Hacker News Reader

Comment by thin_carapace | Hacker News Reader

I think you have good intentions so I don't intend to attack you personally. just wanted to suggest that an individual being arrested for doing the right thing probably decreases the likelihood of them doing the right thing in future. so perhaps discretion is a good idea when doing the right thing, to increase chances of the right thing being done long term. there doesn't seem to exist a logical reason that corporations would avoid using the letter of the law to defend themselves, regardless as to how right that defense may be?

View on HN

Deterrance not only works at the individual level, anyone reading these news reports about an innocent person being wrongly prosecuted for doing the right thing, is being trained to not do the right thing next time and just do nothing instead (because that's safer)

well I read those reports and came up with my comment above instead of running away so I'm not sure I can trust a conclusion based on your 'anyone' premise when the premise doesn't apply to me personally

anyone !== everyone

i assure u that nothing special has been accomplished by my body, most definitely i am an anybody and not a somebody. the purpose of a system is what it does, we dont have anything to disagree with outside of cheeky nit picks , so i guess this is good bye !

Can confirm, not arrested but threatened with litigation/employer contacted for responsible disclosure of unsanitized user input allowing arbitrary access to protected data of presumably any user. Just a url query param value flipped from true to false. Incrementing int user id too, so enumeration is trivial and the response payload was json so no need to do anything.

It is amazing what a casual observer with a background in web dev will see if they just open devtools. It has instilled a deep aversion in me to give any service any of my data that I care about protecting.

There should be an anonymous org way to report these without putting yourself in personal jeopardy, some kind of "innocent observer" protections built in...

If your system has gaps im not at fault for discovering them sort of deal

Long, long ago we had anonymous remailers.

It was a different time. Today, I don't think I'd trust an intermediary set up to - essentially - pass along 0-days not to sleep on the juicy ones.

wasn't that the origin of crypto and bitcoin too, or similar communities at least.

I think that's where I've read from about remailers in the past as in the same people who mined bitcoin early was into these

Unfortunately the anonymous org will then get abused by bad actors because of its anonymousness which leaves us where we are today

I dont see why we should do unpaid work for megacorps. If I found a vuln, I would seriously consider releasing it on the darknet if I could even figure out how to use it. Not even try to sell it, just give it to them. I have no sympathy for the shareholders, or the corporate drones that work there. Who actually feels the damage?

Unfortunately, the damage is usually felt by the individuals whose data is compromised.

they aren't being made whole by receiving "free credit monitoring" or a check for $12.83 18 months later either. maybe increasing the damages paid by the corporation is needed?

Reply on news.ycombinator.com