3 ms·

Isn’t this a bit like irresponsible disclosure? Since this may be considered a security vulnerability. Although it’s all client side, I’m sure there’s some basi

Isn’t this a bit like irresponsible disclosure? Since this may be considered a security vulnerability. Although it’s all client side, I’m sure there’s some basis for a lawsuit here.

bangaladore 2y ago
It is my opinion that you do not need to responsibly disclose "security by obscurity" Additionally, what is irresponsible here? Its not like this gives you the capability to clone tickets without first having a ticket in the first place.
AlotOfReading 2y ago
How is this a security vulnerability? It's displaying the exact bits Ticketmaster uses and explaining what those bits are. They're not circumventing security systems, just the requirement to use the app.
efitz 2y ago
The app-based barcodes don’t seem to be solving a security problem for customers - they seem to be for the purpose of ensuring that traditional scalping doesn’t work, forcing ticket resale into a market that TicketMaster can profit from. I would consider it unethical to publish details of an unpatched vulnerability that allowed ticket forgery, but I don’t think it’s unethical to bypass DRM-like controls for personal convenience rather than commercial purposes. Of course opinions may differ on this.
willcipriano 2y ago
Responsible disclosure is something you pay for, not something you are entitled to.
jjcm 2y ago
It requires sniffing your own session credentials first, which I don't see as a security vulnerability. The only thing it allows you to do is sell your ticket, which is legal to do.
Thaxll 2y ago
Everyone want Ticketmaster to die.
- criddell 2y ago
  Except for a lot of performers and venue operators. Ticketmaster is paid well to be the bad guy. They often share the fees with both the performer and the venue.
  - magnetowasright 2y ago
    I'm sorry to be that guy but do you have literally any source for this? Might just be the musicians I like, or the fact that negativity is better for clicks, but I've never seen an artist saying they get any benefit from ticketmaster's fees and other such shenanigans; I've only seen artists and venues saying that they don't get any money or benefits at all from ticketmaster's racketeering.
    - criddell 2y ago
      From the Ticketmaster website: > ticket fees (which can include a service fee, order processing fee, and the occasional delivery fee) are determined by and shared between the parties who have a hand in making live events happen including venues, Ticketmaster, sports teams, leagues and promoters When the artist doesn't want their fans to be charged big fees - they have some say in it. Robert Smith of The Cure made a stand on this last year and got Ticketmaster to refund a bunch of money.
      - rty32 2y ago
        > they have some say in it That's a very carefully crafted sentence. How much, exactly, do artists have a say? Do artists equally have the same amount of "say"? And why are we even discussing all these nonsense in the first place?
12_throw_away 2y ago
"Responsible disclosure" is poorly defined corporate wishcasting, and certainly not any sort of best practice or legal shield.
- Aachen 2y ago
  The public prosecutor does not pursue cases where responsible aka coordinated vulnerability disclosure was applied. I'd say that's a legal shield of some kind at least, and it is generally also considered best practice in the industry. There's exceptions to everything but, in the general case, I'm not sure where you're getting these viewpoints from
  - blincoln 2y ago
    "The public prosecutor does not pursue cases where responsible aka coordinated vulnerability disclosure was applied." That seems like a pretty substantial claim to make without any sort of "in [country/state/province/etc.]" qualification, let alone a reference.
    - Aachen 2y ago
      https://www.om.nl/onderwerpen/cybercrime/coordinated-vulnerability-disclosure---ethisch-hacken https://www.om.nl/onderwerpen/cybercrime/coordinated-vulnera...
  - deleted 2y ago
    [deleted]
coldpie 2y ago
Nah. Ticketmaster is unethical enough that spreading information that harms them or helps them go out of business is ethical.
speed_spread 2y ago
If it runs on my CPU and shows up on my screen after I paid for it, it's mine and I can do whatever I want. Anybody who thinks otherwise can fuck off outright.
- warkdarrior 2y ago
  That's exactly the same policy I apply to AGPL software. I paid for it ($0, as mandated by the developer) and it runs on my CPU.
jcranmer 2y ago
I'm struggling to come up with a good basis for a lawsuit. CFAA abuse is the first thing that comes to mind, but this is a real stretch for that, and SCOTUS shut that stretching down a while ago. DMCA doesn't come into play, since this isn't circumventing any copyright protection schemes. So this kind of leaves you with some form of contract violation, but even that seems like a stretch here. Tortious interference or interference with prospective business? I mean, I don't see any events complaining about this (hell, Ticketmaster itself arguably has some contract liability issues with the fact that their technology relies on cell service which tends to be spotty in dense crowds). So you're kind of left with some individual contract liability issue, which is literally not worth the cost of litigation.

