6 ms·

> also given him an award Find a vulnerability for a big tech company, get $10,000. Find a vulnerability for the government, get prosecuted. I wonder why gov

> also given him an award Find a vulnerability for a big tech company, get $10,000. Find a vulnerability for the government, get prosecuted. I wonder why government IT is so far behind the private sector!

barbazoo 5y ago
Except that they didn't get prosecuted.
- yashasolutions 5y ago
  well, it was on table for a brief moment... hence the article to communicate it is not happening...
  - datavirtue 5y ago
    And the place is sufficiently corrupt enough to have the prosecutor walking a tightrope so Parsons doesn't go after his ass too. I found the prosecutors statement very unsettling. He basically said that the reporter conducted criminal action but they are going to let it go because he has been punished enough already. Missouri sounds like a toxic, corrupt hell hole.
- rfrey 5y ago
  How stressful do you think the last couple of months have been for that reporter?
  - bruceb 5y ago
    Stressful but also good. Much more widely known than had not been subject to this threat. Probably good for future career prospects.
    - dylan604 5y ago
      Except, to be honest, I know this story (and love to make fun of it), but I couldn't pick the name of the reporter out of a list of names
      - beberlei 5y ago
        However i am probably right to assume that you are neither hiring in journalism nor working in that field. In reverse, you probably know a lot names of startup or IT personalities, that nobody outside our field would ever need to know
    - Beldin 5y ago
      I am not at all convinced that one story where the subject's reaction is out of place makes for a great career boost - though i can see ways how it achieves the opposite. "Known to cause lots of work for legal department" could, for some bosses, be considered a negative signal in hiring. Moreover, "pisses of people with power": same.
      - shadowgovt 5y ago
        "pisses off people with power" is sort of what it says on the résumé for any journalist worth hiring
        CRConrad 5y ago
        > what it says on the résumé for any journalist worth hiring To a good editor, yes. But I'm not sure the majority of editors are good ones, so while your point isn't exactly false, the GP's is also true (with all the other ones).
  - shadowgovt 5y ago
    Depends. Might have been a bit stressful, but this is exactly the kind of "good trouble" a good journalist hopes to be in. They thought they had just found a mistake in the government's IT system; instead, now that have a story about a mistake in the IT system and an idiot governor who doesn't understand infosec and is too bad a leader to delegate to people who do.
  - mdp2021 5y ago
    From the Statement by Josh Renaud about Missouri investigation: > This decision is a relief. But it does not repair the harm done to me and my family. // My deepest desire is that somehow this situation might be redeemed. And I believe it can be. // My actions were entirely legal and consistent with established journalistic principles.
  - barbazoo 5y ago
    You seem to be reading too much into what I wrote. I simply implied that what parent wrote was incorrect.
- xunn0026 5y ago
  I don't wish that limbo to you. Not being prosecuted after such serious threats from big people is no small thing.
- fortran77 5y ago
  Well, I think if the matter reaches the prosecutor's office and it sits there for several months before a determination is made whether to proceed, it's not a stretch for the party involved to prepare as if he will be prosecuted.
- mdp2021 5y ago
  What are the details behind «resolved through non-legal means». The display of corruption has been stellar.
  - CRConrad 5y ago
    > What are the details behind «resolved through non-legal means». The prosecutor did what the governor refused to do: Asked someone with a clue, and found out that absolutely no crime took place. Technical / factual means, not legal.
throwthere 5y ago
Clearly states need to start issuing equity options to govt employees on their future tax revenue. That and somehow raise property values in the middle of Missouri to $500/sq ft.
- hammock 5y ago
  You can definitely thank the government for lowering property values!
badRNG 5y ago
> Find a vulnerability for the government, get prosecuted. In fairness the government is, of course, not a monolith. There are multiple federal bug bounty programs out there [0] [1]. This is probably better stated as "find a vulnerability in the systems of a deeply corrupt, gerrymandered, and unpopular state's government's sites and be prosecuted in that state." [0] https://www.hackerone.com/hack-the-pentagon https://www.hackerone.com/hack-the-pentagon [1] https://www.dhs.gov/news/2021/12/14/dhs-announces-hack-dhs-bug-bounty-program-identify-potential-cybersecurity https://www.dhs.gov/news/2021/12/14/dhs-announces-hack-dhs-b...
- derangedHorse 5y ago
  The government is so fragmented and ineffective that even if I did find a pentagon vulnerability, I'd feel like some other department would prosecute me for it. One of the most unfair cases relating to security testing I've ever read about was that involving Coalfire Labs and the Iowa courthouse: https://www.cyberscoop.com/coalfire-security-pros-arrested-for-breaking-into-iowa-courthouse-are-still-bitter/ https://www.cyberscoop.com/coalfire-security-pros-arrested-f... Here's the darknet diaries episode where I first heard about it: https://darknetdiaries.com/transcript/59/ https://darknetdiaries.com/transcript/59/
andi999 5y ago
I think we shoudnt even call it a vulnerability. They send the 'secret' information in the html file, hoping that the browser does not render it (which it doesnt, so 'viewing source' was the way to see the information). I am actually surprised that the dont charge the person who set up that system; it is like broadcasting the confidential information.
- wildzzz 5y ago
  They should prosecute the hacker who wrote that dangerous "view source" feature

barbazoo 5y ago

Except that they didn't get prosecuted.

