Hacker News Reader

Comment by CSSer | Hacker News Reader

It seems early to speculate, but if this is related to the massive uptick in CVEs we've been seeing recently it feels like we're actively witnessing a corporate reckoning around security posture the likes of which has never occurred.

View on HN

Someone found a vulnerability in the system of Hong Kong Airlines that let the user to see the details of another passenger by changing a few characters in the URL. He reported the issue to the airlines. Then he was prosecuted and found guilty for hacking.

Tells you a lot about the attitude of many cooperations about these vulnerabilities.

That says a lot more about the legal system than the airline

Presumably the airline reported it.

But such a thing should not be prosecutable in the first place. Opening an unlocked door isn't breaking and entering. If you walk inside and steal something, that's a different thing. But if you just close the door and alert the owner that their door is unlocked, what sane person would consider that a crime?

>But such a thing should not be prosecutable in the first place.

Bring it up with China. Hong Kong is in no serious way sovereign.

I noticed I could see a family member's blood test results when clicking their forwarded email when I was logged into _my_ account. Sent an email. No response, but IIRC they fixed it a few weeks later.

Just an anecdote to counterbalance the apathy the OP might instill in people. Do good, regardless of the system.

I think you have good intentions so I don't intend to attack you personally. just wanted to suggest that an individual being arrested for doing the right thing probably decreases the likelihood of them doing the right thing in future. so perhaps discretion is a good idea when doing the right thing, to increase chances of the right thing being done long term. there doesn't seem to exist a logical reason that corporations would avoid using the letter of the law to defend themselves, regardless as to how right that defense may be?

Can confirm, not arrested but threatened with litigation/employer contacted for responsible disclosure of unsanitized user input allowing arbitrary access to protected data of presumably any user. Just a url query param value flipped from true to false. Incrementing int user id too, so enumeration is trivial and the response payload was json so no need to do anything.

It is amazing what a casual observer with a background in web dev will see if they just open devtools. It has instilled a deep aversion in me to give any service any of my data that I care about protecting.

There should be an anonymous org way to report these without putting yourself in personal jeopardy, some kind of "innocent observer" protections built in...

If your system has gaps im not at fault for discovering them sort of deal

Long, long ago we had anonymous remailers.

It was a different time. Today, I don't think I'd trust an intermediary set up to - essentially - pass along 0-days not to sleep on the juicy ones.

wasn't that the origin of crypto and bitcoin too, or similar communities at least.

I think that's where I've read from about remailers in the past as in the same people who mined bitcoin early was into these

Unfortunately the anonymous org will then get abused by bad actors because of its anonymousness which leaves us where we are today

Deterrance not only works at the individual level, anyone reading these news reports about an innocent person being wrongly prosecuted for doing the right thing, is being trained to not do the right thing next time and just do nothing instead (because that's safer)

well I read those reports and came up with my comment above instead of running away so I'm not sure I can trust a conclusion based on your 'anyone' premise when the premise doesn't apply to me personally

anyone !== everyone

i assure u that nothing special has been accomplished by my body, most definitely i am an anybody and not a somebody. the purpose of a system is what it does, we dont have anything to disagree with outside of cheeky nit picks , so i guess this is good bye !

I dont see why we should do unpaid work for megacorps. If I found a vuln, I would seriously consider releasing it on the darknet if I could even figure out how to use it. Not even try to sell it, just give it to them. I have no sympathy for the shareholders, or the corporate drones that work there. Who actually feels the damage?

Unfortunately, the damage is usually felt by the individuals whose data is compromised.

they aren't being made whole by receiving "free credit monitoring" or a check for $12.83 18 months later either. maybe increasing the damages paid by the corporation is needed?

I can't edit, so as a general response: ya'll are a cynical lot, akin to parents who won't let their child walk to school because of the 0.0001% chance they'll be kidnapped. Y'all making the whole world all the worse for your cynicism. Sure, there's a remote chance you get in trouble for it. But there's also a chance you get hit by a car tomorrow morning. Yet you got out bed anyway.

Be the fucking change. At the very least, don't discourage others. Good grief.

I think that's a very privileged take. For most people, getting arrested and having the government try to press fraud and abuse charges is a life altering event, so it's natural that people would be more reticent.

If doing the right thing were easy, it wouldn't be what gives you character.

I agree: having charges brought against you is a life-changing event. FWIW neither Chan Tsz-yan nor Josh Renaud were arrested, and in both cases the charges were dropped. https://pressfreedomtracker.us/all-incidents/missouri-govern... https://missouriindependent.com/2022/02/11/prosecutor-isnt-p...

The system sucks, and will always suck.

If you think these two cases out of umpteen billion CVE/security incident reports are odds enough to hide your face and turn away because the risk is too much... I apologize for being crass, but frankly you're being a little bitch.

