4 ms·
I don't agree that expulsion is the correct reaction, but when he ran the pen-test software, what he was doing was wrong. It's one thing to stumble upon a bug w
by readme 14y ago
I don't agree that expulsion is the correct reaction, but when he ran the pen-test software, what he was doing was wrong. It's one thing to stumble upon a bug while you're developing an app, and report it. That's totally respectable. Running pen-testing software without permission is akin to walking up to a stranger's home and testing that all the windows are locked, with a crowbar.
- rapind 14y agoNo, that's a terrible analogy unless this stranger is not a stranger, and is known to be trusted holding tons of personally identifiable information of yourself and your peers, and has already been alerted they left a window wide open (in this example, minimal tech know how is required). And saying crowbar is intentionally misleading people into thinking that damage is somehow being done during the check.
- randomdata 14y agoI can't help but feel a better analogy is finding a rip in the seat of a bus, reporting it, and then poking at the rip a few days later to see if it has been repaired. Going at someone's windows with a crowbar doesn't seem to fit the situation at all, in my opinion.
- unreal37 14y agoNo, he didn't check if this one bug was fixed. I mean, he could have done that without downloading pen test software - just by checking what he previously checked to discover the bug in the first place. What he did do was download pen test software to automatically check the website for flaws AFTER BEING TOLD NOT TO. He went to every bus and checked every seat, door, window, engine, tire, seat belt for dozens of different flaws without permission. And yes, pen test software can be destructive. It can put bad data in a database, crash a server, overrun log files, and corrupt things. Penetration testing is not a passive process.