News for hackers. Stuff that matters.

A comment on Governor vows criminal prosecution of reporter who found flaw in state website. Parent comment

Re:Governor vows criminal prosecution of reporter who found ... by rpdillon on Thursday October 14, 2021 @03:37PM (#28868949)
Not sure I see how. More like the records office decided that, rather than staffing the front desk to handle records requests, they instead just dumped an unlocked filing cabinet into an alcove off the hallway with an arrow pointing to it labelled "Health Care Plans". Essentially identical to blaming users for finding an unsecured S3 bucket or MongoDB instance: it's on the operator to secure the data.
[ Parent | on HN ]
Re:Governor vows criminal prosecution of reporter who found ... by kelnos on Thursday October 14, 2021 @04:10PM (#28869363)
> Essentially identical to blaming users for finding an unsecured S3 bucket or MongoDB instance

I agree that it's unreasonable to blame users for finding things like that. But if those same users are downloading all the data and making use of it for their own purposes, that's not ok. Finding a vulnerability and reporting it is an admirable thing to do; exploiting that vulnerability yourself is not.

[ Parent | on HN ]
Re:Governor vows criminal prosecution of reporter who found ... by bee_rider on Thursday October 14, 2021 @04:26PM (#28869567)
It is more like the records office decide that, but didn't tell the people who they were holding records for that they didn't feel like staffing the desk. The records office is of course 99% to blame for their incompetence here, but it is still a bummer for the people who trusted them, and better not to look.
[ Parent | on HN ]