3 ms·

I don't particularly disagree with the verdict. He was not hired by them, he did disclose the issue publicly, and the 3-day fix schedule is hilarious. And the 3

I don't particularly disagree with the verdict. He was not hired by them, he did disclose the issue publicly, and the 3-day fix schedule is hilarious. And the 3000 eur fine is more like a slap on the wrist. I actually know an ethical hacker, and the process is quite different - the "deadline" is more like 3 months, and he always contacts the authorities a long time before anything has a chance of going public. As for the company denying the issue this means nothing. It's reflex due to liability - GDPR exposes them of fines of millions, and an email saying "ups, we fucked up" is a quick shortcut to that. > [...] police arrived at the researcher’s residence on September 15, 2021, “gained access to the apartment and pushed him against the wall. The police confiscated a PC, five laptops, a cell phone and five external storage media - the programmer's entire work device.” This is the scary part. Total value confiscated is over 3000 eur, and the disruption created is even more than that. And this happened _before_ any conviction. THIS is what we should be up in arms about. From what I understand, confiscating phones and keeping them for the duration of the investigation is becoming, if not standard, at least moderately common. This is punishment, not investigation.

jevoten 3y ago
> As for the company denying the issue this means nothing. It doesn't mean nothing - if the company themselves claim it's not an issue, then they're admitting he didn't hack anything and didn't expose them to any risk by revealing the vulnerability. Because according to the company themselves, it "means nothing", so he just took them at their word. They can't have it both ways, claim it was nothing to avoid liability themselves, while also claiming it caused them great harm and he should be prosecuted. I will, perhaps, have a tiny bit of sympathy for the company, when attacks by companies on consumers via undisclosed spyware (they call it "telemetry") are treated in the same "raid the premises and confiscate everything" manner by the authorities.
- radu_floricica 3y ago
  I'm not sure if you're making an argument or just ranting. But in case it's an argument: the best behavior for the company is to say "ups, we fucked up", work with the hacker to fix the issue and maybe send some cash his way. The second best behavior is to deny the issue and work on fixing it. We didn't have a chance to see that, because 3 day deadline. It's even possible the initial denial was by a non-technical person, and it took more than 3 days to even escalate to somebody able to do something about it. We're not talking about just a guy with a laptop here, fixing this would most likely involve multiple people, both technical and non technical. Quite possibly somebody approving a budget and so on. That's why I said a 3-day deadline is hilarious.
BLKNSLVR 3y ago
I had $10k of gear confiscated. Took them eight months to find nothing, then I had to go pick it up. This was in Australia. Police forces are grossly under educated about anything related to computers and the internet, and ironically the people that suffer at their hands are the actual knowledgeable ones.
- rokkitmensch 3y ago
  Police forces are grossly under-educated. FTFY.
  - radu_floricica 3y ago
    Are they? I think it's more of a policy issue. When I said phones are starting to be confiscated by default I didn't even mean tech crimes. Many incidents nowadays can be better investigated if you have access to messenger apps and social media - so it's quite tempting to just seize the phones and study them leisurely. If we don't want this as a default for any investigation, we probably need to make some noise about it.
    - BLKNSLVR 3y ago
      Anecdotal aside: all my computer shit that was taken and they didn't confiscate my phone - and I'm thankful that was the case in terms of the ability to conduct day-to-day life, but it's also a bit confusing. I wasn't allowed to touch the phone (or any other of my tech gadgets) whilst under questioning during the raid, and I'm sure they spent some time either imaging it or looking its contents, but they didn't take it with them - nor any of my old phones. It's confusing, because many of the 'cases' I read about in the news mention that the kind of content they're looking for is discovered on phones. Maybe they figured the terabytes of data storage they did take (my NAS) would surely yield enough results.

jevoten 3y ago

> As for the company denying the issue this means nothing. It doesn't mean nothing - if the company themselves claim it's not an issue, then they're admitting he didn't hack anything and didn't expose them to any risk by revealing the vulnerability. Because according to the company themselves, it "means nothing", so he just took them at their word. They can't have it both ways, claim it was nothing to avoid liability themselves, while also claiming it caused them great harm and he should be prosecuted. I will, perhaps, have a tiny bit of sympathy for the company, when attacks by companies on consumers via undisclosed spyware (they call it "telemetry") are treated in the same "raid the premises and confiscate everything" manner by the authorities.

radu_floricica 3y ago
I'm not sure if you're making an argument or just ranting. But in case it's an argument: the best behavior for the company is to say "ups, we fucked up", work with the hacker to fix the issue and maybe send some cash his way. The second best behavior is to deny the issue and work on fixing it. We didn't have a chance to see that, because 3 day deadline. It's even possible the initial denial was by a non-technical person, and it took more than 3 days to even escalate to somebody able to do something about it. We're not talking about just a guy with a laptop here, fixing this would most likely involve multiple people, both technical and non technical. Quite possibly somebody approving a budget and so on. That's why I said a 3-day deadline is hilarious.

BLKNSLVR 3y ago

I had $10k of gear confiscated. Took them eight months to find nothing, then I had to go pick it up. This was in Australia. Police forces are grossly under educated about anything related to computers and the internet, and ironically the people that suffer at their hands are the actual knowledgeable ones.

rokkitmensch 3y ago
Police forces are grossly under-educated. FTFY.
- radu_floricica 3y ago
  Are they? I think it's more of a policy issue. When I said phones are starting to be confiscated by default I didn't even mean tech crimes. Many incidents nowadays can be better investigated if you have access to messenger apps and social media - so it's quite tempting to just seize the phones and study them leisurely. If we don't want this as a default for any investigation, we probably need to make some noise about it.
  - BLKNSLVR 3y ago
    Anecdotal aside: all my computer shit that was taken and they didn't confiscate my phone - and I'm thankful that was the case in terms of the ability to conduct day-to-day life, but it's also a bit confusing. I wasn't allowed to touch the phone (or any other of my tech gadgets) whilst under questioning during the raid, and I'm sure they spent some time either imaging it or looking its contents, but they didn't take it with them - nor any of my old phones. It's confusing, because many of the 'cases' I read about in the news mention that the kind of content they're looking for is discovered on phones. Maybe they figured the terabytes of data storage they did take (my NAS) would surely yield enough results.