If these odds aren't good enough for you to live up to your values, what are?

you didn't have the guts to write me a response or to really acknowledge what the guy you're responding to here said. the things you say could be genuinely true , I'm not gonna absorb any of it since you're out here calling me a bitch while behaving like one yourself. was your goal to wave the finger or to inspire change in others? coz only one of those things happened today. by this point if you're an average human you'll have switched your brain off - on the off chance you're different, it's time to listen to the pot by tool

This one's still fresh in my mind: "A Missouri newspaper told the state about a security risk. Now it faces prosecution"[1]

[1] https://www.npr.org/2021/10/14/1046124278/missouri-newspaper...

Ah yes the government was putting teacher SSNs on the html client-side. Someone inspected element and found them and reported it. The governor went on a personal vendetta and tried to get him charged with CFAA violations which are no joke.

Made me realize we need way more coders in congress that understand basic technology. Especially with AI becoming a big part of society.

This is not the answer to this problem. Instead vulnerability researchers should share their findings with potential victims so they can sue rather than reporting to Republican state governments that will simply sue them.

What can the potential victims sue for specifically? Like what is the legal theory there? Which law has the state government broken and how would the plaintiffs get around sovereign immunity? Please to provide citations for the relevant statutes and case law.

I don't think understanding is the issue. It doesn't take a lot of tech knowledge to understand "the SSNs were all being sent, they were just hidden poorly."

What we need is fewer vindictive, fragile people in positions of power. Unfortunately this is an unsolved problem.

The problem with the people in power is that they were the ones seeking to be in power. If, instead, the mechanism was by lottery, thrusting the reigns of power upon any random citizen, the system wouldn't select for people who were also vindictive and fragile as a consequence of being egotistical enough to seek power.

It’s easy to criticise large legacy orgs having bad security, but what should you actually do as a C suite leader to fix it in these orgs?

It’s easy to list the various code scanning and monitoring solutions, but what do you do if teams continue to fail to fix issues on time? And realistically there’s a shadow IT of shell scripts and macros you don’t have much visibility on.

You can’t fire everyone, so I think it’d be better to link compensation of engineers (especially leads/managers) to scan reports, incidents, and audits, even if these are imperfect. But even then you’ll have business complaints about taking away engineering capacity from feature delivery.

The obvious first step is to outsource all IT infrastructure to one of the large service providers. While it's possible that they'll be breached, at least they have the resources and expertise to stand a fighting chance against the new wave of advanced persistent threats. Smaller companies outside the tech sector will never be able to keep up and secure their own systems. Like can you imagine some random manufacturing company hiring enough real security experts to keep up on their own? Even if they were willing to pay there around enough of those employees to go around. (I mean real security domain experts, not compliance process box checkers.)

It's unfortunate that every business now has to pay what effectively amounts to an IT security tax which will further enrich a small set of large tech companies. But that is our reality and there's no point in pretending otherwise.

>Tells you a lot about the attitude of many cooperations about these vulnerabilities.

If you were a faceless sociopathic entity that had a zero cost easy button to make problems go away you'd press it too.

I'm not sure there will be corporate reckoning. Unless security breaches come with business impacting consequences, they will continue to ignore it and just pay out occasional class action lawsuit.

I agree for data loss and ransomware where the ransom is paid, ie economically driven attacks. I wouldn’t agree when the hack is designed to kill the business destructively and no economic gain is sought or intended.

The difference in attack methodology is trivial, from a threat actor perspective, imho.

Sony Pictures is still in business.

Zeabur is shutting down: what happens next - https://news.ycombinator.com/item?id=50198025 - October 2026

- On October 14, 2026 (UTC), an external attacker gained unauthorized access to Zeabur's internal systems and some customer services. We began our emergency response as soon as we detected the unusual activity. We have confirmed that this incident affected a broader scope than the incident in late August...Having another security incident in such a short time has let down the people who trusted us. Protecting your services and data is our responsibility, and we have fallen short.

The end of the road – OSGrid shutting down due to attack - https://news.ycombinator.com/item?id=50060854 - October 2026

7 Companies Forced to Shut Down After a Data Breach - https://n2ws.com/blog/5-companies-shut-down-data-breaches - March 4th, 2025

(if others have more examples, I am collecting them, please drop them in a reply)

Jaguar Land Rover didn't go bust (yet) but they had to shut down production in the UK for months following a cyber attack.

Very much a material impact on the bottom line and share price

Jaguar-LandRover had a cyber attack which shut them down for months and nearly caused them to go bankrupt

https://en.wikipedia.org/wiki/Jaguar_Land_Rover_cyberattack

Of course they then blame "state sponsored" attackers.

https://www.techdigest.tv/2026/10/former-minister-confirms-j...

These days they’ll add “sophisticated AI attack” and get a pass for shoddy security.

I’ve been increasingly going with Delta regardless of price because of their tech being at least somewhat usable. I might even be inclined to switch to another carrier if they were to make entirely api-based (personal) access available for flight management and searching/booking (probably via MCP given the current climate, but I’ll take what I can get).

The "All modern digital infrastructure" xkcd (https://xkcd.com/2347/) where they had a fragile tower of blocks needs an update where those blocks are now collapsed on the floor in a complete mess.

There's been some modifications to that image for the AI era. I don't know where the original source is to properly credit the creator, but one example is here: https://www.linkedin.com/posts/darshan-j-baligeri_all-modern...

