4 ms·

Which jurisdiction is this in? I'm fairly sure this wouldn't fly here, afaik you can't be fired if you are doing your job properly, you didn't do something like

by Aachen 5y ago

Which jurisdiction is this in? I'm fairly sure this wouldn't fly here, afaik you can't be fired if you are doing your job properly, you didn't do something like steal from your employer, and the company isn't in trouble and can't afford you anymore. This is just hearsay, plus they already knew the claim was nonsense because you up front disclosed the issue. I'm not even sure which company I fault more here, OP's or the one with the security issue.

paxys 5y ago
I'm pretty sure running destructive pen tests on a competitor using work resources without any prior authorization from either company counts as doing your job improperly.
- Aachen 5y ago
  > using work resources Did OP do that? I thought he said he did it in private time, so I assumed using private resources (the post is deleted now). Using work resources does change the situation, though if it's just about client-side systems and not IP space then it makes very little difference in practice. Especially if your employer lets you use hardware for private purposes (this is apparently very common for company phones and laptops in NL/BE/DE; personally I like to have clear boundaries there...), but we don't know if that was the case here iirc. > destructive pen tests That's not really what happened though, if I remember the post correctly. Running a GET without authorization header whatsoever on a beta application and getting back production data with secret payment tokens in it... you can't make that stuff up.
tptacek 5y ago
Not sure where "here" is for you, but in the United States, you can be fired for having a bad haircut. Conducting unauthorized security testing on a company competitor will absolutely get you fired.
- Aachen 5y ago
  > Not sure where "here" is for you, but in the United States ...which is exactly why I was asking which jurisdiction OP is in. Kind of annoying when that information is omitted. I work in Germany but am from the Netherlands; both cultures and the resulting laws are quite similar anyway. > Conducting unauthorized security testing on a company competitor will absolutely get you fired. In the US, maybe. If all US companies are like OP's. For a data point from Europe, I actually asked my employer because it seems people here (mostly from the US afaik) thought I had too much confidence in my employer in other comments. I commented here with what I asked and their reply: https://news.ycombinator.com/item?id=30710078 https://news.ycombinator.com/item?id=30710078 It's also a bit different to look into a product meant for the general public (that's how I understood OP's situation to be), or if you actively seek out to hack a competitor's infrastructure and mess with them (not what OP was doing from my understanding).

by Aachen 5y ago

paxys 5y ago

I'm pretty sure running destructive pen tests on a competitor using work resources without any prior authorization from either company counts as doing your job improperly.

Aachen 5y ago
> using work resources Did OP do that? I thought he said he did it in private time, so I assumed using private resources (the post is deleted now). Using work resources does change the situation, though if it's just about client-side systems and not IP space then it makes very little difference in practice. Especially if your employer lets you use hardware for private purposes (this is apparently very common for company phones and laptops in NL/BE/DE; personally I like to have clear boundaries there...), but we don't know if that was the case here iirc. > destructive pen tests That's not really what happened though, if I remember the post correctly. Running a GET without authorization header whatsoever on a beta application and getting back production data with secret payment tokens in it... you can't make that stuff up.

tptacek 5y ago

Not sure where "here" is for you, but in the United States, you can be fired for having a bad haircut. Conducting unauthorized security testing on a company competitor will absolutely get you fired.

Aachen 5y ago
> Not sure where "here" is for you, but in the United States ...which is exactly why I was asking which jurisdiction OP is in. Kind of annoying when that information is omitted. I work in Germany but am from the Netherlands; both cultures and the resulting laws are quite similar anyway. > Conducting unauthorized security testing on a company competitor will absolutely get you fired. In the US, maybe. If all US companies are like OP's. For a data point from Europe, I actually asked my employer because it seems people here (mostly from the US afaik) thought I had too much confidence in my employer in other comments. I commented here with what I asked and their reply: https://news.ycombinator.com/item?id=30710078 https://news.ycombinator.com/item?id=30710078 It's also a bit different to look into a product meant for the general public (that's how I understood OP's situation to be), or if you actively seek out to hack a competitor's infrastructure and mess with them (not what OP was doing from my understanding).