5 ms·

With all due respect, most of the replies here are missing the most important point. Does the company have a bug bounty policy? No? Then keep your mouth shut

With all due respect, most of the replies here are missing the most important point. Does the company have a bug bounty policy? No? Then keep your mouth shut and get on with your life. A significant percentage of people in power will react to unsolicited warnings of security vulnerabilities by attacking you as though you were their enemy. Worse, the law is at least not clearly on your side. This is not theoretical: people have come to significant harm in this way. Being a hero is great. Being a martyr? Not so much. You don't want next week's top HN story to be an appeal for donations to the legal defense fund of sah88.

sharpneli 12y ago
This cannot be emphasized enough. Just keep your mouth shut or you will quite likely be sued. The only thing you should do is simply not just trust that particular company with your data anymore. If the risk to public good is great enough and the bug simply must be revealed then it should be done anonymously and with full disclosure. Contacting the company will only give your address to them.
- shangxiao 12y ago
  What would happen if sah88 were to realise the site's name, but not the details, to warn other people to also not trust this company. Is this grounds for defamation or something like that?
  - superpatosainz 12y ago
    Defamation/libel/etc. is only when you claim something false to be a fact.
    - sharpneli 12y ago
      Depends on the country. In UK truth is no defense for libel. Also if you are sued for libel in US and prove that they indeed have a security hole that gives them the evidence directly to sue you for 'hacking' their site.
      - noir_lord 12y ago
        US courts (at a state level) have occasionally ruled similarly, it is a worrying trend. > The court ruled in the case of Noonan v. Staples that truth published with “actual malice” gleaned from the context of the statement can give rise to a libel lawsuit. http://itlaw.wikia.com/wiki/Noonan_v._Staples http://itlaw.wikia.com/wiki/Noonan_v._Staples
      - DanBC 12y ago
        > In UK truth is no defense for libel. What? http://www.senseaboutscience.org/data/files/A_quick_guide_to_libel_laws_in_England_and_Wales.pdf http://www.senseaboutscience.org/data/files/A_quick_guide_to... > Justification: a defendant must show that the substance and fact of what they have written is true. However, a judge decides what the words meant, and therefore what a defendant must prove to be true – sometimes not what a defendant expects. http://en.wikipedia.org/wiki/English_defamation_law http://en.wikipedia.org/wiki/English_defamation_law > Allowable defences are justification (i.e. the truth of the statement), Edit: http://en.wikipedia.org/wiki/Defamation_Act_2013 http://en.wikipedia.org/wiki/Defamation_Act_2013 > and introducing new statutory defences of truth, honest opinion, and 'publication on a matter of public interest' or privileged publications (including peer reviewed scientific journals),
    - kordless 12y ago
      Is there an anonymous means by which this can be done?
- smoe 12y ago
  How about passing the information to someone like the EFF and let them inform the owners? The OP said he used a form for reporting security vulnerabilities on the site. Does he still have to be afraid to get sued in such a case?
  - yuhong 12y ago
    I think the CERT would be a better idea.
  - droopyEyelids 12y ago
    The EFF exists to influence court cases that are likely to set a precedent. They are not a general 'help everyone' organization for people who get into technological legal trouble- the closest they come is having a list of law firms they refer uninteresting legal business to.
    - smoe 12y ago
      That's why I wrote "like the EFF". I figured, when you life in a country where you actually can get sued for things like that, there must/should be an organisation or site one can use as a middleman. I wasn't aware of CERT. I'm still wondering if it has any legal influence in the US when a site provides a form for reporting vulnerabilities.
chacham15 12y ago
The answer is not "sweep the problem under the rug", but rather "tell people who know what theyre doing". The idea of "oh lets just pretend this security hole doesnt exist" makes me cringe. As JCR wrote: "The safe and sane approach is to contact CERT [3,4] through their vulnerability reporting page [5] and let them contact the vendor." [4] https://www.cert.org https://www.cert.org [5] http://www.kb.cert.org/vuls/html/report-a-vulnerability/ http://www.kb.cert.org/vuls/html/report-a-vulnerability/
- crazypyro 12y ago
  If that idea makes you cringe, you should work to change our politicians because that is how the law is written. Any unauthorized access, even if the initial probe was accidental, is against the law and with the way security break-ins hurt company stock prices these days, you can be damn sure someone will come after you if it gets out, even if you weren't the one to release it. All-in-all, don't tell people unless you have explicit, written proof of the companies consent to pentest their application because its simply not worth risking your entire life because someone in power's day is ruined by your curiosity.
anon4 12y ago
I agree. If it doesn't impact you, turn around and walk away. If you do want to make a difference, sell the exploit to the chinese. You'll still be arrested and charged for hacking, but at least you'll have made some money and made the exploit visible.
serve_yay 12y ago
Yeah. People don't like this answer because it's so obviously suboptimal in technical and security terms, but you're absolutely right. There's no upside to disclosure and only downside. If they don't welcome disclosures, beware.

