4 ms·
It's also not completely crazy to wonder if this guy discovered the flaw like this, reported it in a way he knew would never actually get to OtherCo, then explo
by ufmace 5y ago
It's also not completely crazy to wonder if this guy discovered the flaw like this, reported it in a way he knew would never actually get to OtherCo, then exploited it himself through a more anonymous channel for real. Then wrote it up like this and made himself sound super-extra-innocent when he found it.
- vaxman 5y agoAgreed. This is the most likely scenario. His blog post is literary trash and full of unconvincing self-rationalizations of his every move prior to being caught, while also digging a hole for himself by articulating what kind of industry-insider knowledge was required to exploit that vulnerability. There is, however, a small chance that he is telling the truth, but it’s not enough to get him off the hook in a civil case (at least in the US) because the standard of proof is much lower. Dude’s handle on Twitter is “AccidHacker” and he may claim that’s short for “Accidental Hacker”, but that’s also not believable, from a literal/legal perspective anyway —more likely something an actual hacker would post lamenting how they wound up in such a life.