Governor vows criminal prosecution of reporter who found flaw in state website

Re:Governor vows criminal prosecution of reporter who found ... by jameshart on Thursday October 14, 2021 @05:06PM (#28870115)

Unfortunately, this is the top comment and it has led to a lengthy discussion about the ethics of altering a url to retrieve a resource you should not have access to.

Which is a fascinating discussion, but has nothing to do with the case at hand which is where the underlying html on a publicly accessible search result page contained SSNs of the teachers returned in the search.

All the analogies about ‘it’s like asking the IRS for another document’ are all wonderfully applicable to this comment, but not remotely applicable to the actual article.

[ Parent | on HN ]

Re:Governor vows criminal prosecution of reporter who found ... by woodruffw on Thursday October 14, 2021 @06:01PM (#28870768)

This entire thread is a great microcosm of how difficult it actually is to talk precisely and intelligibly about "hacking", permissions, intended access, etc!

[ Parent | on HN ]

Re:Governor vows criminal prosecution of reporter who found ... by askvictor on Thursday October 14, 2021 @06:47PM (#28871225)

On the other hand, to a non-techie person, where do you draw the line? Accessing the HTML of a public webpage is trivial to you and me. But what about decompiling or extracting strings from an .apk? Almost exactly the same thing as pressing F12 in the browser, but a tad more 'active'. It is relevant to this article, as it asks what hacking is OK, and what isn't

[ Parent | on HN ]

Re:Governor vows criminal prosecution of reporter who found ... by alpaca128 on Thursday October 14, 2021 @07:26PM (#28871595)

I wouldn't call any of your examples hacking, at least not in the "hacking other people's systems" sense. It's accessing information the other party actively sent to users. The fault lies with the one distributing and potentially exposing sensitive information through negligence.

[ Parent | on HN ]

Re:Governor vows criminal prosecution of reporter who found ... by jameshart on Thursday October 14, 2021 @07:38PM (#28871743)

If someone distributed a .apk that contained plaintext SSNs of their employees, I don't think I would call someone who noticed a 'hacker'.

[ Parent | on HN ]

Re:Governor vows criminal prosecution of reporter who found ... by aufhebung on Thursday October 14, 2021 @07:35PM (#28871711)

I would say that finding and reporting exploits is ok in every circumstance. I would draw the line at using those exploits for malicious purposes.

[ Parent | on HN ]

Re:Governor vows criminal prosecution of reporter who found ... by blacksmith_tb on Thursday October 14, 2021 @08:02PM (#28871998)

Yes, it looks like it was built to search educator SSNs[1], so the devs just... put them all in the js. How's that for caching? Ouch.

1: https://web.archive.org/web/20210428154433/https://apps.dese...

[ Parent | on HN ]

Re:Governor vows criminal prosecution of reporter who found ... by michael_michael on Thursday October 14, 2021 @06:10PM (#28870866)

I am now questioning the wisdom of having shared this story, and I apologize for derailing the discussion.

[ Parent | on HN ]

Re:Governor vows criminal prosecution of reporter who found ... by jameshart on Thursday October 14, 2021 @06:20PM (#28870968)

It’s a relevant comment, and people evidently found it interesting.

[ Parent | on HN ]

Re:Governor vows criminal prosecution of reporter who found ... by nyczomg on Thursday October 14, 2021 @08:31PM (#28872260)

Yours is an interesting story. And very relevant. It just isn’t applicable to one interesting aspect of the article being discussed which is that the sensitive data was sent to every user but was “hidden” by html.

But the shoot the messenger aspect of reporting vulnerabilities is also very relevant. It’s just the nature of forums like this that some things bubble up to the top and dominate the discussion. Hard to say it’s your fault for retelling a story.

[ Parent | on HN ]

Re:Governor vows criminal prosecution of reporter who found ... by wslack on Thursday October 14, 2021 @06:36PM (#28871109)

It's a good story and relevant. Not your fault the internet got spun up in a totally other direction with it.

[ Parent | on HN ]

Re:Governor vows criminal prosecution of reporter who found ... by bob_roberts on Friday October 15, 2021 @02:21AM (#28874900)

fwiw, I found it relevant. It's obviously not _exactly_ the same thing, but "sending an HTTP GET request to a URL" is similar to "viewing HTML source" in that both are totally normally things to expect from a user, so it's hard to see how either could count as "hacking".

[ Parent | on HN ]

Re:Governor vows criminal prosecution of reporter who found ... by datavirtue on Thursday October 14, 2021 @06:59PM (#28871350)

URLs are not secrets. End of discussion.

[ Parent | on HN ]

Re:Governor vows criminal prosecution of reporter who found ... by jameshart on Thursday October 14, 2021 @08:07PM (#28872040)

End of a different discussion than the one this news article warrants.

[ Parent | on HN ]