sharpneli 12y ago

This cannot be emphasized enough. Just keep your mouth shut or you will quite likely be sued. The only thing you should do is simply not just trust that particular company with your data anymore. If the risk to public good is great enough and the bug simply must be revealed then it should be done anonymously and with full disclosure. Contacting the company will only give your address to them.

shangxiao 12y ago
What would happen if sah88 were to realise the site's name, but not the details, to warn other people to also not trust this company. Is this grounds for defamation or something like that?
- superpatosainz 12y ago
  Defamation/libel/etc. is only when you claim something false to be a fact.
  - sharpneli 12y ago
    Depends on the country. In UK truth is no defense for libel. Also if you are sued for libel in US and prove that they indeed have a security hole that gives them the evidence directly to sue you for 'hacking' their site.
    - noir_lord 12y ago
      US courts (at a state level) have occasionally ruled similarly, it is a worrying trend. > The court ruled in the case of Noonan v. Staples that truth published with “actual malice” gleaned from the context of the statement can give rise to a libel lawsuit. http://itlaw.wikia.com/wiki/Noonan_v._Staples http://itlaw.wikia.com/wiki/Noonan_v._Staples
    - DanBC 12y ago
      > In UK truth is no defense for libel. What? http://www.senseaboutscience.org/data/files/A_quick_guide_to_libel_laws_in_England_and_Wales.pdf http://www.senseaboutscience.org/data/files/A_quick_guide_to... > Justification: a defendant must show that the substance and fact of what they have written is true. However, a judge decides what the words meant, and therefore what a defendant must prove to be true – sometimes not what a defendant expects. http://en.wikipedia.org/wiki/English_defamation_law http://en.wikipedia.org/wiki/English_defamation_law > Allowable defences are justification (i.e. the truth of the statement), Edit: http://en.wikipedia.org/wiki/Defamation_Act_2013 http://en.wikipedia.org/wiki/Defamation_Act_2013 > and introducing new statutory defences of truth, honest opinion, and 'publication on a matter of public interest' or privileged publications (including peer reviewed scientific journals),
  - kordless 12y ago
    Is there an anonymous means by which this can be done?
smoe 12y ago
How about passing the information to someone like the EFF and let them inform the owners? The OP said he used a form for reporting security vulnerabilities on the site. Does he still have to be afraid to get sued in such a case?
- yuhong 12y ago
  I think the CERT would be a better idea.
- droopyEyelids 12y ago
  The EFF exists to influence court cases that are likely to set a precedent. They are not a general 'help everyone' organization for people who get into technological legal trouble- the closest they come is having a list of law firms they refer uninteresting legal business to.
  - smoe 12y ago
    That's why I wrote "like the EFF". I figured, when you life in a country where you actually can get sued for things like that, there must/should be an organisation or site one can use as a middleman. I wasn't aware of CERT. I'm still wondering if it has any legal influence in the US when a site provides a form for reporting vulnerabilities.

chacham15 12y ago

The answer is not "sweep the problem under the rug", but rather "tell people who know what theyre doing". The idea of "oh lets just pretend this security hole doesnt exist" makes me cringe. As JCR wrote: "The safe and sane approach is to contact CERT [3,4] through their vulnerability reporting page [5] and let them contact the vendor." [4] https://www.cert.org https://www.cert.org [5] http://www.kb.cert.org/vuls/html/report-a-vulnerability/ http://www.kb.cert.org/vuls/html/report-a-vulnerability/

crazypyro 12y ago
If that idea makes you cringe, you should work to change our politicians because that is how the law is written. Any unauthorized access, even if the initial probe was accidental, is against the law and with the way security break-ins hurt company stock prices these days, you can be damn sure someone will come after you if it gets out, even if you weren't the one to release it. All-in-all, don't tell people unless you have explicit, written proof of the companies consent to pentest their application because its simply not worth risking your entire life because someone in power's day is ruined by your curiosity.

anon4 12y ago

I agree. If it doesn't impact you, turn around and walk away. If you do want to make a difference, sell the exploit to the chinese. You'll still be arrested and charged for hacking, but at least you'll have made some money and made the exploit visible.

serve_yay 12y ago

Yeah. People don't like this answer because it's so obviously suboptimal in technical and security terms, but you're absolutely right. There's no upside to disclosure and only downside. If they don't welcome disclosures, beware.