Hacker News Reader

Comment by bsuvc | Hacker News Reader

> … and have a lawyer working on all this drama.

> But I mostly kept this story to myself and felt it was time to share, even if anonymously.

I’m sure your lawyer would beg to differ that it is “time to share” if you still have a criminal and/or civil case pending.

I’m not sure why you’re publicizing what you have been accused of and providing the level of detail you have provided.

And is a Wordpress-hosted blog truly anonymous?

Anyway, I guess you are here for questions, so here is one: Do you feel like you made an ethical mistake attempting to find security holes in the competitor, or do you think your former employer overreacted and was wrong to fire you?

View on HN

> And is a Wordpress-hosted blog truly anonymous?

Would not be surprised if someone figured out how to register a free Wordpress account to the point where any disclosed information is a dead-end trail to any corporate investigators. Takes a dedicated discipline and tradecraft.

If I was in the shoes of OP I certainly would not be discussing anything related to my case until either its conclusion or with all publications reviewed by lawyers.

Then again I have not been in this situation but have seen how things can go south when certain advice is ignored.

I mean, it’s par for the course with someone who thinks it’s just a no-big-deal, “personal interest,” to MITM a bank’s mobile app in order to start poking around in their production servers, without prior consent from the bank.

If this description gets submitted as evidence, the case will be dismissed. The way it is described is 100% legit pen testing with public data and endpoints and no malicious use of vulnerabilities found. If this is actually what happened the case will get thrown out.

Is it ethically wrong to check a public product to see if it follows basic security protocols? Especially if you’re an expert having created those security controls previously? Obviously not.

Is it ethically wrong to ask your employer before submitting findings to a competitor? Maybe? But only because you have an obligation to disclose regardless of what your employer says, but a judge isn’t going to be mad about following chain of command. It probably helped the bug report get p0 attention from the security team.

The fact of the matter is if the vulnerabilities were real and it sounds like they were, it’s fantastic news that the vulnerable company was able to fix them before the errors were exploited widely.

> The way it is described is 100% legit pen testing with public data and endpoints and no malicious use of vulnerabilities found.

"legit pen testing" requires consent from the owners of the system being tested.

I’m sure the lawyers could figure out how to argue that the MITM attack this person did is some kind of illegal identity fraud.

Reply on news.ycombinator.com