Hacker News Reader

Comment by sgentle | Hacker News Reader

So if I understand correctly, this was found by scanning the Alexa top 1M for exposed .git directories. It's based on research from 2015 where the authors... scanned the Alexa top 1M for exposed .git directories.

Anyone want to hazard a guess at whether anyone else between 2015 and 2018 also thought to run the same experiment with the same parameters and thus also downloaded ebay.co.jp's production database passwords and Wordpress admin credentials?

Of course, that would only be a concern if the master hacker in question decided eBay Japan's backend data was more valuable than having their name on a website that says "good job thanks".

View on HN

It's beyond me why they don't reward such guy even if they don't have any bounty program in place. 10-100K is pennies to them. It just seems more economic to pay white hats than to deal with effects of black hats actions.

But maybe I'm wrong and in the real world there is not much penalty for exposing data of thousands or millions of users..

Before GDPR there actually wasn't much penalty for reckless collection and storage of personal data. Only PR damage had to be considered.

Bear in mind though that Ebay Japan does not target EU/no/ch customers, which is a requirement for the "big reach" of the GDPR.

Wikipedia excerpt: "... for all individuals within the European Union (EU) and the European Economic Area (EEA)."

https://en.wikipedia.org/wiki/General_Data_Protection_Regula...

It is likely though that, if GDPR proves effective, other countries will soon follow suit and implement a similar set of data protection regulations.

Perhaps by then companies around the world will be forced into paying more attention to these matters, and a system of reward for white hats may become the norm.

With GDPR version in each country after some time the best market will be for companies to lawsuit other IT companies over violations..

After some time smaller companies will be forced to work on market siloses, to not jave to worry about such lawsuits.

I've generally read on Hacker News that having EU users is sufficient to put you within the GDPR's reach, and that for a web service there's therefore nothing that will protect you besides IP-blocking Europe.

The quote that you provide here that supposedly shows that the GDPR is irrelevant to Ebay Japan does not in fact contradict that claim.

Do you have an excerpt or other source that does?

Amusingly, if a European citizen is not in Europe, they are also covered, so IP banning Europe will not help you.

The analysis I’ve seen from lawyers is that it only applies to EU citizens inside the EU.

That's not how things work. You don't get to bring your laws with you when you travel.

> I've generally read on Hacker News that having EU users is sufficient to put you within the GDPR's reach, and that for a web service there's therefore nothing that will protect you besides IP-blocking Europe.

This is fairly ridiculous, if you're have no European presence, you're free to ignore the GDPR. The EU has no legal jurisdiction over you, the only recourse would be for the EU to block your site and that's just not going to happen - no one wants to see a Great Firewall of the EU, can you imagine the backlash?

If you have EU TLDs, maybe you could lose those domains?

Or your trademarks become unenforceable in EU?

Imagine the mess if I start usatoday.eu, but « focussed only on the EU market ».

Since .com doesn’t operate in the EU market because of GDPR, am I really infringing in their mark?

A prerequisite for "purchasing" (renting) a .eu TLD is that you're a European Union citizen. Technically, it's against the ToS to rent one to anyone else. If they're not aiming for the market, I think they also can't get .eu domain.

That being said, it sure will be fun when all the British people/corporations won't be able to renew their .eu domains no more!

Unfortunately that’s the truth: https://ec.europa.eu/info/sites/info/files/notice_to_stakeho...

Maybe for .eu, but I don’t believe that’s true for all other EU TLDs (e.g. .co.uk (for another few months anyway...))

> and that for a web service there's therefore nothing that will protect you besides IP-blocking Europe.

Which is bizarre reasoning: geo-IP databases are not foolproof, and thus you will get legitimate EU traffic from EU ISPs regardless. Further, by this reasoning, what's to say an EU customer using a VPN to exit in the US is somehow excluded from GDPR?

If someone tells you “I have no interest in serving you, because I do not wish to follow your rules”, and you disguise yourself as someone else and ask again, how could you possibly expect your rules to be suddenly be followed? It would be absurd. At that point, they would have follow all rules across all countries simultaneously, because who knows what country any given person is really from? Ask and they’ll lie, and you’ll still be on the hook!

At some point the responsibility has to fall on the user instead of the business, and the I think actively skirting the rules is sufficient and a nice, clear line, to fault the user.

The fact that the issue remains unaddressed just tells us the organization (as in, the management chain) is fundamentally broken from a tech point of view.

From there, it is not surprising that they would not bother to compensate white hat hackers, because we have established that the organization is fundamentally broken.

> It's beyond me why they don't reward

Who? They?

And now there's confirmation that their bug bounties come with significant caveats that make payout unlikely even for large vulnerabilities. Any future vulnerabilities are now less likely to be reported.

I've been running the same scan since mid 2017 and it has netted me a substantial amount of bounties. There's 100s of people that run internet wide scans of exposed git. And of course I also report to companies that don't have bounties (anonymously). I actually found a different eBay domain with the same issue and they added me to their security hall of fame.

The main problem is that new developers come and go, so does the exposed gits.

I used to have a collection of downloaded user databases in an encrypted partition in my iPod back when I was in high school.

Some were actually pretty high profile sites (probably top 100 at the time) but I was worried they'd come after me if I reported the vulnerabilities (that was the standard response before bounty programs and such) so I just dumped it and moved on.

I'm sure I'm not the only one that just did it for sport.

Reply on news.ycombinator.com