The corporate reckoning will only come if there's actual consequences for any of this. There haven't been any when this was happening to one big company a month, there won't be any when it starts happening to five big companies a day.

Sure a run-of-the-mill data leak might not do much besides ruffle customer's feathers. But disruptions to a companies' operations can become very costly, very quickly in today's tech-dependent world.

Eg. recent Albert Heijn (Dutch supermarket chain) "cyber incident" must have cost them 10s of millions of Euros.

That's real gain for any competitor NOT having such issue. See eg. Darwinian evolution on how even small (dis)advantages can lead to species being outcompeted & disappearing.

Most industries aren't in highly competitive markets, though, and many are trending towards oligopolies or monopolies. I can't speak for France, but in Canada, if this happened to Loblaws, the owners would just take it as another excuse to raise prices. Their profit margins are immense, and their competitors can't manage to eat into them or their market share.

Jevons has entered the room.

Perhaps it's time to... hire more engineers?

Engineers aren't a help if they have poor inuition and insight into security concerns themselves, which is true for almost all of them.

Filling departments with inexperienced people based on how well they can recall a classic algorithm on a whiteboard was never the set up for a secure software or IT ecosystem. Peers watching in shock and dismay as supply chain risk escalated year over year for the last decade, among other horrifying practices, have been crying over this all along.

They might be able to follow an AI lead better than someone even less technical, but it's unclear that doing without true expertise as an oversight and check would cut it.

Having walked ourselves into it long before AI appeared, We're set up for a dark time with few easy outs.

I have a more nuanced take on this, which is that many engineers may have decent intuition on security - but that's entirely besides the point here, because without the political capital to have a large organization (and their customers and counterparties!) change their workflows and security stances, they're tilting at windmills. Security is not one of those things that one can throw bodies at - it requires true attention and commitment from leadership, and time to percolate across every facet of a company. If such a mandate is in place, talent is far from the limiting factor.

As someone who has been working at a software supply chain security startup for the last 5 years of my life, watching it hemorrhage customers and watching our team get whittled down to essentially just me as our budget gets cut, while the rest of the company's token spend balloons past whatever we were paying the people we cut from my team... I think I'm done. I'm increasingly thinking I have to leave the computer industry in general or I'm going to off myself.

I did AppSec for a couple of years just for a change of pace. The friend who worked there said they wanted to strengthen their infosec program in general, which is why they wanted to hire an SWE for AppSec instead of using cyber boot camp grads like they had been. Turned out 90% of infosec is about creating all of the necessary paperwork to protect to company from liability if there's a breach. Actual security issues were ignored most of the time if there wasn't a compliance framework that addressed the vuln directly. We could have tripled the number of people in the department and it wouldn't have made any difference in terms of actual security. Maybe the compliance paperwork would have been submitted a bit sooner.

The same engineers who built the vulnerable systems?

Hiring them is only the start.

Keeping them, and having them around, to be responsible for cleaning up their mess, is the trick.

Modern (US) tech companies are spectacularly bad at keeping talent.

Really, really bad.

https://pwn.watch

https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

> it feels like we're actively witnessing a corporate reckoning around security posture the likes of which has never occurred.

As a cyber person, I agree. The theater has met reality, and those who put in the work will have an easier time than those who just checked a box. Good luck to all actively responding.

Safety alignment feels like an absolute farce and the completely wrong approach too. These things are guns, or attack dogs. We've never succeeded at reigning in software with this approach in the past, besides maybe DRM, which is itself laughable under many circumstances. This has the unprecedented ability to entertain the base desires of most juvenile threat actors, which is to get a big payout with minimal effort (let alone the pre-existing sophisticated attackers, who are now basically gods). Now we have a turn-key tool that can leverage and chain the most minute vulnerabilities up the ladder to full compromise or discover zero days with unyielding dedication. It feels like it almost makes CVE level classification moot.

As someone who red teams with open weight models (GLM 5.3 currently) and a domain focused harness, I would agree with this. No regulation will prevent a sufficiently capable open model, nor stop the development of open models. Alignment efforts are “please don’t stop us from selling stock to the unsophisticated” imho. They aren’t stopping anyone competent and/or capable from model development and training.

As someone on the development side who just cares a lot about security, I've already witnessed the strict safety bite in the wrong direction too. IT staff are predictably terrified of the blast radius of these tools, so they're inclined to lock down internal enterprise agent subscription permissions so tightly that the tool is not only neutered but also incapable of doing pre-product release, staging testing or even responsible disclosure of vulnerabilities to adjacent teams at the speed at which threat actors will be able to move once it's in production. That's pretty bad. It's not like we don't wonder about the implications of architectural decisions we're making as we do them. We just often lack the bandwidth or resources to fully explore them. And there's a huge difference between "Let's see if I can DDoS this service" and "I wonder if that token is single use or not". If you're going to be tying your system to theirs, it seems like it's a good idea to question the latter and report that to them if it's not prior to shipping it. Forcing the engineer to do that manually helps no one good. I've always thought zero-trust was a little broken in this way, but now it feels really shattered.

Reply on news.ycombinator.com