Hacker News Reader

I'm sure that will change sooner rather than later, otherwise enterprising hackers will be able to claim that the model they were using went rogue.

View on HN

This would be bad; we've already had a few cases on HN where someone noticed that they could increment the customer number in a URL or similar, resulting in police action.

Got a source for that?

Not from the US but https://www.cbc.ca/news/canada/nova-scotia/freedom-of-inform...

This news segment goes into more detail about how he downloaded the documents (by incrementing the document id in the url) https://x.com/Brett_CBC/status/984751373525901313

Wow, just wow. How about charging the website builders for negligence, for failing to protect sensitive data? Simply incredible.

IDOR is a well known security issue that can result in exactly the scenario described (someone incrementing a counter in a url) and has on many occasions in different jurisdictions caused legal issues for the person doing it. Unless you are specifically asking for a hn reference, which I don't understand the relevance but I'm sure they exist.

Reply on news.ycombinator.com