alt Hacker NewsSomeone found a vulnerability in the system of Hong Kong Airlines that let the user to see the details of another passenger by changing a few characters in the URL. He reported the issue to the airlines. Then he was prosecuted and found guilty for hacking.
Tells you a lot about the attitude of many cooperations about these vulnerabilities.
Replies
I noticed I could see a family member's blood test results when clicking their forwarded email when I was logged into _my_ account. Sent an email. No response, but IIRC they fixed it a few weeks later.
Just an anecdote to counterbalance the apathy the OP might instill in people. Do good, regardless of the system.
That says a lot more about the legal system than the airline
>Tells you a lot about the attitude of many cooperations about these vulnerabilities.
If you were a faceless sociopathic entity that had a zero cost easy button to make problems go away you'd press it too.
It’s easy to criticise large legacy orgs having bad security, but what should you actually do as a C suite leader to fix it in these orgs?
It’s easy to list the various code scanning and monitoring solutions, but what do you do if teams continue to fail to fix issues on time? And realistically there’s a shadow IT of shell scripts and macros you don’t have much visibility on.
You can’t fire everyone, so I think it’d be better to link compensation of engineers (especially leads/managers) to scan reports, incidents, and audits, even if these are imperfect. But even then you’ll have business complaints about taking away engineering capacity from feature delivery.
This one's still fresh in my mind: "A Missouri newspaper told the state about a security risk. Now it faces prosecution"[1]
[1] https://www.npr.org/2021/10/14/1046124278/missouri-newspaper...