Hacker News Reader

Comment by h2odragon | Hacker News Reader

Even for things like this, of broader interest and some controversy, the news articles often are just abridged versions of a press release, anyway.

Might was well get the full sack of horse shit from the original source, than half a sack from a secondary.

View on HN

A news source will at least try to get the other side of things.

In a criminal case like this, the other side is unlikely to say anything very specific in their own defense, to avoid jeopardizing their case in court. So the press release is most of what a news outlet will have to go on.

It’s an indictment so it’s really the only (palatable) side available right now. The person indicted is unlikely to give a statement because anything they say could harm their defense. Their attorneys certainly will not speak in any substantive way. That leaves media outlets with options like ‘contact their grandma’ to try to get a statement.

Some journalists will try stuff like that, but that’s arguably worse than a press release.

This case has implications across the board for CISOs that have to deal with incidents like this. I believe this case also dealt with a payout for a "bug bounty".

It did.

If you're interested, the congress hearing is here. That hearing is still the primary source for this story. It's worth some time - some journalists have tried to cover this but mostly just cherrypicked quotes. The entire hearing is better than any of the coverage.

https://www.commerce.senate.gov/2018/2/data-security-and-bug...

You can watch the hearing on that page (it's more interesting to watch than to read) or find links to the various witnesses and their testimony. For example, if you want to read John Flynn's testimony, it is available here (.pdf):

John Flynn - CISO @ Uber - https://www.commerce.senate.gov/services/files/7D70E53E-73E9...

At this point, the only real lesson for CISO's seems to be 'report'.

Reply on news.ycombinator.com