yashasolutions 5y ago
well, it was on table for a brief moment... hence the article to communicate it is not happening...
- datavirtue 5y ago
  And the place is sufficiently corrupt enough to have the prosecutor walking a tightrope so Parsons doesn't go after his ass too. I found the prosecutors statement very unsettling. He basically said that the reporter conducted criminal action but they are going to let it go because he has been punished enough already. Missouri sounds like a toxic, corrupt hell hole.
rfrey 5y ago
How stressful do you think the last couple of months have been for that reporter?
- bruceb 5y ago
  Stressful but also good. Much more widely known than had not been subject to this threat. Probably good for future career prospects.
  - dylan604 5y ago
    Except, to be honest, I know this story (and love to make fun of it), but I couldn't pick the name of the reporter out of a list of names
    - beberlei 5y ago
      However i am probably right to assume that you are neither hiring in journalism nor working in that field. In reverse, you probably know a lot names of startup or IT personalities, that nobody outside our field would ever need to know
  - Beldin 5y ago
    I am not at all convinced that one story where the subject's reaction is out of place makes for a great career boost - though i can see ways how it achieves the opposite. "Known to cause lots of work for legal department" could, for some bosses, be considered a negative signal in hiring. Moreover, "pisses of people with power": same.
    - shadowgovt 5y ago
      "pisses off people with power" is sort of what it says on the résumé for any journalist worth hiring
      - CRConrad 5y ago
        > what it says on the résumé for any journalist worth hiring To a good editor, yes. But I'm not sure the majority of editors are good ones, so while your point isn't exactly false, the GP's is also true (with all the other ones).
- shadowgovt 5y ago
  Depends. Might have been a bit stressful, but this is exactly the kind of "good trouble" a good journalist hopes to be in. They thought they had just found a mistake in the government's IT system; instead, now that have a story about a mistake in the IT system and an idiot governor who doesn't understand infosec and is too bad a leader to delegate to people who do.
- mdp2021 5y ago
  From the Statement by Josh Renaud about Missouri investigation: > This decision is a relief. But it does not repair the harm done to me and my family. // My deepest desire is that somehow this situation might be redeemed. And I believe it can be. // My actions were entirely legal and consistent with established journalistic principles.
- barbazoo 5y ago
  You seem to be reading too much into what I wrote. I simply implied that what parent wrote was incorrect.
xunn0026 5y ago
I don't wish that limbo to you. Not being prosecuted after such serious threats from big people is no small thing.
fortran77 5y ago
Well, I think if the matter reaches the prosecutor's office and it sits there for several months before a determination is made whether to proceed, it's not a stretch for the party involved to prepare as if he will be prosecuted.
mdp2021 5y ago
What are the details behind «resolved through non-legal means». The display of corruption has been stellar.
- CRConrad 5y ago
  > What are the details behind «resolved through non-legal means». The prosecutor did what the governor refused to do: Asked someone with a clue, and found out that absolutely no crime took place. Technical / factual means, not legal.

throwthere 5y ago

Clearly states need to start issuing equity options to govt employees on their future tax revenue. That and somehow raise property values in the middle of Missouri to $500/sq ft.

hammock 5y ago
You can definitely thank the government for lowering property values!

badRNG 5y ago

> Find a vulnerability for the government, get prosecuted. In fairness the government is, of course, not a monolith. There are multiple federal bug bounty programs out there [0] [1]. This is probably better stated as "find a vulnerability in the systems of a deeply corrupt, gerrymandered, and unpopular state's government's sites and be prosecuted in that state." [0] https://www.hackerone.com/hack-the-pentagon https://www.hackerone.com/hack-the-pentagon [1] https://www.dhs.gov/news/2021/12/14/dhs-announces-hack-dhs-bug-bounty-program-identify-potential-cybersecurity https://www.dhs.gov/news/2021/12/14/dhs-announces-hack-dhs-b...

derangedHorse 5y ago
The government is so fragmented and ineffective that even if I did find a pentagon vulnerability, I'd feel like some other department would prosecute me for it. One of the most unfair cases relating to security testing I've ever read about was that involving Coalfire Labs and the Iowa courthouse: https://www.cyberscoop.com/coalfire-security-pros-arrested-for-breaking-into-iowa-courthouse-are-still-bitter/ https://www.cyberscoop.com/coalfire-security-pros-arrested-f... Here's the darknet diaries episode where I first heard about it: https://darknetdiaries.com/transcript/59/ https://darknetdiaries.com/transcript/59/

andi999 5y ago

I think we shoudnt even call it a vulnerability. They send the 'secret' information in the html file, hoping that the browser does not render it (which it doesnt, so 'viewing source' was the way to see the information). I am actually surprised that the dont charge the person who set up that system; it is like broadcasting the confidential information.

wildzzz 5y ago
They should prosecute the hacker who wrote that dangerous "view source" feature