2 ms·

This isn't the first time a security research who's politely and confidentially disclosed a vulnerability has been threaned. There's an important lesson to glea

This isn't the first time a security research who's politely and confidentially disclosed a vulnerability has been threaned. There's an important lesson to glean from this. The next time someone discovers a company that has poor database security, they should, IMO: (1) make a full copy of confidential user data, (2) delete all data on the server, (3) publish confidential user data on some dumping site; and protect their anonymity while doing all 3 of these. If these researchers had done (2) and (3) – and done so anonymously, that would have not only protected them from legal threats/harm, but also effectively killed off a company that shouldn't exist – since all of Buzz/Fizz users would likely abandon it as consequence.

AnimalMuppet 3y ago
So your solution for possibly being prosecuted for something marginal is to do several things for which it would be much more reasonable to be prosecuted? That seems like a rather unwise solution to the problem. It's especially unwise because you now give the company a massive incentive to hire real forensics specialists to try to track you down. You're placing a lot of faith in your ability to remain anonymous under that level of scrutiny.
pc86 3y ago
"To avoid a baseless legal threat you should commit multiple felonies" is certainly an interesting take.
- meepmorp 3y ago
  Well, at that point, the legal threats stop being baseless. Problem solved!
jstarfish 3y ago
> The next time someone discovers a company that has poor database security, they should, IMO: (1) make a full copy of confidential user data, (2) delete all data on the server, (3) publish confidential user data on some dumping site; and [4] protect their anonymity while doing all 3 of these. Aaron Swartz only did (1). Failing at (4) didn't end so well for him. I get that you're frustrated but encouraging others to make martyrs of themselves is cowardice. If some dumb kid tries this and their opsec isn't bulletproof, they're fucked. Put your own skin in the game and do it yourself if your convictions are that strong.
dragonwriter 3y ago
> If these researchers had done (2) and (3) – and done so anonymously, that would have not only protected them from legal threats/harm No, it wouldn’t. Anonymity can be penetrated, and the more incentive people have to do so, the more likely it will be.

AnimalMuppet 3y ago

So your solution for possibly being prosecuted for something marginal is to do several things for which it would be much more reasonable to be prosecuted? That seems like a rather unwise solution to the problem. It's especially unwise because you now give the company a massive incentive to hire real forensics specialists to try to track you down. You're placing a lot of faith in your ability to remain anonymous under that level of scrutiny.

pc86 3y ago

"To avoid a baseless legal threat you should commit multiple felonies" is certainly an interesting take.

meepmorp 3y ago
Well, at that point, the legal threats stop being baseless. Problem solved!

jstarfish 3y ago

> The next time someone discovers a company that has poor database security, they should, IMO: (1) make a full copy of confidential user data, (2) delete all data on the server, (3) publish confidential user data on some dumping site; and [4] protect their anonymity while doing all 3 of these. Aaron Swartz only did (1). Failing at (4) didn't end so well for him. I get that you're frustrated but encouraging others to make martyrs of themselves is cowardice. If some dumb kid tries this and their opsec isn't bulletproof, they're fucked. Put your own skin in the game and do it yourself if your convictions are that strong.

dragonwriter 3y ago

> If these researchers had done (2) and (3) – and done so anonymously, that would have not only protected them from legal threats/harm No, it wouldn’t. Anonymity can be penetrated, and the more incentive people have to do so, the more likely it will be.