Re:How not to protect against SQL injection (view source)
by nowarninglabel on Wednesday March 30, 2011 @02:49AM
(#2386142)
I wouldn't say they were paranoid. A few months back I showed a colleague what looked like the openings of a very serious data leak in a major company's site. He investigated further and then reported it up through the chain of command and then over to the company. At no point did he do anything other than what was done here, as in point out a publicly visible security flaw. He was nearly fired after the company threatened to sue. The company only relented when he agreed to keep quiet and his employers disciplined him. The employers didn't back him up. All this for solely reporting a flaw, absolutely zero use of said flaw.
I lost a lot of my faith in humanity that day.
Re:How not to protect against SQL injection (view source)
by flexd on Thursday March 31, 2011 @02:45AM
(#2390630)
I would go find a new employer if that was the case, what bunch of idiots.
Re:How not to protect against SQL injection (view source)
by jggube on Wednesday March 30, 2011 @10:52AM
(#2387465)
Is that the typical response to bug reports, or an exception to the rule?
Re:How not to protect against SQL injection (view source)
by Stormbringer on Tuesday March 29, 2011 @08:27PM
(#2385204)
I've got $10 riding on "they see the word Hacker in 'Hacker News' and start freaking out". :D
Oh, I understand the word hacker in all its culturally and context relevant forms, and you understand the word hacker, but they do not understand the word hacker. :-(
Re:How not to protect against SQL injection (view source)
by mixmax on Tuesday March 29, 2011 @08:35PM
(#2385223)
That's why we have to tell them.
If we, as hackers of the sort that inhabit hacker news, have a post like this on the frontpage and noone cares to actually write them and tell them they have a security problem that may cause them serious damage we don't deserve better.
Re:How not to protect against SQL injection (view source)
by dwwoelfel on Wednesday March 30, 2011 @12:07AM
(#2385752)
Perhaps an anonymous email would have been safer.
Edit: But your email is very amiable and clear, so I think you're probably safe.
Re:How not to protect against SQL injection (view source)
by AndyKelley on Thursday March 31, 2011 @05:14AM
(#2390868)
I think he deftly smoothed that potential problem over with the statement in parenthesis, as well as mentioning how it was posted in reddit.
Re:How not to protect against SQL injection (view source)
by TallGuyShort on Tuesday March 29, 2011 @09:14PM
(#2385345)
You're right, getting sued for pointing this out would be absurd. But where you're wrong, is that just might've happened. There are more ridiculous lawsuits out there. There was a story on here a couple of years ago where a US Government real estate web site was using JavaScript for their authentication, with the password stored in plain text. When it was pointed out to them via email, they responded with allegations of computer fraud and threatened to file charges. Obviously they weren't 100% serious and I'm sure nothing official came of it - but yes, people this stupid are that ridiculous.
Re:How not to protect against SQL injection (view source)
by _b8r0 on Wednesday March 30, 2011 @09:26AM
(#2387045)
The Computer Misuse Act 1990 makes no provision for intent (this is partially provided through the Police and Justice Act 2005 amendments). Instead, the act talks about unauthorised access, which is an undefined term.
In fact, a security consultant was convicted[1] for using ../../ in a URL after he thought a site had been hacked.
Re:How not to protect against SQL injection (view source)
by eustatius on Wednesday March 30, 2011 @07:47AM
(#2386757)
Getting penalized - sometimes heavily - for pointing out someone else's security problems can and does happen:
Here's the mail I sent:
Hi there,
It appears that you have some pretty severe security problems on your site. This is a heads up so you can get it fixed. I would recommend doing so ASAP.
Your site has been posted to hacker news (which is a friendly programming site for start-up people and nerds) as an example of bad security practices. The link is here: http://news.ycombinator.com/item?id=2383857
It has also been posted to Reddit, which might be more of a problem since that site has a lot of 14 year old bored teens hanging around that know just enough about programming to do a lot of damage... Link: http://www.reddit.com/r/programming/comments/gdviz/how_not_t...
It appears that your site is easy to compromise, which might lead to anything from defacement to someone stealing all your content, usernames, passwords, etc.
I have nothing to do with these postings, I just don't like to see innocent sites get in trouble, hence this mail. Feel free to contact me if you need anything or have questions.
Hope you get it fixed before someone breaks it.
Yours,
Max