7 ms·
Previous thread from 3 weeks ago: https://news.ycombinator.com/item?id=28867562 https://news.ycombinator.com/item?id=28867562 Recent developments: - The CS pr
by danso 5y ago
Previous thread from 3 weeks ago: https://news.ycombinator.com/item?id=28867562 https://news.ycombinator.com/item?id=28867562
Recent developments:
- The CS professor whose expert opinion was quoted by the newspaper article is demanding an apology and legal expenses from the state, alleging that the governor defamed and violated his free speech rights.
- The governor's political fundraising committee is running ads making this a "fake news" issue.
The email that the reporter sent, in advance of publishing the article revealing the state education website's data leakage:
> “I recently discovered a significant exposure of the sensitive data of more than 100,000 teachers on a DESE website,” Renaud wrote to the agency’s communications chief, Mallory McGowin. “At this point I am confident what I found is a genuine vulnerability — I have confirmed with three teachers from different districts that their data was exposed. I also have consulted an UMSL cybersecurity researcher who verified my findings. The P-D plans to publish a story about this sensitive data exposure, but we wanted to inform DESE first so that you would have a chance to mitigate the problem.”
> Renaud shared his timeline for publishing the story and asked for interviews with officials from DESE and the Missouri Office of Administration’s Information Technology Services Division. In a second email sent about 45 minutes later, he described the steps he’d taken in finding and confirming the vulnerability.
- docmechanic 5y agoThanks for the update. Not surprised to see the governor making the "fake news" argument rather than trying to criminalize the reading of HTML code - in browsers only - across the state of Missouri.
- smnrchrds 5y agoA few years ago an American lawyer wrote a book called Three Felonies a Day [0] whose premise is that "the average professional in this country wakes up in the morning, goes to work, comes home, eats dinner, and then goes to sleep, unaware that he or she has likely committed several federal crimes that day". If pressing F12 is a crime, the average software developer must be committing three felonies an hour. [0] https://www.amazon.ca/Three-Felonies-Day-Target-Innocent/dp/1594035229 https://www.amazon.ca/Three-Felonies-Day-Target-Innocent/dp/...
- devrand 5y agoDo you even need to press F12? Is looking at the HTML is the problem? What if I just download the page? I now have leaked SSNs saved to my computer. Is that criminal under in governor's mind?
- testplzignore 5y agoEach received TCP packet is a separate charge. After conviction, sentences will be served reliably and in order. Errors will be detected and punished severely.
- havkd 5y agoThat depends on whether you press F12 on your page or on someone else’s
- rootusrootus 5y agoAs I recall, that book was considered pretty good but the consensus was that the title was off by large amount. I.e. most people definitely do not commit three felonies a day. Maybe a few a month. Which is still bad, yes. FWIW, I can't remember the last time I pressed F12 ;-)
- dylan604 5y agoOf course the GP's premise assumes that most devs are web frontend types that care about the HTML. Based on modern frontend libraries, is there really any default HTML that view source would see other than enough to load up the megabytes of JS code?
- jdavis703 5y agoYes, consider the case of server side rendering. Or even companies like Basecamp that disavow single page applications. Or massive legacy ASP, PHP and Java web apps.
- 5y ago
- notreallyserio 5y agoI love the term fake news. As soon as someone uses it in some genuine fashion, I know that I don't have to take anything else they may say seriously. (Unless, of course, I become the direct target.)
- heavyset_go 5y agoAt one point "fake news" meant something concrete, referring to throwaway blogs masquerading as actual news organizations that don't exist.
- notreallyserio 5y agoDoes Bruno Mars is gay?
- dangle1 5y agoAlso the misfortune of a large fire on Monday that has taken out the workspace and equipment of 80 IT professionals: https://www.stltoday.com/news/local/govt-and-politics/more-computer-woes-in-missouri-after-fire-guts-building-housing-tech-offices/article_fad7931b-ac99-593f-a980-7b4c6862099c.html https://www.stltoday.com/news/local/govt-and-politics/more-c... Best online comment on the article: "When the building's on fire, don't call the fire department or Parson will accuse you of arson.
- madaxe_again 5y agoI’m trying to find the statistic, but it’s something like 75% of crime reporters in the US end up facing prosecution - i.e. if you report a fire, there’s a good chance you’ll face arson charges - if you phone the police to report an assault, there’s a good chance they’ll arrest you for calling them. Made that mistake as a kid when I saw a guy dragging his girlfriend down the street by her hair - turns out the guy was a local politician’s son, and I ended up facing a civil suit for her emotional distress caused by me interfering. I’ve found vulnerabilities in US government technology, and I know that the sensible and sane thing to do is just move on, ignore it, let it be someone else’s problem - I have no desire to end up in prison for being a Good Samaritan. If some greater fool can deal with it, let them deal with it. People don’t want help. They want someone to blame.
- threatofrain 5y ago> The governor's political fundraising committee is running ads making this a "fake news" issue. https://www.youtube.com/watch?v=9IBPeRa7U8E https://www.youtube.com/watch?v=9IBPeRa7U8E If anyone is curious what the political ad looks like.
- deeg 5y agoI almost never wade into the cesspool that is YT comments but just this once I read through a number. Every single one made fun of the governor and the PAC that put together the video. That was mildly heartening.
- TigeriusKirk 5y agoHave we heard yet what the exact form of the vulnerability was? I haven't seen precise details myself.