Comment by mixmax | Hacker News Reader

Comment by mixmax | Hacker News Reader

Parent Full thread

No offense, but I think you're a tad paranoid. If I was a mechanic and I saw someone at a gasstation driving a car that was obviously dangerous because of some kind of bad fixup I would tell him. This is no different, and I don't expect anyone to sue me for that.

Here's the mail I sent:

Hi there,

It appears that you have some pretty severe security problems on your site. This is a heads up so you can get it fixed. I would recommend doing so ASAP.

Your site has been posted to hacker news (which is a friendly programming site for start-up people and nerds) as an example of bad security practices. The link is here: http://news.ycombinator.com/item?id=2383857

It has also been posted to Reddit, which might be more of a problem since that site has a lot of 14 year old bored teens hanging around that know just enough about programming to do a lot of damage... Link: http://www.reddit.com/r/programming/comments/gdviz/how_not_t...

It appears that your site is easy to compromise, which might lead to anything from defacement to someone stealing all your content, usernames, passwords, etc.

I have nothing to do with these postings, I just don't like to see innocent sites get in trouble, hence this mail. Feel free to contact me if you need anything or have questions.

Hope you get it fixed before someone breaks it.

Yours,

Max

I wouldn't say they were paranoid. A few months back I showed a colleague what looked like the openings of a very serious data leak in a major company's site. He investigated further and then reported it up through the chain of command and then over to the company. At no point did he do anything other than what was done here, as in point out a publicly visible security flaw. He was nearly fired after the company threatened to sue. The company only relented when he agreed to keep quiet and his employers disciplined him. The employers didn't back him up. All this for solely reporting a flaw, absolutely zero use of said flaw.

I lost a lot of my faith in humanity that day.

I would go find a new employer if that was the case, what bunch of idiots.

Is that the typical response to bug reports, or an exception to the rule?

I've got $10 riding on "they see the word Hacker in 'Hacker News' and start freaking out". :D

Oh, I understand the word hacker in all its culturally and context relevant forms, and you understand the word hacker, but they do not understand the word hacker. :-(

That's why we have to tell them.

If we, as hackers of the sort that inhabit hacker news, have a post like this on the frontpage and noone cares to actually write them and tell them they have a security problem that may cause them serious damage we don't deserve better.

Perhaps an anonymous email would have been safer.

Edit: But your email is very amiable and clear, so I think you're probably safe.

I think he deftly smoothed that potential problem over with the statement in parenthesis, as well as mentioning how it was posted in reddit.

You're right, getting sued for pointing this out would be absurd. But where you're wrong, is that just might've happened. There are more ridiculous lawsuits out there. There was a story on here a couple of years ago where a US Government real estate web site was using JavaScript for their authentication, with the password stored in plain text. When it was pointed out to them via email, they responded with allegations of computer fraud and threatened to file charges. Obviously they weren't 100% serious and I'm sure nothing official came of it - but yes, people this stupid are that ridiculous.

The Computer Misuse Act 1990 makes no provision for intent (this is partially provided through the Police and Justice Act 2005 amendments). Instead, the act talks about unauthorised access, which is an undefined term.

In fact, a security consultant was convicted[1] for using ../../ in a URL after he thought a site had been hacked.

[1] - http://www.out-law.com/page-6207

Getting penalized - sometimes heavily - for pointing out someone else's security problems can and does happen:

http://thedailywtf.com/Comments/Hack-School.aspx

I sent a email when i saw it too.

Actually got a thank you email back yesterday, them seemed pleased :-) See what they did there america? You don't have to sue everyone.

Reply on news.ycombinator.com