alt Hacker NewsI don't argue it is not good faith. I just wonder if OP realized that they might be crossing a line they shouldn't be crossing, ever, while doing security research without being under contract to the party they are investigating.
Then at least you are under and NDA and there is no way for the company to spin it that you were a bad guy.
The numbers mentioned are pretty serious: "We found records containing email addresses in 10,560 tables across 7,403 of the 24,664 websites (30%)."
To me - and please correct me if I'm wrong - that reads like 'we downloaded at least parts of 10560 tables'.
Replies
> I just wonder if OP realized that they might be crossing a line they shouldn't be crossing, ever, while doing security research without being under contract to the party they are investigating
yeah, good question - agreed that probably a lot safer to do this with explicit permission, though like others mentioned the tradeoff is that the company can cover it all up before it's clear just how bad the problem ever was and then say "we fixed a minor issue". I wouldn't risk my neck over that, but some people might I guess.
> To me - and please correct me if I'm wrong - that reads like 'we downloaded at least parts of 10560 tables'.
To me it sounds like they downloaded one or two records each from 10,560 tables and confirmed that those records contained emails. But you're right, I'm not sure it's very clear from the description.
Im not sure why you're arguing for an nda. Ive done a lot of security work under contract, the nda consistently means the company will file the report away and never talk about it again.
If you actually want change and things to be secured, this post might cause that. I dont understand the energy you are putting into convincing us thats a bad thing.