Hacker News Reader

Comment by rwallace | Hacker News Reader

With all due respect, most of the replies here are missing the most important point.

Does the company have a bug bounty policy?

No?

Then keep your mouth shut and get on with your life.

A significant percentage of people in power will react to unsolicited warnings of security vulnerabilities by attacking you as though you were their enemy. Worse, the law is at least not clearly on your side. This is not theoretical: people have come to significant harm in this way. Being a hero is great. Being a martyr? Not so much. You don't want next week's top HN story to be an appeal for donations to the legal defense fund of sah88.

View on HN

The answer is not "sweep the problem under the rug", but rather "tell people who know what theyre doing". The idea of "oh lets just pretend this security hole doesnt exist" makes me cringe.

As JCR wrote: "The safe and sane approach is to contact CERT [3,4] through their vulnerability reporting page [5] and let them contact the vendor."

[4] https://www.cert.org

[5] http://www.kb.cert.org/vuls/html/report-a-vulnerability/

If that idea makes you cringe, you should work to change our politicians because that is how the law is written. Any unauthorized access, even if the initial probe was accidental, is against the law and with the way security break-ins hurt company stock prices these days, you can be damn sure someone will come after you if it gets out, even if you weren't the one to release it.

All-in-all, don't tell people unless you have explicit, written proof of the companies consent to pentest their application because its simply not worth risking your entire life because someone in power's day is ruined by your curiosity.

This cannot be emphasized enough.

Just keep your mouth shut or you will quite likely be sued. The only thing you should do is simply not just trust that particular company with your data anymore.

If the risk to public good is great enough and the bug simply must be revealed then it should be done anonymously and with full disclosure. Contacting the company will only give your address to them.

What would happen if sah88 were to realise the site's name, but not the details, to warn other people to also not trust this company. Is this grounds for defamation or something like that?

Defamation/libel/etc. is only when you claim something false to be a fact.

Depends on the country. In UK truth is no defense for libel.

Also if you are sued for libel in US and prove that they indeed have a security hole that gives them the evidence directly to sue you for 'hacking' their site.

US courts (at a state level) have occasionally ruled similarly, it is a worrying trend.

> The court ruled in the case of Noonan v. Staples that truth published with “actual malice” gleaned from the context of the statement can give rise to a libel lawsuit.

http://itlaw.wikia.com/wiki/Noonan_v._Staples

> In UK truth is no defense for libel.

What?

http://www.senseaboutscience.org/data/files/A_quick_guide_to...

> Justification: a defendant must show that the substance and fact of what they have written is true. However, a judge decides what the words meant, and therefore what a defendant must prove to be true – sometimes not what a defendant expects.

http://en.wikipedia.org/wiki/English_defamation_law

> Allowable defences are justification (i.e. the truth of the statement),

Edit:

http://en.wikipedia.org/wiki/Defamation_Act_2013

> and introducing new statutory defences of truth, honest opinion, and 'publication on a matter of public interest' or privileged publications (including peer reviewed scientific journals),

Is there an anonymous means by which this can be done?

How about passing the information to someone like the EFF and let them inform the owners?

The OP said he used a form for reporting security vulnerabilities on the site. Does he still have to be afraid to get sued in such a case?

I think the CERT would be a better idea.

The EFF exists to influence court cases that are likely to set a precedent.

They are not a general 'help everyone' organization for people who get into technological legal trouble- the closest they come is having a list of law firms they refer uninteresting legal business to.

That's why I wrote "like the EFF". I figured, when you life in a country where you actually can get sued for things like that, there must/should be an organisation or site one can use as a middleman. I wasn't aware of CERT.

I'm still wondering if it has any legal influence in the US when a site provides a form for reporting vulnerabilities.

I agree. If it doesn't impact you, turn around and walk away. If you do want to make a difference, sell the exploit to the chinese. You'll still be arrested and charged for hacking, but at least you'll have made some money and made the exploit visible.

Yeah. People don't like this answer because it's so obviously suboptimal in technical and security terms, but you're absolutely right. There's no upside to disclosure and only downside. If they don't welcome disclosures, beware.

Reply on news.ycombinator.com