Hacker News Reader

Comment by xux | Hacker News Reader

In December I found a glitch in my university's directory that let me have access to personal info of over 60,000 professors, students, and staff.

I was thinking of writing an email to the IT, but fuck that. I'm not paying for someone else's mistake.

View on HN

You could send a postcard through regular mail to the head of IT's house, I think that would get the point across haha. They might be able to find you by checking access logs after the fact though, I don't think there is any riskless way to disclose.

Send an anonymous email or other notification to them? I agree it's scary to be penalized for "hacking" the system (in their eyes), but I also think these things can't be left alone. It'd be cool if you found a way to let them know.

What's an anonymous email? Even Tor is subject to tracking if the endpoint IPs are monitored [1].

The issue of anonymous disclosure is a real issue if you don't

Why do you think Wikileaks was such a big/new deal?

[1] http://www.forbes.com/sites/runasandvik/2013/12/18/harvard-s...

Lol, you've never opened a gmail account using fake data and sent from there? Yahoo? Hotmail?

The FBI will help your sys admin investigate a bomb threat, obviously. Reporting a security hole will unlikely draw their interest. Yes, just using a fake gmail account is tracable without more protections (like correctly accessing Tor). Again, I doubt the FBI is going to investigate.

But hey, I'm all for paranoia and extra caution.

Plus, rtfa you linked. It says clearly in the first few paragraphs that Tor did NOT fail this guy, but that he's an idiot in how he accessed it.

Lastly, as mentioned, send an anonymous letter. It's not hard, kids!

If what you're reporting is significant enough to threaten the livelihood or reputation of people important enough, they can and will find a way to trace you via your fingerprints/IPs … or do you think Google won't simply roll over on you when they get a subpoena/warrant?

I already gave you the answer. Send an anonymous letter. Done.

Or, similarly, drop a physical, paper note off under their door explaining the problem.

Then you have to worry that they might track you down. How will you send an anonymous email? The library will have cameras, so might the coffee shop. The fake email you setup might store information about your location as well. You can never be too careful. It might be better to send a regular old mail.

Reply on news.ycombinator.com