3 ms·
I do test a lot of websites actually but I mis-understood what you meant. Like the other guy said this area is grey. If he accidentally finds a stored xss of t
by theboss 13y ago
I do test a lot of websites actually but I mis-understood what you meant.
Like the other guy said this area is grey. If he accidentally finds a stored xss of the magnitude you suggest I'm 100% sure he still wouldn't go to jail. Who tests with a malicious payload? There would be no malicious intent in the situation and no unauthorized access...still.
- tptacek 13y agoYou didn't say this was a grey area. You said "Nobody will EVER go to jail for an XSS" and then cited the CFAA as evidence of that fact, suggesting that you might have some minor gaps on how XSS works and that you definitely have major gaps on how CFAA works. Pro-tip: avoid stringing "Nobody will EVER go to jail for" and "CFAA" together in the same paragraph.
- theboss 13y agoLet me rephrase. Nobody will go to jail for the level of poking and prodding I expect Dave is trying. I'm 100% sure the CFAA won't send anyone to jail for alert(1) My 100% is a gut feeling. I'll quit computers if I'm wrong
- tptacek 13y agoI doubt anyone is going to get in trouble over the PDF report I read about Healthcare.gov, but that's not why I'm commenting.