Hacker News Reader

Comment by jameshart | Hacker News Reader

Unfortunately, this is the top comment and it has led to a lengthy discussion about the ethics of altering a url to retrieve a resource you should not have access to.

Which is a fascinating discussion, but has nothing to do with the case at hand which is where the underlying html on a publicly accessible search result page contained SSNs of the teachers returned in the search.

All the analogies about ‘it’s like asking the IRS for another document’ are all wonderfully applicable to this comment, but not remotely applicable to the actual article.

View on HN

This entire thread is a great microcosm of how difficult it actually is to talk precisely and intelligibly about "hacking", permissions, intended access, etc!

On the other hand, to a non-techie person, where do you draw the line? Accessing the HTML of a public webpage is trivial to you and me. But what about decompiling or extracting strings from an .apk? Almost exactly the same thing as pressing F12 in the browser, but a tad more 'active'. It is relevant to this article, as it asks what hacking is OK, and what isn't

I wouldn't call any of your examples hacking, at least not in the "hacking other people's systems" sense. It's accessing information the other party actively sent to users. The fault lies with the one distributing and potentially exposing sensitive information through negligence.

I would say that finding and reporting exploits is ok in every circumstance. I would draw the line at using those exploits for malicious purposes.

If someone distributed a .apk that contained plaintext SSNs of their employees, I don't think I would call someone who noticed a 'hacker'.

Yes, it looks like it was built to search educator SSNs[1], so the devs just... put them all in the js. How's that for caching? Ouch.

1: https://web.archive.org/web/20210428154433/https://apps.dese...

I am now questioning the wisdom of having shared this story, and I apologize for derailing the discussion.

It’s a relevant comment, and people evidently found it interesting.

It's a good story and relevant. Not your fault the internet got spun up in a totally other direction with it.

Yours is an interesting story. And very relevant. It just isn’t applicable to one interesting aspect of the article being discussed which is that the sensitive data was sent to every user but was “hidden” by html.

But the shoot the messenger aspect of reporting vulnerabilities is also very relevant. It’s just the nature of forums like this that some things bubble up to the top and dominate the discussion. Hard to say it’s your fault for retelling a story.

fwiw, I found it relevant. It's obviously not _exactly_ the same thing, but "sending an HTTP GET request to a URL" is similar to "viewing HTML source" in that both are totally normally things to expect from a user, so it's hard to see how either could count as "hacking".

URLs are not secrets. End of discussion.

End of a different discussion than the one this news article warrants.

Reply on news.ycombinator.com