Hacker News Reader

Comment by TekMol | Hacker News Reader

So the author transferred tons of private data of eBay users to his computer? This seems like a significant crime.

Why didn't eBay alert the FBI or something?

He downloaded the source code, not the database, so no user data. Still questionable to some degree, one could demonstrate the problem without a full download

Why do you think he "only" downloaded the source ? He wrote:

    I got 1.2 GB of data to go through. The data-set
    contained:

    Wordpress configuration files (yes, they use Wordpress)
    including hashed user credentials for the backend login
    
    Database passwords for production databases

    Log files

    A lot of PHP source code
    (who could have guessed?!)

    much more …

They publicly hosted their .git folder on their web server (which it says in the blog post). They had those things committed to version control (stupid) and publicly served it (stupid). Nothing was stolen.

If something is available via HTTP that you didn't want, how is it different than downloading HTML that you did? The protocol knows nothing about your intent.

Because that's not user data? That's code...

> Database passwords for production databases

You can use those to obtain user data.

> Log files

Easily could contain user data.

Because the FBI doesn't operate in Japan?

Also the git repo was publicly available, he didn't "hack" anything.

Reply on news.ycombinator.com