Hacker News Reader

Comment by esskay | Hacker News Reader

Indeed, especially when Googling "Mercedes report security issue" the page litterally populates the results with the address to email so it wasn't like it's hard to find.

View on HN

It’s pretty dangerous according to German law to disclose security issues.

From earlier this month: German Court Fines Security Researcher for Reporting a Company's Data Vulnerabilities https://news.ycombinator.com/item?id=39098969

This is why I need the CCC in my life

But they have no big influence, they just play the courtjester to a forever demented king.

Thou it would be worse without a jester

And it is in this sense kind of a smart move if you do not want to pay for a lawyer and there is no bug bounty program with T&Cs: journalists can protect their sources. However, you then somehow need to make sure that they waive potential hacking charges. Funnily in the quoted case one of the reasons for the fines was damages related to involving the press.

> journalists can protect their sources.

But in this case not. He must have been pretty worried about German lawyers and courts, which decided really strange lately.

Wouldn't it be even more dangerous to report them to a journalist?

Assuming anyone is reading that email account

Lawyers will.

Then having journalists in the conversation helps, as they can produce bad press if the lawyers play games.

> Indeed, especially when Googling "Mercedes report security issue" the page litterally populates the results with the address to email so it wasn't like it's hard to find.

Reporting via a third party isn't super unusual if you think that a organisation may be a bit legal threat happy from your report.

This may be true if there isn't a vulnerability disclosure program in place but there was, thus your point is completely invalid.

No, his point remains: companies may act in bad faith, and publicly committing to act in good faith is absolutely no evidence they will not.

I don’t mean to be trite, but publishing a bug bounty program doesn’t mean you’re the good guys.

> publishing a bug bounty program doesn’t mean you’re the good guys

this is meaningless rabble. Yes you can get burned in all kinds of legitimate situations [1], but 99.xx% of bug bounty interactions do not result in any kind of legal action even if you wander a bit out of scope

[1]: https://eu.desmoinesregister.com/story/news/crime-and-courts...

> this is meaningless rabble

That is rich coming from yourself. Are you at all familiar with German law?

It’s less than a 1% chance of financial ruin!m? Sign me up!

I hope you also avoid using any kind of modern transportation, like cars, since there's a non-zero chance of dying in a crash

I would probably avoid transportation that kills 1% of its users each trip.

Username checks out. Guess you're going for 100%?

Reply on news.ycombinator.com