Hacker News Reader

Comment by dist-epoch | Hacker News Reader

This is a pet peeve of tptacek:

> server-side vulnerabilities are worth very little, because they quickly get patched.

The "take over any instagram/meta account through their AI password reset chatbot" was going around and sold on shady forums for ~1 month before being patched.

then server side vulnerabilities should not be reported, instead sell the data, more profitable

Very few people would even have the knowledge of who, how, or where to "sell" such vulnerabilities. Going through a public bounty program is pretty much always preferable.

Most people don't want to be felons.

Don't worry, as more and more people get put of of work by AI the number of people willing to be felons will increase. Hell, they might even become president.

The president can't be a felon by definition, because it's legal to do absolutely anything if you're the president.

The legality of most activities doesn't change, but you can't be prosecuted while you're president.

I am sure this is a crime, but what crime?

I think people who can hack, also know where they can sell it

Anyone can "hack". It's not really a skill anymore.

The recent South Korean hacker reportedly wasn't a hacker at all, just asked Claude to handle it.

I'm not that kind of hacker, but I guarantee I could be, complete with an abliterated model on my local rig, in a few minutes. Claude would happily set it all up for me, too.

In reality, I suppose I'm about to keep my rig busy staying ahead of the hackers.

I'm sure there are places that would sue you for that, and it's not worth the bother. Bug bounties really compete mostly with people like me who would say, "Haha, I found an issue with Meta; they're gigantic idiots." And then make an X post or anything about it.

Technically this is what you’d call a client-side vuln, but yes, server-side as in cloud.

Reply on news.ycombinator.com