23 ms·

I'm disappointed you're downvoted. I know a woman who is the exact situation you describe (sans hacker); their ex-husband has made threats to her life and has m

I'm disappointed you're downvoted. I know a woman who is the exact situation you describe (sans hacker); their ex-husband has made threats to her life and has made attempts to act on those threats. She's extremely privacy sensitive as a result. You are right. But remember you can be sued for anything, and further remember that suing someone doesn't mean you have good cause to win. For corollaries, see good samaritan laws [0]: (specifically about Texas) https://www.uslawshield.com/can-get-sued-good-samaritan-laws-texas/ https://www.uslawshield.com/can-get-sued-good-samaritan-laws... [1]: https://www.themirror.com/news/weird-news/i-cpr-crash-victim-saved-352724 https://www.themirror.com/news/weird-news/i-cpr-crash-victim... [2]: (More generally) https://en.wikipedia.org/wiki/Good_Samaritan_law https://en.wikipedia.org/wiki/Good_Samaritan_law So it stands to reason that a white hat hacker who, in good faith, publicly releases information in an attempt to get things fixed shouldn't face negative repercussion.

0xbadcafebee 2y ago
But they should face consequences if they were irresponsible, regardless of intention. If you found the nuclear launch codes, and you're pretty sure nobody else has found them, should you wait a week and then release them, because you had a good faith interest in exposing this hole? No, of course not, that'd be insane. What one should do in that situation is wait, and try to get the codes changed. You shouldn't wait forever, because someone else might find them. But you also should wait for as long as you reasonably can, because of how severe the risk of releasing is. This risk analysis is the calculus of responsible disclosure. Any ethical security researcher should err on the side of avoiding harm, making every effort to ensure the disclosure doesn't harm unnecessarily. For most researchers, that means waiting more than 2 months over a holiday season, even if it was just a bug in a javascript library or something. Knowingly exposing the privacy and security of thousands of people is pretty fucked up, imo. I'm pretty sure they could have come up with a half dozen different ways to try and get the issue resolved, if not through the company directly, then through individual apartment complexes, law enforcement, etc. Looking at this closer, it's actually worse than I originally thought. You can see what time everyone comes home every day, what their weekly routines are. So you know when they're gone, so you can rob their house. Or you know when they come home, so you know when you can attack them. This is fucking chilling.
- me-vs-cat 2y ago
  The author contacted the current and former vendors, got a flippant answer, asked again, and was ghosted for two weeks. I see here a desire for a random person to accept a staggering amount of your personal responsibility. Anyone under long-term active threat without defense-in-depth redundancy isn't someone I can save by waiting longer before disclosure. I am frankly amazed you expect so much from a stranger for so little benefit. It is fucking chilling -- that the publisher would do this, in the first place, and blow him off now, too. Why don't YOU pick up what you said, and start contacting apartment buildings and police? How many of those half-dozen ways you mentioned will YOU act upon?
- inetknght 2y ago
  > But they should face consequences if they were irresponsible, regardless of intention. Intention is important. If their intention is to highlight that a problem exists, then sure. They should be forced to participate in resolution (at the very minimum). As for liability? No, that definitely belongs on the owners of the insecure devices. If their intention is to show to "the bad guys" where the spots are vulnerable? Then yes, they are partly culpable. Again, being a good samaritan (showing that a problem exists) should NOT make you liable for the problems that already existed. > you also should wait for as long as you reasonably can That word, "reasonably", is loaded. I think waiting a couple of months is perfectly reasonable when being stonewalled by other parties, especially the owner. > that means waiting more than 2 months over a holiday season Yup, sure, because thieves definitely don't operate during holiday season. And please ask Russia and the US to hold off on their nuclear war. It's called Nuclear Winter, but that doesn't mean it has to happen during Winter, right? > This is fucking chilling. The problem existed before the announcement was made. You think it was chilling before? Just imagine that nobody who was capable of fixing it didn't know about the problem. So it could be abused without anyone being the wiser. That is fucking chilling. It's chilling that people would be more upset about the announcement and less upset about the apartment building owners not fixing the problem in the first place. That is fucking chilling.
blueflow 2y ago
I downvoted, because they wanted to create sympathy with a victim, and to achieve that, they made it a woman. What is the takeaway from that? I'm out of charitable explanations.
- inetknght 2y ago
  [flagged]
  - blueflow 2y ago
    [flagged]

0xbadcafebee 2y ago

But they should face consequences if they were irresponsible, regardless of intention. If you found the nuclear launch codes, and you're pretty sure nobody else has found them, should you wait a week and then release them, because you had a good faith interest in exposing this hole? No, of course not, that'd be insane. What one should do in that situation is wait, and try to get the codes changed. You shouldn't wait forever, because someone else might find them. But you also should wait for as long as you reasonably can, because of how severe the risk of releasing is. This risk analysis is the calculus of responsible disclosure. Any ethical security researcher should err on the side of avoiding harm, making every effort to ensure the disclosure doesn't harm unnecessarily. For most researchers, that means waiting more than 2 months over a holiday season, even if it was just a bug in a javascript library or something. Knowingly exposing the privacy and security of thousands of people is pretty fucked up, imo. I'm pretty sure they could have come up with a half dozen different ways to try and get the issue resolved, if not through the company directly, then through individual apartment complexes, law enforcement, etc. Looking at this closer, it's actually worse than I originally thought. You can see what time everyone comes home every day, what their weekly routines are. So you know when they're gone, so you can rob their house. Or you know when they come home, so you know when you can attack them. This is fucking chilling.

me-vs-cat 2y ago
The author contacted the current and former vendors, got a flippant answer, asked again, and was ghosted for two weeks. I see here a desire for a random person to accept a staggering amount of your personal responsibility. Anyone under long-term active threat without defense-in-depth redundancy isn't someone I can save by waiting longer before disclosure. I am frankly amazed you expect so much from a stranger for so little benefit. It is fucking chilling -- that the publisher would do this, in the first place, and blow him off now, too. Why don't YOU pick up what you said, and start contacting apartment buildings and police? How many of those half-dozen ways you mentioned will YOU act upon?
inetknght 2y ago
> But they should face consequences if they were irresponsible, regardless of intention. Intention is important. If their intention is to highlight that a problem exists, then sure. They should be forced to participate in resolution (at the very minimum). As for liability? No, that definitely belongs on the owners of the insecure devices. If their intention is to show to "the bad guys" where the spots are vulnerable? Then yes, they are partly culpable. Again, being a good samaritan (showing that a problem exists) should NOT make you liable for the problems that already existed. > you also should wait for as long as you reasonably can That word, "reasonably", is loaded. I think waiting a couple of months is perfectly reasonable when being stonewalled by other parties, especially the owner. > that means waiting more than 2 months over a holiday season Yup, sure, because thieves definitely don't operate during holiday season. And please ask Russia and the US to hold off on their nuclear war. It's called Nuclear Winter, but that doesn't mean it has to happen during Winter, right? > This is fucking chilling. The problem existed before the announcement was made. You think it was chilling before? Just imagine that nobody who was capable of fixing it didn't know about the problem. So it could be abused without anyone being the wiser. That is fucking chilling. It's chilling that people would be more upset about the announcement and less upset about the apartment building owners not fixing the problem in the first place. That is fucking chilling.

blueflow 2y ago

I downvoted, because they wanted to create sympathy with a victim, and to achieve that, they made it a woman. What is the takeaway from that? I'm out of charitable explanations.

inetknght 2y ago
[flagged]
- blueflow 2y ago
  [flagged]