Hacker News Reader

Comment by ck2 | Hacker News Reader

This is a case of some idiot who is responsible for the server having to tell management something so they say "oh this guy hacked it".

Management tells the lawyers and PR which forwards it to the "news" who just go for the most sensationalist story possible.

Hope he wins any lawsuit and more importantly his reputation back somehow.

I'm not even sure what would have been the better course here other than to have CC'ed other people on the email.

ps. No way in heck I am going to click on them but those filenames seem to appear in google cache elsewhere.

View on HN

And that's one of the reasons if you're not a security expert and stumble upon someone's security problems, you do nothing (at least in US).

Not sure why this is downvoted. Reporting a security problem, particularly a significant one, puts you at high risk for unjust prosecution and imprisonment.

Unless lives are at stake due to the security lapse, it's pretty clear to me that the only reasonable response is to go "oh, that's interesting" and then close your browser window and never tell a soul.

What part of "server containing medical data about thousands of patients." indicates to you that lives were not at stake?

edit - the folk saying that this guy was stupid for doing anything are completely irresponsible.

What part of archived medical data would put lives at risk? I mean, it sure as hell puts their privacy at risk, but can you describe what scenario you are imagining that puts lives at risk? Just because it has the word "medical" doesn't mean it's life or death (and this appears not to be).

From my point of view this is what anonymous full disclosure is for.

Naming and shaming typically gets some kind of a response. Keeping quiet does not.

I know not everyone agrees with full disclosure but I assert there is a time and a place, and after a demonstration like this one, IMO this university is one of those places.

Edit: typo

Let's assume that is all true, the "journalist" not contacting the professor before publishing that article seems quite unprofessional.

I mean aren't real journalists meant to check sources and get both sides of a story (or outside of America anyway)?

> aren't real journalists meant to check sources and get both sides of a story

No, they are meant to sell as much ads as possible.

Steady on.

The journalists I know do indeed meet society's expectations for fairness and accuracy, and make calls and pound beats, but there are also a lot more people who project themselves as journalists who are a long way from this ideal. Sadly market pressures mean there are a lot of the latter about.

That's the theory but remember how badly journalism has been mismanaged into a death spiral. This article smells of someone with less experience (i.e. cheaper) being told to churn out a certain number of stories a week, given less support for editing and fact checking than they'd have had a generation ago, and – most importantly – they'd better sound interesting so people click and boost page views and as impressions.

It looks like the source article did not name the professor. I'm unsure how the SCMagazine article author was supposed to contact said professor. Should they have just contact City College for a comment[1]?

[1] the original article said it was an unnamed professor of Computer Science at City College

Reply on news.ycombinator.com