I think you have good intentions so I don't intend to attack you personally. just wanted to suggest that an individual being arrested for doing the right thing probably decreases the likelihood of them doing the right thing in future. so perhaps discretion is a good idea when doing the right thing, to increase chances of the right thing being done long term. there doesn't seem to exist a logical reason that corporations would avoid using the letter of the law to defend themselves, regardless as to how right that defense may be?

Deterrance not only works at the individual level, anyone reading these news reports about an innocent person being wrongly prosecuted for doing the right thing, is being trained to not do the right thing next time and just do nothing instead (because that's safer)

well I read those reports and came up with my comment above instead of running away so I'm not sure I can trust a conclusion based on your 'anyone' premise when the premise doesn't apply to me personally

anyone !== everyone

i assure u that nothing special has been accomplished by my body, most definitely i am an anybody and not a somebody. the purpose of a system is what it does, we dont have anything to disagree with outside of cheeky nit picks , so i guess this is good bye !

Can confirm, not arrested but threatened with litigation/employer contacted for responsible disclosure of unsanitized user input allowing arbitrary access to protected data of presumably any user. Just a url query param value flipped from true to false. Incrementing int user id too, so enumeration is trivial and the response payload was json so no need to do anything.

It is amazing what a casual observer with a background in web dev will see if they just open devtools. It has instilled a deep aversion in me to give any service any of my data that I care about protecting.

There should be an anonymous org way to report these without putting yourself in personal jeopardy, some kind of "innocent observer" protections built in...

If your system has gaps im not at fault for discovering them sort of deal

Unfortunately the anonymous org will then get abused by bad actors because of its anonymousness which leaves us where we are today

Long, long ago we had anonymous remailers.

It was a different time. Today, I don't think I'd trust an intermediary set up to - essentially - pass along 0-days not to sleep on the juicy ones.

wasn't that the origin of crypto and bitcoin too, or similar communities at least.

I think that's where I've read from about remailers in the past as in the same people who mined bitcoin early was into these

I dont see why we should do unpaid work for megacorps. If I found a vuln, I would seriously consider releasing it on the darknet if I could even figure out how to use it. Not even try to sell it, just give it to them. I have no sympathy for the shareholders, or the corporate drones that work there. Who actually feels the damage?

Unfortunately, the damage is usually felt by the individuals whose data is compromised.

they aren't being made whole by receiving "free credit monitoring" or a check for $12.83 18 months later either. maybe increasing the damages paid by the corporation is needed?

I can't edit, so as a general response: ya'll are a cynical lot, akin to parents who won't let their child walk to school because of the 0.0001% chance they'll be kidnapped. Y'all making the whole world all the worse for your cynicism. Sure, there's a remote chance you get in trouble for it. But there's also a chance you get hit by a car tomorrow morning. Yet you got out bed anyway.

Be the fucking change. At the very least, don't discourage others. Good grief.

I think that's a very privileged take. For most people, getting arrested and having the government try to press fraud and abuse charges is a life altering event, so it's natural that people would be more reticent.

If doing the right thing were easy, it wouldn't be what gives you character.

I agree: having charges brought against you is a life-changing event. FWIW neither Chan Tsz-yan nor Josh Renaud were arrested, and in both cases the charges were dropped. https://pressfreedomtracker.us/all-incidents/missouri-govern... https://missouriindependent.com/2022/02/11/prosecutor-isnt-p...

The system sucks, and will always suck.

If you think these two cases out of umpteen billion CVE/security incident reports are odds enough to hide your face and turn away because the risk is too much... I apologize for being crass, but frankly you're being a little bitch.

If these odds aren't good enough for you to live up to your values, what are?

you didn't have the guts to write me a response or to really acknowledge what the guy you're responding to here said. the things you say could be genuinely true , I'm not gonna absorb any of it since you're out here calling me a bitch while behaving like one yourself. was your goal to wave the finger or to inspire change in others? coz only one of those things happened today. by this point if you're an average human you'll have switched your brain off - on the off chance you're different, it's time to listen to the pot by tool

> you didn't have the guts to write me a response

I did? Which is why you're here?

