3 ms·

This is not like dropping a wallet in a public place. This is literally the equivalent of sending your wallet to my house amongst other things that I actually r

This is not like dropping a wallet in a public place. This is literally the equivalent of sending your wallet to my house amongst other things that I actually requested. When you visit a website you are essentially trusting the website and giving it permission to download arbitrary data (in the form of HTML, CSS, and Javascript) to your machine. Now imagine if that website gave you more data than you intended to the point where it made you liable as an owner of something you neither intended to have nor wanted. In terms of delivering something malicious to someone under no presumption of its deliverance, it's analogous to the extreme case of someone shipping a whole bunch of cocaine in a package with a book that you ordered. If we want to get closer to the actual problem, it's like you finding a paper shipped with your book and seeing a whole bunch of social securities numbers on it that may have included your own! Now if you have reasonable indication that this list was being sent out to everyone who ordered books from a specific place, of course you'd want to inform the people sending books to stop doing this so you could feel safe about your personal information. Now imagine instead of protecting the information which has been going out to random people, the company decided to get angry and attempt to prosecute you for pointing out their negligence. It's absolute idiocracy. As one of the Missouri residents who had their social security number exposed in this way I'd be furious at those who were delivering it.

thinkharderdev 5y ago
Right, you should be furious at the people who created the site because they are absolutely at fault. But X is at fault for ludicrously bad security practices and Y exploited said bad security illegally are not mutually exclusive. But to use your example, if you accidentally ship you credit card to me amongst a bunch of other papers, it would still be illegal for me to sell the information on the dark web. Likewise, if the reporter in question took the SSNs and sold them on the dark web that would presumably be prosecutable as well. Now if I just took the credit card and returned it to you, I don't think any reasonable person would consider that illegal (and I certainly hope that no prosecutor would try and bring a case for it). My only point is that we ultimately are making judgements about malicious intent. To be clear I don't mean to imply this is just some misunderstanding either. Obviously the MO governor is just being a blowhard to try and deflect blame for a really bone-headed screw up. But I see a lot of discussions in security/hacker circles where people seemingly think that if security is bad enough, then whatever you do to exploit it cannot possibly be illegal. But I don't think that is true and people should keep it in mind.
- CRConrad 5y ago
  > But X is at fault for ludicrously bad security practices and Y exploited said bad security illegally are not mutually exclusive. No, but even that wasn't the case here. When X has NO -- not even "ludicrously bad" -- security, Y can't have "exploited" anything, because there was nothing for them to exploit.

thinkharderdev 5y ago

Right, you should be furious at the people who created the site because they are absolutely at fault. But X is at fault for ludicrously bad security practices and Y exploited said bad security illegally are not mutually exclusive. But to use your example, if you accidentally ship you credit card to me amongst a bunch of other papers, it would still be illegal for me to sell the information on the dark web. Likewise, if the reporter in question took the SSNs and sold them on the dark web that would presumably be prosecutable as well. Now if I just took the credit card and returned it to you, I don't think any reasonable person would consider that illegal (and I certainly hope that no prosecutor would try and bring a case for it). My only point is that we ultimately are making judgements about malicious intent. To be clear I don't mean to imply this is just some misunderstanding either. Obviously the MO governor is just being a blowhard to try and deflect blame for a really bone-headed screw up. But I see a lot of discussions in security/hacker circles where people seemingly think that if security is bad enough, then whatever you do to exploit it cannot possibly be illegal. But I don't think that is true and people should keep it in mind.

CRConrad 5y ago
> But X is at fault for ludicrously bad security practices and Y exploited said bad security illegally are not mutually exclusive. No, but even that wasn't the case here. When X has NO -- not even "ludicrously bad" -- security, Y can't have "exploited" anything, because there was nothing for them to exploit.