3 ms·

Absolutely not. That's not your concern nor your problem. They're perfectly capable of hiring incident response experts, and companies commonly have cyber insu

Absolutely not. That's not your concern nor your problem. They're perfectly capable of hiring incident response experts, and companies commonly have cyber insurance that'll pay for it. "Demonstrating" is dumb and means you turn an ordinary disclosure into personal liability for you. Blabbing about it on the internet is just the idiot cherry on the stupid cake.

DANmode 8mo ago
If your goal is to successfully report and resolve, it is your problem. Agree otherwise. In the stories I’ve carefully read, no proof means being ignored by frontline people who are all you can reach, turning an ordinary disclosure into no disclosure at all.
- habinero 8mo ago
  That's still not your concern or your problem. You're not internet Batman. Opening up yourself to criminal liability for someone else's site is insane.
  - DANmode 8mo ago
    Lots of good white and grey hats have used anonymity to report for this exact reason. Whether or not you feel it’s your concern (or “problem”) depends on your thoughts on moral responsibility to others in your society.
    - habinero 8mo ago
      Yeeeeah, that's not how it works lol. Anyone who does offensive security for more than 5 minutes understands how little protection they have. And true anonymity is much, much harder than you think. If you act in certain ways, you will probably not get in trouble but I have a lawyer on retainer for a reason lol The harsh truth is you aren't protecting anything by doing this, because you can't control how (or if!) they fix the problem. All you're doing by accessing the data is for-real committing a felony, and that is an incredibly stupid thing to do.
      - DANmode 8mo ago
        > And true anonymity is much, much harder than you think. You take steps that match the threat model - if it’s important enough to you. Not everything found is. Some things are.
  - DANmode 8mo ago
    Even if you were selfish: it’s your own data being leaked. You don’t have to be Batman to want your data secure.

DANmode 8mo ago

If your goal is to successfully report and resolve, it is your problem. Agree otherwise. In the stories I’ve carefully read, no proof means being ignored by frontline people who are all you can reach, turning an ordinary disclosure into no disclosure at all.

habinero 8mo ago
That's still not your concern or your problem. You're not internet Batman. Opening up yourself to criminal liability for someone else's site is insane.
- DANmode 8mo ago
  Lots of good white and grey hats have used anonymity to report for this exact reason. Whether or not you feel it’s your concern (or “problem”) depends on your thoughts on moral responsibility to others in your society.
  - habinero 8mo ago
    Yeeeeah, that's not how it works lol. Anyone who does offensive security for more than 5 minutes understands how little protection they have. And true anonymity is much, much harder than you think. If you act in certain ways, you will probably not get in trouble but I have a lawyer on retainer for a reason lol The harsh truth is you aren't protecting anything by doing this, because you can't control how (or if!) they fix the problem. All you're doing by accessing the data is for-real committing a felony, and that is an incredibly stupid thing to do.
    - DANmode 8mo ago
      > And true anonymity is much, much harder than you think. You take steps that match the threat model - if it’s important enough to you. Not everything found is. Some things are.
- DANmode 8mo ago
  Even if you were selfish: it’s your own data being leaked. You don’t have to be Batman to want your data secure.