But maybe I'm wrong and in the real world there is not much penalty for exposing data of thousands or millions of users..
Wikipedia excerpt: "... for all individuals within the European Union (EU) and the European Economic Area (EEA)."
https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
The quote that you provide here that supposedly shows that the GDPR is irrelevant to Ebay Japan does not in fact contradict that claim.
Do you have an excerpt or other source that does?
This is fairly ridiculous, if you're have no European presence, you're free to ignore the GDPR. The EU has no legal jurisdiction over you, the only recourse would be for the EU to block your site and that's just not going to happen - no one wants to see a Great Firewall of the EU, can you imagine the backlash?
Or your trademarks become unenforceable in EU?
Imagine the mess if I start usatoday.eu, but « focussed only on the EU market ».
Since .com doesn’t operate in the EU market because of GDPR, am I really infringing in their mark?
That being said, it sure will be fun when all the British people/corporations won't be able to renew their .eu domains no more!
Which is bizarre reasoning: geo-IP databases are not foolproof, and thus you will get legitimate EU traffic from EU ISPs regardless. Further, by this reasoning, what's to say an EU customer using a VPN to exit in the US is somehow excluded from GDPR?
At some point the responsibility has to fall on the user instead of the business, and the I think actively skirting the rules is sufficient and a nice, clear line, to fault the user.
Perhaps by then companies around the world will be forced into paying more attention to these matters, and a system of reward for white hats may become the norm.
After some time smaller companies will be forced to work on market siloses, to not jave to worry about such lawsuits.
From there, it is not surprising that they would not bother to compensate white hat hackers, because we have established that the organization is fundamentally broken.
Who? They?
A common trollish trick is to use explicitly female usernames, so when we come down hard on them, it looks like we're abusing women. Another common troll trick is to make self-serving proclamations about why they were banned.
If you want to participate on HN, you need to take the spirit of this site to heart, as described at https://news.ycombinator.com/newsguidelines.html, and use it only as intended.
The main problem is that new developers come and go, so does the exposed gits.
Some were actually pretty high profile sites (probably top 100 at the time) but I was worried they'd come after me if I reported the vulnerabilities (that was the standard response before bounty programs and such) so I just dumped it and moved on.
I'm sure I'm not the only one that just did it for sport.
Anyone want to hazard a guess at whether anyone else between 2015 and 2018 also thought to run the same experiment with the same parameters and thus also downloaded ebay.co.jp's production database passwords and Wordpress admin credentials?
Of course, that would only be a concern if the master hacker in question decided eBay Japan's backend data was more valuable than having their name on a website that says "good job thanks".