4 ms·

(Note: The post appears to have disappeared, so I don't have the full details of what the author did/didn't do. I have a vague understanding based off the paren

(Note: The post appears to have disappeared, so I don't have the full details of what the author did/didn't do. I have a vague understanding based off the parent conversation.) I don't want to sound purposefully ignorant here but is your advice basically that, if you find a vulnerability, the only way to remain a white hat hacker, assuming you were not hired to check for vulnerabilities, to not report the security flaw? If not, please explain. If so, I can certainly understand the perspective, but for me, I feel a sort of obligation to make people aware of serious problems. Whether it be them driving around with a headlight burned out, or their website processing credit card info in an insanely insecure manner. Each are dangerous, and can cause many problems not just for the operator, but for the people around them as well. To me, it seems like it is ultimately at least as malicious as a grey or black hat, if a white hat were to find a basic (or serious) issue, and not try to inform the owner (or in this case, their boss) of the issue in some fashion. Perhaps the law should look for some kind of "good sanitarian law" for these sorts of situations.

tptacek 5y ago
There is no "good samaritan" clause in the CFAA, just for what it's worth to you. I don't know what this "white hat hacker" stuff is. There's no rule of hats in the law. I know "white hat" mostly as a term of derision, not as a technical or legal term of art. The problem this person has run into is that they went looking for vulnerabilities in someone else's website without permission to do that. You're not allowed to do that. If you do it, a lot of times you'll run into companies that are cool about it, but a lot of times the companies you run into aren't cool about it. The law is on the side of the people who aren't cool about it.
- deleted 5y ago
  [deleted]
- tluyben2 5y ago
  > The law US law right? Out of interest, not trying to make a point; I cannot read the article so I do not know.
- borski 5y ago
  to the sibling comment, since replies are turned off: yes, US law. I doubt either 'tptacek or I know any detail of significance around non-US computer fraud / security law.
caf 5y ago
The post is archived at https://web.archive.org/web/20220317003600/https://accidhacker.wordpress.com/2022/03/16/i-found-a-security-issue-on-a-competitor-got-fired-and-served-a-summons/ https://web.archive.org/web/20220317003600/https://accidhack...
- tptacek 5y ago
  It would be better if we weren't dragging this back onto the thread.
tsimionescu 5y ago
> I don't want to sound purposefully ignorant here but is your advice basically that, if you find a vulnerability, the only way to remain a white hat hacker, assuming you were not hired to check for vulnerabilities, to not report the security flaw? I think the important point is: if you don't want to risk a world of legal trouble, don't look for vulnerabilities in other people's systems in the first place, unless and until you have a contract with them. At the very least, make sure they have a bug bounty program or some other public indication that they are interested in getting vulnerability reports. Again, the most important point is that you do this before even checking for the vulnerability you think you may have found.

tptacek 5y ago

There is no "good samaritan" clause in the CFAA, just for what it's worth to you. I don't know what this "white hat hacker" stuff is. There's no rule of hats in the law. I know "white hat" mostly as a term of derision, not as a technical or legal term of art. The problem this person has run into is that they went looking for vulnerabilities in someone else's website without permission to do that. You're not allowed to do that. If you do it, a lot of times you'll run into companies that are cool about it, but a lot of times the companies you run into aren't cool about it. The law is on the side of the people who aren't cool about it.

deleted 5y ago
[deleted]
tluyben2 5y ago
> The law US law right? Out of interest, not trying to make a point; I cannot read the article so I do not know.
borski 5y ago
to the sibling comment, since replies are turned off: yes, US law. I doubt either 'tptacek or I know any detail of significance around non-US computer fraud / security law.

caf 5y ago

The post is archived at https://web.archive.org/web/20220317003600/https://accidhacker.wordpress.com/2022/03/16/i-found-a-security-issue-on-a-competitor-got-fired-and-served-a-summons/ https://web.archive.org/web/20220317003600/https://accidhack...

tptacek 5y ago
It would be better if we weren't dragging this back onto the thread.

tsimionescu 5y ago

> I don't want to sound purposefully ignorant here but is your advice basically that, if you find a vulnerability, the only way to remain a white hat hacker, assuming you were not hired to check for vulnerabilities, to not report the security flaw? I think the important point is: if you don't want to risk a world of legal trouble, don't look for vulnerabilities in other people's systems in the first place, unless and until you have a contract with them. At the very least, make sure they have a bug bounty program or some other public indication that they are interested in getting vulnerability reports. Again, the most important point is that you do this before even checking for the vulnerability you think you may have found.