Hacker News Reader

Comment by bt3 | Hacker News Reader

Perhaps I'm naïve, but the fact this "breach" is being disclosed anonoymously, via a medium commonly associated with nefarious data dumps suggests to me that there really was little consideration paid to allowing Panera an opportunity to correct this situation.

Disclosing this as such was irresponsible, despite being an important discovery.

View on HN

To bypass the responsible disclosure versus full disclosure debate: I provided them with well over six months of time to fix this and reported it last year. My own data is in this set.

Did you try reaching out to Troy Hunt, by chance? In the event of failed response from the site, I would maybe pass breaches to him, as he seems to be fairly successful at getting responses from breached organizations, and has an effective setup for notifying those breached.

Good work, in any case.

I sent this to Krebs and Troy shortly after uploading it.

Whilst that does appear to have had the desired effect in this case, I do hope to never find ourselves into the position where "responsible disclosure" includes "consulted with Troy Hunt" as a step.

>Disclosing this as such was irresponsible

How so? Is allowing a company a chance to patch a bug a responsibility that random people have to a company? What do those people get in return? Some companies will go as far as accusing the reporter of hacking them.

I might even go as far to say that if companies expect to be told of bugs and not have the information released to the wild, they will be less concerned with security because they can always patch the bugs as they come and perform the smallest disclosure they know of. Such an idea of 'responsible disclosure' may lead to less security overall.

Perhaps the responsible thing is reporting the breach to the public because they are the ones most hurt by it, so they can take immediate corrective actions.

It's also possible that Panera would prosecute you for hacking their systems, if they were able to identify you. Better to be safe and disclose anonomyously.

Is sniffing and accessing an API that requires no credentials really prosecutable for "hacking"?

Anyone can download a MITM proxy on their phone and replay HTTP/HTTPS calls.

Long story short, it's actually happened: https://en.wikipedia.org/wiki/Weev#AT&T_data_breach

Although Weev is a terrible person in general, this is the best case to cite for precedent.

It was given 6 months of lead time, but furthermore no researcher is under any obligation at all to consider corporate profits when releasing their research

Given the number of times well-meaning do-gooders have been prosecuted or sued after publicly disclosing a breach, I find this approach entirely reasonable.

The caveat, of course, is that the poster should definitely have first attempted to contact Panera. I would not be surprised at all if Panera responded by doing absolutely nothing, which eventually led to this post.

If you contacted them, you just opened yourself to potential persecution, even if it would not be you who actually pastebined it later.

Not even once.

Panera was contacted in August of last year.

Reply on news.ycombinator.com