3 ms·

This cannot be emphasized enough. Just keep your mouth shut or you will quite likely be sued. The only thing you should do is simply not just trust that partic

This cannot be emphasized enough. Just keep your mouth shut or you will quite likely be sued. The only thing you should do is simply not just trust that particular company with your data anymore. If the risk to public good is great enough and the bug simply must be revealed then it should be done anonymously and with full disclosure. Contacting the company will only give your address to them.

shangxiao 12y ago
What would happen if sah88 were to realise the site's name, but not the details, to warn other people to also not trust this company. Is this grounds for defamation or something like that?
- superpatosainz 12y ago
  Defamation/libel/etc. is only when you claim something false to be a fact.
  - sharpneli 12y ago
    Depends on the country. In UK truth is no defense for libel. Also if you are sued for libel in US and prove that they indeed have a security hole that gives them the evidence directly to sue you for 'hacking' their site.
    - noir_lord 12y ago
      US courts (at a state level) have occasionally ruled similarly, it is a worrying trend. > The court ruled in the case of Noonan v. Staples that truth published with “actual malice” gleaned from the context of the statement can give rise to a libel lawsuit. http://itlaw.wikia.com/wiki/Noonan_v._Staples http://itlaw.wikia.com/wiki/Noonan_v._Staples
    - DanBC 12y ago
      > In UK truth is no defense for libel. What? http://www.senseaboutscience.org/data/files/A_quick_guide_to_libel_laws_in_England_and_Wales.pdf http://www.senseaboutscience.org/data/files/A_quick_guide_to... > Justification: a defendant must show that the substance and fact of what they have written is true. However, a judge decides what the words meant, and therefore what a defendant must prove to be true – sometimes not what a defendant expects. http://en.wikipedia.org/wiki/English_defamation_law http://en.wikipedia.org/wiki/English_defamation_law > Allowable defences are justification (i.e. the truth of the statement), Edit: http://en.wikipedia.org/wiki/Defamation_Act_2013 http://en.wikipedia.org/wiki/Defamation_Act_2013 > and introducing new statutory defences of truth, honest opinion, and 'publication on a matter of public interest' or privileged publications (including peer reviewed scientific journals),
  - kordless 12y ago
    Is there an anonymous means by which this can be done?
smoe 12y ago
How about passing the information to someone like the EFF and let them inform the owners? The OP said he used a form for reporting security vulnerabilities on the site. Does he still have to be afraid to get sued in such a case?
- yuhong 12y ago
  I think the CERT would be a better idea.
- droopyEyelids 12y ago
  The EFF exists to influence court cases that are likely to set a precedent. They are not a general 'help everyone' organization for people who get into technological legal trouble- the closest they come is having a list of law firms they refer uninteresting legal business to.
  - smoe 12y ago
    That's why I wrote "like the EFF". I figured, when you life in a country where you actually can get sued for things like that, there must/should be an organisation or site one can use as a middleman. I wasn't aware of CERT. I'm still wondering if it has any legal influence in the US when a site provides a form for reporting vulnerabilities.

shangxiao 12y ago

What would happen if sah88 were to realise the site's name, but not the details, to warn other people to also not trust this company. Is this grounds for defamation or something like that?

superpatosainz 12y ago
Defamation/libel/etc. is only when you claim something false to be a fact.
- sharpneli 12y ago
  Depends on the country. In UK truth is no defense for libel. Also if you are sued for libel in US and prove that they indeed have a security hole that gives them the evidence directly to sue you for 'hacking' their site.
  - noir_lord 12y ago
    US courts (at a state level) have occasionally ruled similarly, it is a worrying trend. > The court ruled in the case of Noonan v. Staples that truth published with “actual malice” gleaned from the context of the statement can give rise to a libel lawsuit. http://itlaw.wikia.com/wiki/Noonan_v._Staples http://itlaw.wikia.com/wiki/Noonan_v._Staples
  - DanBC 12y ago
    > In UK truth is no defense for libel. What? http://www.senseaboutscience.org/data/files/A_quick_guide_to_libel_laws_in_England_and_Wales.pdf http://www.senseaboutscience.org/data/files/A_quick_guide_to... > Justification: a defendant must show that the substance and fact of what they have written is true. However, a judge decides what the words meant, and therefore what a defendant must prove to be true – sometimes not what a defendant expects. http://en.wikipedia.org/wiki/English_defamation_law http://en.wikipedia.org/wiki/English_defamation_law > Allowable defences are justification (i.e. the truth of the statement), Edit: http://en.wikipedia.org/wiki/Defamation_Act_2013 http://en.wikipedia.org/wiki/Defamation_Act_2013 > and introducing new statutory defences of truth, honest opinion, and 'publication on a matter of public interest' or privileged publications (including peer reviewed scientific journals),
- kordless 12y ago
  Is there an anonymous means by which this can be done?

smoe 12y ago

How about passing the information to someone like the EFF and let them inform the owners? The OP said he used a form for reporting security vulnerabilities on the site. Does he still have to be afraid to get sued in such a case?

yuhong 12y ago
I think the CERT would be a better idea.
droopyEyelids 12y ago
The EFF exists to influence court cases that are likely to set a precedent. They are not a general 'help everyone' organization for people who get into technological legal trouble- the closest they come is having a list of law firms they refer uninteresting legal business to.
- smoe 12y ago
  That's why I wrote "like the EFF". I figured, when you life in a country where you actually can get sued for things like that, there must/should be an organisation or site one can use as a middleman. I wasn't aware of CERT. I'm still wondering if it has any legal influence in the US when a site provides a form for reporting vulnerabilities.