News for hackers. Stuff that matters.

A comment on How I hijacked the top-level domain of a sovereign state. Parent comment

Re:How I hijacked the top-level domain of a sovereign state by toshk on Friday January 15, 2021 @10:01AM (#25791697)
I work for a few a cities in Europe, and happen to know one of the cities had a site with an sql injection issue. An external person found and let the city know but didn't want to reveal the specifics before getting money. The city has no bounty program and for some people in the City it came across as if the guy was distorting them. The guy probably felt like he didn't get money for his work. Probably both have a point. In the end it got resolved.
[ Parent | on HN ]
Re:How I hijacked the top-level domain of a sovereign state by lovasoa on Friday January 15, 2021 @10:10AM (#25791805)
The guy has no reason to expect a reward if the city has no bug bounty program. They could just sue him.
[ Parent | on HN ]
Re:How I hijacked the top-level domain of a sovereign state by LegitShady on Friday January 15, 2021 @10:40AM (#25792109)
What are their damages? He's not required to disclose their security vulnerabilities to them. It's his work not theirs.
[ Parent | on HN ]
Re:How I hijacked the top-level domain of a sovereign state by high_density on Friday January 15, 2021 @11:21AM (#25792547)
I think lovasoa is pointing out what could happen in real-life, not 'what should happen morally/ethically/etc'.
[ Parent | on HN ]
Re:How I hijacked the top-level domain of a sovereign state by murphy1312 on Friday January 15, 2021 @11:07AM (#25792409)
if he was smart, then he said nothing that sounds like blackmail. but you could say, for example, that I have to settle the expense of reproducing it and writing it down properly or something similar.
[ Parent | on HN ]
Re:How I hijacked the top-level domain of a sovereign state by Chris2048 on Friday January 15, 2021 @12:42PM (#25793609)
sue him for what? Discovering an exploit without disclosing the details?
[ Parent | on HN ]
Re:How I hijacked the top-level domain of a sovereign state by lovasoa on Friday January 15, 2021 @03:40PM (#25796116)
It depends on the country, but in France for instance, there is a maximum sentence of one year in prison and a 15000€ fine just for "fraudulently accessing a data processing system", or trying to do so even if you don't succeed.
[ Parent | on HN ]
Re:How I hijacked the top-level domain of a sovereign state by Chris2048 on Friday January 15, 2021 @05:55PM (#25797652)
And they'll prove that without knowing what the exploit is?
[ Parent | on HN ]
Re:How I hijacked the top-level domain of a sovereign state by jessaustin on Friday January 15, 2021 @02:07PM (#25794850) 

  s/distort/extort/
[ Parent | on HN ]
Re:How I hijacked the top-level domain of a sovereign state by toshk on Friday January 15, 2021 @02:22PM (#25795056)
Yes right. Apologies.
[ Parent | on HN ]