Isn’t this a bit like irresponsible disclosure? Since this may be considered a security vulnerability. Although it’s all client side, I’m sure there’s some basis for a lawsuit here.

bangaladore 2y ago

It is my opinion that you do not need to responsibly disclose "security by obscurity" Additionally, what is irresponsible here? Its not like this gives you the capability to clone tickets without first having a ticket in the first place.

AlotOfReading 2y ago

How is this a security vulnerability? It's displaying the exact bits Ticketmaster uses and explaining what those bits are. They're not circumventing security systems, just the requirement to use the app.

efitz 2y ago

The app-based barcodes don’t seem to be solving a security problem for customers - they seem to be for the purpose of ensuring that traditional scalping doesn’t work, forcing ticket resale into a market that TicketMaster can profit from. I would consider it unethical to publish details of an unpatched vulnerability that allowed ticket forgery, but I don’t think it’s unethical to bypass DRM-like controls for personal convenience rather than commercial purposes. Of course opinions may differ on this.

willcipriano 2y ago

Responsible disclosure is something you pay for, not something you are entitled to.

jjcm 2y ago

It requires sniffing your own session credentials first, which I don't see as a security vulnerability. The only thing it allows you to do is sell your ticket, which is legal to do.

Thaxll 2y ago

Everyone want Ticketmaster to die.

criddell 2y ago
Except for a lot of performers and venue operators. Ticketmaster is paid well to be the bad guy. They often share the fees with both the performer and the venue.
- magnetowasright 2y ago
  I'm sorry to be that guy but do you have literally any source for this? Might just be the musicians I like, or the fact that negativity is better for clicks, but I've never seen an artist saying they get any benefit from ticketmaster's fees and other such shenanigans; I've only seen artists and venues saying that they don't get any money or benefits at all from ticketmaster's racketeering.
  - criddell 2y ago
    From the Ticketmaster website: > ticket fees (which can include a service fee, order processing fee, and the occasional delivery fee) are determined by and shared between the parties who have a hand in making live events happen including venues, Ticketmaster, sports teams, leagues and promoters When the artist doesn't want their fans to be charged big fees - they have some say in it. Robert Smith of The Cure made a stand on this last year and got Ticketmaster to refund a bunch of money.
    - rty32 2y ago
      > they have some say in it That's a very carefully crafted sentence. How much, exactly, do artists have a say? Do artists equally have the same amount of "say"? And why are we even discussing all these nonsense in the first place?

12_throw_away 2y ago

"Responsible disclosure" is poorly defined corporate wishcasting, and certainly not any sort of best practice or legal shield.

Aachen 2y ago
The public prosecutor does not pursue cases where responsible aka coordinated vulnerability disclosure was applied. I'd say that's a legal shield of some kind at least, and it is generally also considered best practice in the industry. There's exceptions to everything but, in the general case, I'm not sure where you're getting these viewpoints from
- blincoln 2y ago
  "The public prosecutor does not pursue cases where responsible aka coordinated vulnerability disclosure was applied." That seems like a pretty substantial claim to make without any sort of "in [country/state/province/etc.]" qualification, let alone a reference.
  - Aachen 2y ago
    https://www.om.nl/onderwerpen/cybercrime/coordinated-vulnerability-disclosure---ethisch-hacken https://www.om.nl/onderwerpen/cybercrime/coordinated-vulnera...
- deleted 2y ago
  [deleted]

coldpie 2y ago

Nah. Ticketmaster is unethical enough that spreading information that harms them or helps them go out of business is ethical.

speed_spread 2y ago

If it runs on my CPU and shows up on my screen after I paid for it, it's mine and I can do whatever I want. Anybody who thinks otherwise can fuck off outright.

warkdarrior 2y ago
That's exactly the same policy I apply to AGPL software. I paid for it ($0, as mandated by the developer) and it runs on my CPU.

jcranmer 2y ago

I'm struggling to come up with a good basis for a lawsuit. CFAA abuse is the first thing that comes to mind, but this is a real stretch for that, and SCOTUS shut that stretching down a while ago. DMCA doesn't come into play, since this isn't circumventing any copyright protection schemes. So this kind of leaves you with some form of contract violation, but even that seems like a stretch here. Tortious interference or interference with prospective business? I mean, I don't see any events complaining about this (hell, Ticketmaster itself arguably has some contract liability issues with the fact that their technology relies on cell service which tends to be spotty in dense crowds). So you're kind of left with some individual contract liability issue, which is literally not worth the cost of litigation.