4 ms·
Did you contact the creator first with these findings? What was the creator's response, if any? In any case I hope the creator was contacted, I'd say publishin
by thih9 1y ago
Did you contact the creator first with these findings? What was the creator's response, if any?
In any case I hope the creator was contacted, I'd say publishing active issues like this on a popular website would be arguably as bad as releasing insecure software.
- bravetraveler 1y agoResponsible disclosure for a meme-level mistake, lol. I understand letting them know. I agree. Painting them as equally wrong, no. "Popular website"; you mean 'theirs', right? The person with a whole 27 GitHub followers right now.
- MrGilbert 1y agoThe article says: "Nearly a thousand children under the age of 18 with their live location, photo, and age being beamed up to a database that's left wide open." Meme-level mistake is one thing, but their wrong doesn’t grant the right to be irresponsible for the author.
- bravetraveler 1y agoI don't believe this is irresponsible, they called for readers to report the app. We can all contact the host and go escalate if we want. I wouldn't suggest anyone recreate this process just to sanitize what's sitting around. There you go, new trolley problem.
- JanSt 1y agoPushing out an exact way to extract that data without giving the creator time to fix it may even be worse than using such code in production. The data may than be in the hands of malicious people who wouldn’t have found it otherwise
- bravetraveler 1y agoGo talk to the abuse contact, I won't stop you
- coal320 1y agoResponsible disclosure was given. Developer doesn't seem keen on changing things.
- handfuloflight 1y agoValid security issues buried under unnecessary smugness and basic 'techniques' like demonstrating the unzip command. The condescending tone undermines what could have been constructive disclosure. This reads like a high schooler dunking on a first grader, I'm just glad we all learned from the technical prowess of extracting an archive. The underlying problems with exposed API keys and unrestricted database access are serious, but your arrogant presentation does a disservice to responsible disclosure.
- ycombinatrix 1y agothis app leaks the private data of hundreds of children, but GP's "smugness" is the problem? give me a break. are you Christian Monfiston? that would explain a lot.
- handfuloflight 1y agoI never said the app's issues should be absolved, the security problems are obviously serious. But the author claims he did responsible disclosure and got no response, yet somehow skipped the obvious next step of contacting Apple directly. Instead he chose to publish a detailed technical writeup that essentially creates a how-to guide for exploiting these vulnerabilities. Now because of this post, these children are arguably at greater risk than before, since anyone can follow his step-by-step instructions. If he actually cared about user safety over HN karma, he would have escalated to Apple's App Store channel rather than publishing exploitation details. The smugness isn't the only problem, it's the irresponsible disclosure wrapped in performative outrage. You can criticize terrible security practices without creating a ready to replay tutorial for bad actors.
- ycombinatrix 1y ago