> or to really acknowledge what the guy you're responding to here said

I did? "If these odds aren't good enough for you to live up to your values, what are?" is a genuine question. Note that you didn't answer the question.

And everything said before _was_ a response to privilege, but to be more explicit: if you have the _privilege_ of discovering a vuln and the technical knowhow of recognizing its magnitude and potential effect on others, is it not YOU that are using your privilege for ill? "The indifference of good men...", etc, etc.

Listen. We're all cowards and bitches, me included. We all have faults, we all take the easy path, we all could do better. Me especially. I have a history that I'm not proud of, and my character is as flawed as anyone's. I apologize again for using crass language, perhaps if you're willing to extend some charity, substitute whatever language you feel like would be more appropriate. Unfortunately if I come up with other words they'd _still_ read as negative, so I'll refrain.

when you provide the respect of directly addressing me + the concerns I voice , I'm happy to read your points and acknowledge them in return. I'm here for a discussion, those things aren't directly connected to us personally if we don't want them to be. you seem to have targeted a widespread personal connection via emotive language, I understand the technique, it's just you kinda chose the emotion of insult, which tends to be reflected like other emotions. I'm not sure how to prove your final point wrong, aside from referring back to where I previously said you're probably right ... it's just the expression does not convey your point well. no offence I don't even want to address your counter arguments, they're ethereal at best, "you didn't answer my question that was posed in a rhetorical manner" and pretending an indirect response has the same impact as a direct one. trying to sway others emotively takes a really strong argumentative base. to be very clear I fully agree with the idea you're trying to convey.

> just wanted to suggest that an individual being arrested for doing the right thing probably decreases the likelihood of them doing the right thing in future.

Agree. Again, the system sucks, and will always suck.

> so perhaps discretion is a good idea when doing the right thing, to increase chances of the right thing being done long term.

Agree. I lean utilitarian philosophically. If we lived in a society akin to Russia where Doing The Right Thing would get you thrown out of a window, then I would not be telling people to do so.

> there doesn't seem to exist a logical reason that corporations would avoid using the letter of the law to defend themselves, regardless as to how right that defense may be?

I admit I'm having trouble parsing this. But if you're saying corps use lawfare to get away with as much as they can: I agree.

I'm not saying that you should Always Do The Right Thing At The Cost of Everything. I'm only saying yall are indexing very, very hard on 2 edge cases that were dropped and led to no arrests or jailtime. My anecdote/advice does NOT apply to those living in authoritarian regimes where the tallest nail gets hammered down. (You could argue that Hong Kong is such an authoritarian regime; I won't disagree.)

Let me phrase it this way: if you're too risk-averse to report when you see security issues because you fear charges, then you should also always stay within the speed limit, come to a complete stop at stop signs, never jaywalk, loiter or consume alcohol in public. Heck while we're at it you should also stop driving; the risk of death is much higher than that of being arrested for reporting a security issue. We all have different risk tolerances, but I think the numbers here are in my favor.

perhaps it may bear fruit being mindful that some of the online audience do spectate from such regimes. citizens reporting flaws in public infrastructure is the objectively correct decision a majority of the time. concurrently, many individuals acting in both public and private interests regarding security, vastly more than surmisable as edge cases, have been prosecuted for acts that any sane individual would deem not irrational. I don't think it's fair, comparing a jaywalking fine to a criminal charge for entering a URL (but one example given here).

> perhaps it may bear fruit being mindful that some of the online audience do spectate from such regimes

Sure, I could caveat my arguments down to nothing (unless you live in a authoriatrian government, unless you're an investigative journalist whose livelihood and sources would be threatened by your arrest, unless you're 9months pregant and cannot in good conscience undergo even imagined stress, etc. etc.) Or I could simply say "Do the Right Thing", give the base rate, and let you handle the nuances for your situation.

Sure, jaywalking is not a crime in some areas. Engage with the steelman of my argument dude, don't just find the weakest example out of ~5 and go after it.