←back to thread

577 points galnagli | 3 comments | | HN request time: 0.45s | source
Show context
awesome_dude ◴[] No.45675356[source]
Rule 1.

NEVER trust user supplied data.

Once that rule was broken, any other rules broken became clear to everyone

replies(3): >>45676139 #>>45676989 #>>45681943 #
jacquesm ◴[] No.45676139[source]
You'd think that client side security would be something that we'd gotten over by now.
replies(2): >>45677562 #>>45683834 #
rpcope1 ◴[] No.45677562[source]
You'd think but I keep meeting even "experienced" technical leadership that have been at this for a while that there's no way to get around validation and security that's implemented in client code.
replies(1): >>45677748 #
cheschire ◴[] No.45677748[source]
I’ve used browser dev tools to regularly add additional drop down options to menus that weren’t present. Huel, for example, only offered 2 or 4 week subscriptions, so I added 3 weeks to it because that’s the frequency I needed, and it worked no problem. 3 weeks later my shakes arrived and every 3 weeks since.
replies(7): >>45677777 #>>45677902 #>>45678651 #>>45678780 #>>45679165 #>>45680139 #>>45681137 #
mulmen ◴[] No.45677902[source]
Did you try adjusting price?
replies(3): >>45679214 #>>45680517 #>>45681477 #
achairapart ◴[] No.45679214[source]
A kid in Hungary was arrested for exactly this (and it was a cheap bus ticket): https://www.bitdefender.com/en-us/blog/hotforsecurity/budape...
replies(1): >>45679458 #
umanwizard ◴[] No.45679458[source]
It doesn’t seem crazy to me that someone should be arrested for that! It’s stealing. If someone came in my house and stole my property I’d expect them to be arrested, even if I had stupidly left the door wide open.
replies(4): >>45679731 #>>45679762 #>>45680020 #>>45680373 #
jacquesm ◴[] No.45679762[source]
Why are you on HN?

A kid showed up a bunch of big names. That's the equivalent of a kid walking into a bank and somehow making it into the vault, alerting security to the fact that it's possible without actually making off with all of the gold. That's on the bank, not on the kid. Nobody came into your house or stole your property. If they had the police likely wouldn't show up, nor would the case make the newspaper even if - hah, as if that happens - they made an arrest.

The only reason you are hearing about this is because someone at 'bigcorp' didn't want to accept responsibility for their fuckups, and so they used the law to come down on some kid which effectively did them a service, which costs society a large pile of money, further externalizing the cost of their fuckup.

replies(2): >>45679984 #>>45680235 #
motorest ◴[] No.45679984[source]
> A kid showed up a bunch of big names.

The kid purposely changed the price of a service to lower it to an insignificant fraction (reportedly from ~27£ to ~0.15£).

If that same kid went around a supermarket replacing price tags to lower the selling price, would you call it "showing up a bunch of big names"?

Say what you may about how broken and buggy the system was. Purposely misusing it for financial advantage is still a no-no.

replies(4): >>45680011 #>>45680026 #>>45680065 #>>45681932 #
achairapart ◴[] No.45680065[source]
Come on, a kid was just fooling around with the developer console and probably had a curiosity just like the comment above:

> Did you try adjusting price?

And he was punished for "hacking", not for stealing, and for indirectly putting to shame who was responsible for the epic fail.

replies(1): >>45680333 #
1. motorest ◴[] No.45680333[source]
> Come on, a kid was just fooling around with the developer console and probably had a curiosity just like the comment above

You're failing to address the point. It is also trivial to switch price tags in supermarkets. If a kid rips off the tag of an expensive product, tacks on another price tag for pennies, and proceeds to pay the reported price at the checkout counter, is this something deemed acceptable or even classified as vulnerability research?

Make no mistake: the system was a shit show and all companies involved pulled some "sociopath mid-level manager saving his ass" moves. But the issue is nuanced.

replies(2): >>45680727 #>>45681244 #
2. achairapart ◴[] No.45680727[source]
There was no personal profit. He bought a ticket he never used, just to show to people on twitter how bad the system was. He could have silently taken advantage of his discovery and travel at no cost for a long time peraphs. But no.

Sounds more like vulnerability reasearch than crime to me.

3. sgarland ◴[] No.45681244[source]
IANAL, and furthermore have no idea what Hungary’s legal system is like, but mens rea is a thing. If I break a window by using it as a target for practicing my golf swing (I don’t golf; I have no idea if this is something golfers do) I am culpable. If I break a window because I’m trying to land balls next to the window, I might be culpable. Again, IANAL, so if anyone wants to correct my analogy, please do.