Re:Governor vows criminal prosecution of reporter who found ...
by gffrd on Thursday October 14, 2021 @03:18PM
(#28868728)
> you contunue to use it for your own personal ends
I think this is what people may have been missing from your original post: at some point things can go from innocent to malicious.
"Crime of convenience" is the most common type, after all.
"I'm not the type to steal, but the cash was left on the counter, and …"
Re:Governor vows criminal prosecution of reporter who found ...
by dymax78 on Thursday October 14, 2021 @03:46PM
(#28869039)
> ... and you shouldn't expect a warm welcome from the security team.
The appropriate response from the security team (after verification) is to pull the site down or immediately patch the vulnerability, if possible. Making an outbound call to a third-party is pointless and irresponsible.
All i'm saying is if you find an exploit, and after you verify it works, you contunue to use it for your own personal ends, you're no longer benign and you shouldn't expect a warm welcome from the security team.
The line is when you start to use exploits on computers not owned by yourself for your own ends instead of for the purpose of verifying and reporting the vuln. Sure you could cross that line a little bit or a lot, but you're not innocent if you're over it.