5 ms·

This analogy is just wrong, on the web exists perfect anonymity. Very often you also can hide your traces and nobody will ever find out what you did. You have

by sek 15y ago

This analogy is just wrong, on the web exists perfect anonymity. Very often you also can hide your traces and nobody will ever find out what you did. You have to assume every exploit will be abused. The most stupid thing you can do is attack the white hats, because the next hacker will shove your stupidity down your throat. On a lulz way or on a black hat way. I would never let my data near a company which doesn't respect white hats, for security and moral reasons. I would remind you that we are on Hacker News, that doesn't exclude the popular meaning of the word.

JangoSteve 15y ago
I agree security vulnerabilities should be addressed by the company as much as they can. But there's no such thing as a perfectly secure system, so there will always be some amount of vulnerability. My only point is that there are ways to communicate with companies and help them fix things without committing a crime and breaking them. I wouldn't throw a brick at a store window to make sure they have an alarm installed. Likewise, I wouldn't screw with someone else's production system to make sure they have X or Y security vulnerabilities patched. If you're worried about your own data, then try the exploits on your own account, or repository as the case may be. If it's a concern, get a hold of the company and let them know.
- sek 15y ago
  You are on the mercy of the guy who found the vulnerability, if you like it or not. This person can have any personality and most of them don't care about your costs. They did your work and invested a lot of time. Most of then don't want money, they want appreciation for what they did. You can give it to them, or they take it and they have the perfect tool for that.
  - JangoSteve 15y ago
    Entirely true. And that person is at the mercy of their governing law and the company's ability to pursue and press charges should they decide to take matters into their own hands, regardless of intent (unless their governing law takes intent into account).
    - jebblue 15y ago
      Has he been arrested yet? If not, I wonder why not. Github should press charges.
  - kellenfujimoto 15y ago
    There's a big difference between acknowledging that a crime can be committed, and condoning that crime when it happens.
- dthunt 15y ago
  > If it's a concern, get a hold of the company and let them know. Easier said than done. It's hard enough to find the right people to talk to when people are so paranoid about connecting devs with customers, and if by chance you wind up talking to a PM first, the first thing he does is engage legal, which means instead of fixing the problem and protecting their customers and data, you may now be threatened with lawsuits, have the incident reported to the FBI or someone for investigation (on the assumption that you are in fact trying to extort them or something). In this world, I'm not sure you can 'win' at this situation at present. Until there are protections for white hats that are broadly recognized, I'm going to side with people like Egor, who find a big damn problem and don't use it for ill.
  - sek 15y ago
    In Germany we have the CCC, they provide legal advice for these cases and have a ton of experience. Do you have something similar in the states?
    - dthunt 15y ago
      EFF has a network of people they can put people in touch with, even if for a variety of reasons they can't offer legal help in a particular instance. But that's not the point. While we can be grateful for the CCC and the EFF for existing and doing the community a great service, we can also believe that their extraordinary contributions should be unnecessary.
  - JangoSteve 15y ago
    That's a very good point about there not necessarily being a right answer. Though of all the companies in the world, Github is one of the easiest to get in touch with their developers.
    - dthunt 15y ago
      And yet Egor made several attempts to illustrate the depth of a single problem, and nobody was able to understand that this was serious badness. Sometimes, it is actually necessary to pull down someone else's pants to expose a problem. I think the record here speaks for itself.

by sek 15y ago

JangoSteve 15y ago

I agree security vulnerabilities should be addressed by the company as much as they can. But there's no such thing as a perfectly secure system, so there will always be some amount of vulnerability. My only point is that there are ways to communicate with companies and help them fix things without committing a crime and breaking them. I wouldn't throw a brick at a store window to make sure they have an alarm installed. Likewise, I wouldn't screw with someone else's production system to make sure they have X or Y security vulnerabilities patched. If you're worried about your own data, then try the exploits on your own account, or repository as the case may be. If it's a concern, get a hold of the company and let them know.

sek 15y ago
You are on the mercy of the guy who found the vulnerability, if you like it or not. This person can have any personality and most of them don't care about your costs. They did your work and invested a lot of time. Most of then don't want money, they want appreciation for what they did. You can give it to them, or they take it and they have the perfect tool for that.
- JangoSteve 15y ago
  Entirely true. And that person is at the mercy of their governing law and the company's ability to pursue and press charges should they decide to take matters into their own hands, regardless of intent (unless their governing law takes intent into account).
  - jebblue 15y ago
    Has he been arrested yet? If not, I wonder why not. Github should press charges.
- kellenfujimoto 15y ago
  There's a big difference between acknowledging that a crime can be committed, and condoning that crime when it happens.
dthunt 15y ago
> If it's a concern, get a hold of the company and let them know. Easier said than done. It's hard enough to find the right people to talk to when people are so paranoid about connecting devs with customers, and if by chance you wind up talking to a PM first, the first thing he does is engage legal, which means instead of fixing the problem and protecting their customers and data, you may now be threatened with lawsuits, have the incident reported to the FBI or someone for investigation (on the assumption that you are in fact trying to extort them or something). In this world, I'm not sure you can 'win' at this situation at present. Until there are protections for white hats that are broadly recognized, I'm going to side with people like Egor, who find a big damn problem and don't use it for ill.
- sek 15y ago
  In Germany we have the CCC, they provide legal advice for these cases and have a ton of experience. Do you have something similar in the states?
  - dthunt 15y ago
    EFF has a network of people they can put people in touch with, even if for a variety of reasons they can't offer legal help in a particular instance. But that's not the point. While we can be grateful for the CCC and the EFF for existing and doing the community a great service, we can also believe that their extraordinary contributions should be unnecessary.
- JangoSteve 15y ago
  That's a very good point about there not necessarily being a right answer. Though of all the companies in the world, Github is one of the easiest to get in touch with their developers.
  - dthunt 15y ago
    And yet Egor made several attempts to illustrate the depth of a single problem, and nobody was able to understand that this was serious badness. Sometimes, it is actually necessary to pull down someone else's pants to expose a problem. I think the record here speaks for itself.