Hacker News Reader

Comment by jrockway | Hacker News Reader

> also given him an award

Find a vulnerability for a big tech company, get $10,000. Find a vulnerability for the government, get prosecuted. I wonder why government IT is so far behind the private sector!

View on HN

I think we shoudnt even call it a vulnerability. They send the 'secret' information in the html file, hoping that the browser does not render it (which it doesnt, so 'viewing source' was the way to see the information). I am actually surprised that the dont charge the person who set up that system; it is like broadcasting the confidential information.

They should prosecute the hacker who wrote that dangerous "view source" feature

> Find a vulnerability for the government, get prosecuted.

In fairness the government is, of course, not a monolith. There are multiple federal bug bounty programs out there [0] [1]. This is probably better stated as "find a vulnerability in the systems of a deeply corrupt, gerrymandered, and unpopular state's government's sites and be prosecuted in that state."

[0] https://www.hackerone.com/hack-the-pentagon

[1] https://www.dhs.gov/news/2021/12/14/dhs-announces-hack-dhs-b...

The government is so fragmented and ineffective that even if I did find a pentagon vulnerability, I'd feel like some other department would prosecute me for it.

One of the most unfair cases relating to security testing I've ever read about was that involving Coalfire Labs and the Iowa courthouse: https://www.cyberscoop.com/coalfire-security-pros-arrested-f...

Here's the darknet diaries episode where I first heard about it: https://darknetdiaries.com/transcript/59/

Except that they didn't get prosecuted.

How stressful do you think the last couple of months have been for that reporter?

From the Statement by Josh Renaud about Missouri investigation:

> This decision is a relief. But it does not repair the harm done to me and my family. // My deepest desire is that somehow this situation might be redeemed. And I believe it can be. // My actions were entirely legal and consistent with established journalistic principles.

Depends. Might have been a bit stressful, but this is exactly the kind of "good trouble" a good journalist hopes to be in.

They thought they had just found a mistake in the government's IT system; instead, now that have a story about a mistake in the IT system and an idiot governor who doesn't understand infosec and is too bad a leader to delegate to people who do.

You seem to be reading too much into what I wrote. I simply implied that what parent wrote was incorrect.

Stressful but also good. Much more widely known than had not been subject to this threat. Probably good for future career prospects.

I am not at all convinced that one story where the subject's reaction is out of place makes for a great career boost - though i can see ways how it achieves the opposite.

"Known to cause lots of work for legal department" could, for some bosses, be considered a negative signal in hiring. Moreover, "pisses of people with power": same.

"pisses off people with power" is sort of what it says on the résumé for any journalist worth hiring

> what it says on the résumé for any journalist worth hiring

To a good editor, yes. But I'm not sure the majority of editors are good ones, so while your point isn't exactly false, the GP's is also true (with all the other ones).

Except, to be honest, I know this story (and love to make fun of it), but I couldn't pick the name of the reporter out of a list of names

However i am probably right to assume that you are neither hiring in journalism nor working in that field.

In reverse, you probably know a lot names of startup or IT personalities, that nobody outside our field would ever need to know

well, it was on table for a brief moment... hence the article to communicate it is not happening...

And the place is sufficiently corrupt enough to have the prosecutor walking a tightrope so Parsons doesn't go after his ass too. I found the prosecutors statement very unsettling. He basically said that the reporter conducted criminal action but they are going to let it go because he has been punished enough already. Missouri sounds like a toxic, corrupt hell hole.

I don't wish that limbo to you. Not being prosecuted after such serious threats from big people is no small thing.

Well, I think if the matter reaches the prosecutor's office and it sits there for several months before a determination is made whether to proceed, it's not a stretch for the party involved to prepare as if he will be prosecuted.

What are the details behind «resolved through non-legal means».

The display of corruption has been stellar.

> What are the details behind «resolved through non-legal means».

The prosecutor did what the governor refused to do: Asked someone with a clue, and found out that absolutely no crime took place. Technical / factual means, not legal.

Clearly states need to start issuing equity options to govt employees on their future tax revenue. That and somehow raise property values in the middle of Missouri to $500/sq ft.

You can definitely thank the government for lowering property values!

Reply on news.ycombinator.com