5 ms·

Indeed, especially when Googling "Mercedes report security issue" the page litterally populates the results with the address to email so it wasn't like it's har

by esskay 3y ago

Indeed, especially when Googling "Mercedes report security issue" the page litterally populates the results with the address to email so it wasn't like it's hard to find.

_kbh_ 3y ago
> Indeed, especially when Googling "Mercedes report security issue" the page litterally populates the results with the address to email so it wasn't like it's hard to find. Reporting via a third party isn't super unusual if you think that a organisation may be a bit legal threat happy from your report.
- waihtis 3y ago
  This may be true if there isn't a vulnerability disclosure program in place but there was, thus your point is completely invalid.
  - hug 3y ago
    No, his point remains: companies may act in bad faith, and publicly committing to act in good faith is absolutely no evidence they will not. I don’t mean to be trite, but publishing a bug bounty program doesn’t mean you’re the good guys.
    - waihtis 3y ago
      > publishing a bug bounty program doesn’t mean you’re the good guys this is meaningless rabble. Yes you can get burned in all kinds of legitimate situations [1], but 99.xx% of bug bounty interactions do not result in any kind of legal action even if you wander a bit out of scope [1]: https://eu.desmoinesregister.com/story/news/crime-and-courts/2021/08/01/arrested-coalfire-security-testers-2019-file-dallas-county-iowa-courthouse-lawsuit/5431611001/ https://eu.desmoinesregister.com/story/news/crime-and-courts...
      - beeboobaa 3y ago
        > this is meaningless rabble That is rich coming from yourself. Are you at all familiar with German law?
      - bombcar 3y ago
        It’s less than a 1% chance of financial ruin!m? Sign me up!
        waihtis 3y ago
        I hope you also avoid using any kind of modern transportation, like cars, since there's a non-zero chance of dying in a crash
        bombcar 3y ago
        I would probably avoid transportation that kills 1% of its users each trip.
        anon4242 3y ago
        Username checks out. Guess you're going for 100%?
mavhc 3y ago
Assuming anyone is reading that email account
- johannes1234321 3y ago
  Lawyers will. Then having journalists in the conversation helps, as they can produce bad press if the lawyers play games.
wirrbel 3y ago
It’s pretty dangerous according to German law to disclose security issues.
- joshuaissac 3y ago
  From earlier this month: German Court Fines Security Researcher for Reporting a Company's Data Vulnerabilities https://news.ycombinator.com/item?id=39098969 https://news.ycombinator.com/item?id=39098969
  - mass_and_energy 3y ago
    This is why I need the CCC in my life
    - sparrowInHand 3y ago
      But they have no big influence, they just play the courtjester to a forever demented king.
      - meinheld111 3y ago
        Thou it would be worse without a jester
- riedel 3y ago
  And it is in this sense kind of a smart move if you do not want to pay for a lawyer and there is no bug bounty program with T&Cs: journalists can protect their sources. However, you then somehow need to make sure that they waive potential hacking charges. Funnily in the quoted case one of the reasons for the fines was damages related to involving the press.
  - rurban 3y ago
    > journalists can protect their sources. But in this case not. He must have been pretty worried about German lawyers and courts, which decided really strange lately.

by esskay 3y ago

Indeed, especially when Googling "Mercedes report security issue" the page litterally populates the results with the address to email so it wasn't like it's hard to find.

_kbh_ 3y ago

> Indeed, especially when Googling "Mercedes report security issue" the page litterally populates the results with the address to email so it wasn't like it's hard to find. Reporting via a third party isn't super unusual if you think that a organisation may be a bit legal threat happy from your report.

waihtis 3y ago
This may be true if there isn't a vulnerability disclosure program in place but there was, thus your point is completely invalid.
- hug 3y ago
  No, his point remains: companies may act in bad faith, and publicly committing to act in good faith is absolutely no evidence they will not. I don’t mean to be trite, but publishing a bug bounty program doesn’t mean you’re the good guys.
  - waihtis 3y ago
    > publishing a bug bounty program doesn’t mean you’re the good guys this is meaningless rabble. Yes you can get burned in all kinds of legitimate situations [1], but 99.xx% of bug bounty interactions do not result in any kind of legal action even if you wander a bit out of scope [1]: https://eu.desmoinesregister.com/story/news/crime-and-courts/2021/08/01/arrested-coalfire-security-testers-2019-file-dallas-county-iowa-courthouse-lawsuit/5431611001/ https://eu.desmoinesregister.com/story/news/crime-and-courts...
    - beeboobaa 3y ago
      > this is meaningless rabble That is rich coming from yourself. Are you at all familiar with German law?
    - bombcar 3y ago
      It’s less than a 1% chance of financial ruin!m? Sign me up!
      - waihtis 3y ago
        I hope you also avoid using any kind of modern transportation, like cars, since there's a non-zero chance of dying in a crash
        bombcar 3y ago
        I would probably avoid transportation that kills 1% of its users each trip.
        anon4242 3y ago
        Username checks out. Guess you're going for 100%?

mavhc 3y ago

Assuming anyone is reading that email account

johannes1234321 3y ago
Lawyers will. Then having journalists in the conversation helps, as they can produce bad press if the lawyers play games.

wirrbel 3y ago

It’s pretty dangerous according to German law to disclose security issues.

joshuaissac 3y ago
From earlier this month: German Court Fines Security Researcher for Reporting a Company's Data Vulnerabilities https://news.ycombinator.com/item?id=39098969 https://news.ycombinator.com/item?id=39098969
- mass_and_energy 3y ago
  This is why I need the CCC in my life
  - sparrowInHand 3y ago
    But they have no big influence, they just play the courtjester to a forever demented king.
    - meinheld111 3y ago
      Thou it would be worse without a jester
riedel 3y ago
And it is in this sense kind of a smart move if you do not want to pay for a lawyer and there is no bug bounty program with T&Cs: journalists can protect their sources. However, you then somehow need to make sure that they waive potential hacking charges. Funnily in the quoted case one of the reasons for the fines was damages related to involving the press.
- rurban 3y ago
  > journalists can protect their sources. But in this case not. He must have been pretty worried about German lawyers and courts, which decided really strange lately.