4 ms·
> However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior. That's not prov
by alxndr 14y ago
> However, scripting that to do it many thousands of times and then collecting the information that results is a qualitative change of behavior. That's not proving a point, or being a responsible security researcher, that's something else.
What if you did it by hand? Where's the line between what's ok and what's not?
- rayiner 14y agoUltimately the line is drawn based on what the evidence implies about intent. What does downloading 10 URLs by hand to get a proof of concept say about intent versus downloading 10,000 with a script? If we're going to give "security researchers" license to test other people's systems without consent, shouldn't we at least have some understanding that such actions will be narrowly tailored to prove the necessary point?
- wnight 14y agoIt says nothing to people in the know. It takes no longer to write a script to scan an entire range and return all valid results as it does to scan a specific set, and it avoids having to pick known good IDs. You aren't giving anyone license anyone than the tide needs license to use the beach. You need to recognize that unpassworded sequential URLs are a vulnerability even if you shoot the messenger. And thus, shooting the messenger, and justifying it, is evidence of someone who doesn't get "it".