You’re a curious person and see that the back door to a closed restaurant was left unlocked. You should let them know, but make sure you find out how big of a screw up the closing manager caused so s/he can be dealt with or the process fixed.

You open the door a little and peak inside and see the office door is open. “This can’t be,” you think as you walk into it.

You bet there’s a safe left unlocked and customer reservation left unprotected on the computer, “how irresponsible can these people be…”

If their security is this bad, you wonder what their food safety processes are.

It’s a slippery slope, and maybe well-intentioned, but that doesn’t change the fact that you’re not allowed to wander into this restaurant’s back door or be there when it’s closed, and now that you have, how do you prove you didn’t do anything malicious if the only evidence there is is of you in the restaurant when you’re not supposed to be?

Maybe you can make an appealing public good argument against criminal accusations based on your stellar clean record, but how do you protect yourself from civil suits, which they have every right to spin up if they have damages and can link you to them?

Please don't conflate physical invasion with violation of data privacy. Everyone downloaded a car, 3d printed it, and are now driving around happily in them. This argument is beyond tired.

The laws regarding computer intrusion are stricter than those governing real-world breaking and entering. Trying someone's door isn't a federal crime (though it'll absolutely get you arrested, even though that's the open protocol a doorknob advertises).

Oh, well. I didn't write this law, I just pay attention to how it's used.

Which is exactly the problem - this kind of rule following behaviour for arbitrary and non-sense rules allow for more rules to be implemented without push back.

We as developers and end users have to fight it and not simply argue for the sake of following rules.

It makes zero sense to prevent people from viewing source code of a page when that is how the entire tool chain was built to be used.

They should have made their own native app that couldn't be reverse engineered if they had any mind for real engineering rather than blame 'the web'.

You can be as pissed about it as you like, and I don't have a problem with that. Where I start having a problem is when people say things like "poking around to see what kind of data is exposed by a bug is reasonable testing and not illegal". You wanting something to be legal doesn't make it legal!

Point of order - upstream what is being discussed is 'whitehat' behaviors and tendencies, and whether a behavior is reasonable. This got transmuted to a question of legality by some one downstream, and is in my opinion a good shout but wasn't really a rebuttal to any of the points raised. It seemed like there was some talking past each other going on and I think that is the core of it.

I think I keyed off of "I agree with a parent comment in that someone dropped the ball here and threw him under the bus to protect reputations and prevent any nastiness between the two companies."

>...and is in my opinion a good shout but wasn't really a rebuttal to any of the points raised.

True, but it was not somehow 'out of order' because it was not a rebuttal of the 'whitehat' claims. Given that the article is not primarily about how the author discovered the vulnerability, but the legal problems that ensued, it was not at all unreasonable to point out that acting in accordance with 'whitehat' behaviors and intent is not enough to shield oneself from legal scrutiny. Furthermore, the ensuing discussion, in which various attempts were made to deny this distinction, shows that the point needed to be made!

Objection sustained!

> poking around to see what kind of data is exposed by a bug is reasonable testing and not illegal

Poking around to see what kind of data is exposed by a bug is reasonable.

I’d stop there, and I’d suggest people do that, because it makes for a better society for all of us, regardless of the law. What’s that called? Civil disobedience?

Why bother stopping there? You'll already have committed a felony. Go as far as you want from there! It's civil disobedience, after all!

Real issues arrive when people use "illegal" and "immoral" as if they were interchangeable.