I noticed I could see a family member's blood test results when clicking their forwarded email when I was logged into _my_ account. Sent an email. No response, but IIRC they fixed it a few weeks later.

Just an anecdote to counterbalance the apathy the OP might instill in people. Do good, regardless of the system.

▲

AlexErrant a day ago | parent | next [-]

I can't edit, so as a general response: ya'll are a cynical lot, akin to parents who won't let their child walk to school because of the 0.0001% chance they'll be kidnapped. Y'all making the whole world all the worse for your cynicism. Sure, there's a remote chance you get in trouble for it. But there's also a chance you get hit by a car tomorrow morning. Yet you got out bed anyway.

Be the fucking change. At the very least, don't discourage others. Good grief.

▲

bobthebuilders 21 hours ago | parent [-]

I think that's a very privileged take. For most people, getting arrested and having the government try to press fraud and abuse charges is a life altering event, so it's natural that people would be more reticent.

▲

AlexErrant 19 hours ago | parent [-]

If doing the right thing were easy, it wouldn't be what gives you character.

I agree: having charges brought against you is a life-changing event. FWIW neither Chan Tsz-yan nor Josh Renaud were arrested, and in both cases the charges were dropped. https://pressfreedomtracker.us/all-incidents/missouri-govern... https://missouriindependent.com/2022/02/11/prosecutor-isnt-p...

The system sucks, and will always suck.

If you think these two cases out of umpteen billion CVE/security incident reports are odds enough to hide your face and turn away because the risk is too much... I apologize for being crass, but frankly you're being a little bitch.

If these odds aren't good enough for you to live up to your values, what are?

▲

thin_carapace 17 hours ago | parent [-]

you didn't have the guts to write me a response or to really acknowledge what the guy you're responding to here said. the things you say could be genuinely true , I'm not gonna absorb any of it since you're out here calling me a bitch while behaving like one yourself. was your goal to wave the finger or to inspire change in others? coz only one of those things happened today. by this point if you're an average human you'll have switched your brain off - on the off chance you're different, it's time to listen to the pot by tool

▲

AlexErrant 3 hours ago | parent [-]

> you didn't have the guts to write me a response

I did? Which is why you're here?

> or to really acknowledge what the guy you're responding to here said

I did? "If these odds aren't good enough for you to live up to your values, what are?" is a genuine question. Note that you didn't answer the question.

And everything said before _was_ a response to privilege, but to be more explicit: if you have the _privilege_ of discovering a vuln and the technical knowhow of recognizing its magnitude and potential effect on others, is it not YOU that are using your privilege for ill? "The indifference of good men...", etc, etc.

Listen. We're all cowards and bitches, me included. We all have faults, we all take the easy path, we all could do better. Me especially. I have a history that I'm not proud of, and my character is as flawed as anyone's. I apologize again for using crass language, perhaps if you're willing to extend some charity, substitute whatever language you feel like would be more appropriate. Unfortunately if I come up with other words they'd _still_ read as negative, so I'll refrain.

	▲	thin_carapace 2 hours ago \| parent [-]
		when you provide the respect of directly addressing me + the concerns I voice , I'm happy to read your points and acknowledge them in return. I'm here for a discussion, those things aren't directly connected to us personally if we don't want them to be. you seem to have targeted a widespread personal connection via emotive language, I understand the technique, it's just you kinda chose the emotion of insult, which tends to be reflected like other emotions. I'm not sure how to prove your final point wrong, aside from referring back to where I previously said you're probably right ... it's just the expression does not convey your point well. no offence I don't even want to address your counter arguments, they're ethereal at best, "you didn't answer my question that was posed in a rhetorical manner" + behaving as tho an indirect response has the same impact as a direct one. to be very clear I fully agree with the idea you're trying to convey so it's quite likely that I'm simply being too lazy to properly address your arguments.

▲

thin_carapace a day ago | parent | prev [-]

I think you have good intentions so I don't intend to attack you personally. just wanted to suggest that an individual being arrested for doing the right thing probably decreases the likelihood of them doing the right thing in future. so perhaps discretion is a good idea when doing the right thing, to increase chances of the right thing being done long term. there doesn't seem to exist a logical reason that corporations would avoid using the letter of the law to defend themselves, regardless as to how right that defense may be?

▲

tough a day ago | parent | next [-]

Deterrance not only works at the individual level, anyone reading these news reports about an innocent person being wrongly prosecuted for doing the right thing, is being trained to not do the right thing next time and just do nothing instead (because that's safer)

▲

thin_carapace a day ago | parent [-]

well I read those reports and came up with my comment above instead of running away so I'm not sure I can trust a conclusion based on your 'anyone' premise when the premise doesn't apply to me personally

▲

tough a day ago | parent [-]

anyone !== everyone

	▲	thin_carapace 21 hours ago \| parent [-]
		i assure u that nothing special has been accomplished by my body, most definitely i am an anybody and not a somebody. the purpose of a system is what it does, we dont have anything to disagree with outside of cheeky nit picks , so i guess this is good bye !

▲

matltc a day ago | parent | prev | next [-]

Can confirm, not arrested but threatened with litigation/employer contacted for responsible disclosure of unsanitized user input allowing arbitrary access to protected data of presumably any user. Just a url query param value flipped from true to false. Incrementing int user id too, so enumeration is trivial and the response payload was json so no need to do anything.

It is amazing what a casual observer with a background in web dev will see if they just open devtools. It has instilled a deep aversion in me to give any service any of my data that I care about protecting.

▲

tough a day ago | parent [-]

There should be an anonymous org way to report these without putting yourself in personal jeopardy, some kind of "innocent observer" protections built in...

If your system has gaps im not at fault for discovering them sort of deal

▲

socalgal2 a day ago | parent | next [-]

Unfortunately the anonymous org will then get abused by bad actors because of its anonymousness which leaves us where we are today

▲

flir a day ago | parent | prev [-]

Long, long ago we had anonymous remailers.

It was a different time. Today, I don't think I'd trust an intermediary set up to - essentially - pass along 0-days not to sleep on the juicy ones.

	▲	tough a day ago \| parent [-]
		wasn't that the origin of crypto and bitcoin too, or similar communities at least. I think that's where I've read from about remailers in the past as in the same people who mined bitcoin early was into these

▲

gosub100 a day ago | parent | prev [-]

I dont see why we should do unpaid work for megacorps. If I found a vuln, I would seriously consider releasing it on the darknet if I could even figure out how to use it. Not even try to sell it, just give it to them. I have no sympathy for the shareholders, or the corporate drones that work there. Who actually feels the damage?

▲

runsfromfire a day ago | parent [-]

Unfortunately, the damage is usually felt by the individuals whose data is compromised.

	▲	gosub100 a day ago \| parent [-]
		they aren't being made whole by receiving "free credit monitoring" or a check for $12.83 18 months later either. maybe increasing the damages paid by the corporation is needed?