3 ms·
I don't think the "hardcoded" part is at issue here. If this wasnt a MySQL database but an API that exposed other customer information, he would have the same m
by aqme28 3y ago
I don't think the "hardcoded" part is at issue here. If this wasnt a MySQL database but an API that exposed other customer information, he would have the same moral duty to disclose and the same legal liability, I think.
- tptacek 3y agoMaybe not? Again, only speaking to US law, but your intent matters a lot here, and you have more plausible deniability sending API requests than you do making a direct connection to a database.
- aleph_minus_one 3y ago> you have more plausible deniability sending API requests than you do making a direct connection to a database. A direct connection to a database is an API, too. :-)
- tptacek 3y agoNot normally. Which matters here.
- aleph_minus_one 3y agoBut in this case, it is, since this is the way the client connects to the (database) server here.
- justsomehnguy 3y ago$15 what there is no law about illegally accesing information systems which even define API anywhere in the world.
- tptacek 3y agoWhat's your point? People have been convicted for doing things with actual APIs when prosecutors were able to demonstrate that a reasonable person would have assumed they shouldn't have done those things.
- justsomehnguy 3y agoAPI or not API is a technicality which bothers only tech nerds. The law would bother with such nuances.
- 2muchcoffeeman 3y agoMy thinking is that prod credentials that you aren’t supposed to have were used. So if you’ve been ask to investigate, and see something this glaringly bad, then you need to stop immediately, inform your boss, and get explicit approval before continuing.