also agree the journalist is unlikely to be convicted but we really don't need to muddy the fairly clear scope of computer crimes per the above laws.
- danbmil99 5y agoTake a look at the hiQ / LinkedIn case
- tantalor 5y ago> free to do anything they want Copyright could apply.
- xbar 5y agoJournalists reporting on security vulnerabilities in public systems getting sued for copyright violations would be novel, especially when the actual data involved (SSNs) is not data covered by copyright protections for the owners of those public systems. Perhaps you are trolling?
- tantalor 5y agoNo, I just meant the fact any page is public doesn't mean you can copy it freely in the general case. Usually the opposite is true.
- amohn9 5y agoAccessing public pages is exactly what weev was tried for. He found you could iterate the id argument on a public url to expose email addresses. He was sentenced to 41 months in federal prison
- say_it_as_it_is 5y agoEveryone here is doing exactly what this attack on the journalist was designed to do. It is deflecting attention from the incompetent grift machine running the technology systems in Missouri. If anything, this response demands worldwide attention on the state run systems and contracts paying to build and maintain them. Expect statewide incompetence paid at top dollar to contractors who aren't paid as much as the contract stipulates. FOIA all the way
- softwaredoug 5y agoI presume (and hope) given the high profile of the case the reporter will have some pretty heavyweight legal representation. While being involved in a lengthy, politically charged legal proceeding sucks, I don’t see how that ends well for the governor?
- deleted 5y ago[deleted]
- refracture 5y agoSo what's the lesson here? Never report a critical security problem and hope a nefarious person or group doesn't find it later? I realize this guy is just at it for political reasons.. but I don't think it can be overstated how much of a negative all of this is on society. Even if this reporter never gets convicted of anything it could leave trauma that will make others second guess 'doing the right thing'.
- Miner49er 5y agoThis kind if thing had been happening forever. You either have to report it anonymously or risk going to jail over trying to be helpful.
- xvector 5y agoIs it childish to want the next person who finds a vulnerability to exploit it to cause as much destruction as possible, and then blame it on Parson?
- tyingq 5y agoHis twitter account is in a funny state now. He got a lot of negative comments back when initially announcing this. Then doubled-down and sent another tweet about how it was more than just "view-source" (it wasn't.) Then, he started tweeting/re-tweeting unrelated stuff to try and bury it, but people kept replying to those and re-raising the issue. I look forward to the ACLU handing him his ass.
- akudha 5y agoI look forward to the ACLU handing him his ass. Does he care though? It is all about outrage, diverting attention from actual issues, hogging TV time. We are talking about it, Twitter is talking about it... Mission accomplished for him, no?
- tyingq 5y agoMaybe? He's looking stupid for at least some part of the state population, so it's costing him some amount of votes. And losing in court would be another round of that.
- danbmil99 5y agoI'm afraid he's looking stupid to the people that would never vote for him. Ditto for losing in court; the voters he's courting don't trust the courts because they didn't support Trump's election bs
- jonathanwallace 5y agoI served in the Georgia legislature during a portion of a similar story. Without a doubt, the calculations throughout the story were political not technical. In the Georgia version, the technical details of the exposed information in the Secretary of State's office were facepalmingly simple (misconfigured apache directives) yet the story dragged on politically for years. Quickly, a hired security researcher for a corporate client found all registered voters info and instructional pdfs with credentials for the elections system publicly indexed by google. They responsibly disclosed. The apache configuration was updated to "use encryption" (moved from http to https) but still left the info indexed by google over https vs. http. Eventually, this information became public. The state attempted to prosecute the security researcher but found no state statutes they could use. They then used this incident as a base to create a bill to criminalize the security researcher's actions. As a state rep, I worked very hard to push back on a bad bill spawned by the incident that would've criminalized responsible disclosure. Only due to bi-partisan efforts from technically versed people were we able to get the Governor at the time to veto the bill. https://www.snopes.com/ap/2017/06/15/researcher-finds-georgia-voter-records-exposed-internet/ https://www.snopes.com/ap/2017/06/15/researcher-finds-georgi... https://www.ajc.com/news/state--regional-govt--politics/computer-snooping-bill-vetoed-georgia-gov-nathan-deal/lJwKczPjiu9rDTUWBZJLBM/ https://www.ajc.com/news/state--regional-govt--politics/comp...
- sour-taste 5y agoThat's insane, thank you for your work. It reminds me of this story in Iowa, where pentesters were arrested and charged with felonies for breaking into a courthouse they were hired to infiltrate: https://darknetdiaries.com/episode/59/ https://darknetdiaries.com/episode/59/
- tweetle_beetle 5y agoI'm not an expert in this area, but was interested in that story when it happened. Reading commentary from others in the industry suggested that they were, at best, naive in their handling of that contract. Yes charging them was a political act to save face, but they put themselves in that position through ignorance. Quite a different situation from a reporter and responsible disclosure in my opinion.
- Koshkin 5y agoIt would seem to me that, in theory, it is OK to discover a security flaw by accident, but it’s not OK to be proactively looking for flaws, even out of curiosity, or try to exploit them for any purpose, however innocuous, unless you are a designated security specialist.
- deleted 5y ago[deleted]
- jimt1234 5y agoThere's a lot of comments along the lines of "How could the governor be this dumb?" or "Does he seriously expect this to succeed in court?" I recall an interview with Kevin Mitnick where he talked about a prosecutor arguing in court that he could start a nuclear war with a payphone (or something like that???). Kevin just sat there, listening to the prosecutor, thinking to himself that no judge could be so stupid as to believe that. Wrong. Kevin ended up sitting in jail for years based largely on the belief that he could whistle into a phone a launch nukes. The point is, yes, the courts are, or can be, that stupid, especially when it comes to "hacking". Just ask Kevin Mitnick.
- phkahler 5y ago>> The point is, yes, the courts are, or can be, that stupid, especially when it comes to "hacking". Just ask Kevin Mitnick. +1 for bringing up Mitnick. His book "The Art of Deception" is pretty good and covers what you mentioned. My belief is that the courts and the general public are not nearly so clueless any more. And to the extent that they might be, lawyers know that tech stuff is important and can now make the required arguments to convince any remaining uninformed people how dumb these claims are.
- danbmil99 5y agoIn case Kevin is reading this, you still owe me $500
- deleted 5y ago[deleted]
- Cabal 5y agoFlagged. From the article: > The video is produced by Uniting Missouri, a political action committee created by Parson supporters to back his 2020 election campaign. [...] It operates without direct input from Parson on its activities.
- IG_Semmelweiss 5y agoThis is not a partisan issue. Politicians, particularly those in higher office, are terrible people because the incentives reward those that lie, cheat and steal to get ahead. Elected officials are all antiscience and anti-reason on the left, the right, and the center, if the political situation calls for it. If you can't see that, maybe the problem is elsewhere
- cityzen 5y agopretty funny stuff, from the original article: Though no private information was clearly visible nor searchable on any of the web pages, the newspaper found that teachers’ Social Security numbers were contained in the HTML source code of the pages involved. IN THE HTML SOURCE CODE!!!! The publication also gave them advanced notice: The newspaper delayed publishing this report to give the department time to take steps to protect teachers’ private information, and to allow the state to ensure no other agencies’ web applications contained similar vulnerabilities. It is becoming clear that old folks like this need some basic internet literacy if they're going to accuse reporters of "hacking" because they looked at the source.
- bjd2385 5y agoThis is probably the most toxic thread I've read on this site in a long time. Like wow.
- totalfaggot 5y agoFAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT! FAGGOT!
- indig0g0 5y agoThe interesting part about this is the info that the journalist "hacked" is encoded in the HTML. Given that the website has been archived for the past 8 years, does that means one can fire up the Internet Archive and view those same info?
- surfsvammel 5y agoThis comment section makes it clear to me just how US centric the comment section of HN is. I’ll stay out of this one:)
- TheSocialAndrew 5y agoNot to worry, they have assigned the best Missouri Highway Patrolman on this as we speak. That one guy that fixed the Internet at the station by rebooting the modem has got this.
- Gunax 5y agoIt's not that much different than what happened to weev 10 years ago--a leaky url which was secured in the sense that it was unlinked and 'secret' (one had to guess the user's id). The legal conclusion was simple: weev did not have authorization to access those URLs. The implication being that you are not free to type whatever you want into the URL bar. If I make something accessible by URL accidentally, I haven't given you permission to access that URL.
- dhosek 5y agoIs no one commenting on the fact that the "hack" was doing a view source on the published HTML file? The people responsible for this should be too embarrassed to ever leave their homes again.
- indig0g0 5y agoWhen this story went viral the govt site in question (dese.mo.gov) was taken offline. It's since been back online.
- dang 5y agoRecent and related: Governor vows criminal prosecution of reporter who found flaw in state website - https://news.ycombinator.com/item?id=28866805 https://news.ycombinator.com/item?id=28866805 - Oct 2021 (678 comments)