[HN Gopher] Hackers know everything is securities fraud
___________________________________________________________________
Hackers know everything is securities fraud
Author : toomuchtodo
Score : 105 points
Date : 2023-11-16 19:01 UTC (3 hours ago)
(HTM) web link (www.bloomberg.com)
(TXT) w3m dump (www.bloomberg.com)
| super_linear wrote:
| https://archive.ph/Yffbh
| el_benhameen wrote:
| https://www.bloomberg.com/account/newsletters/money-stuff
|
| For those concerned about the paywall, you can sign up for Money
| Stuff for free with no account. Worth the sub, imo.
| dang wrote:
| [stub for offtopicness]
| downrightmike wrote:
| Can we get a little link below the title that opens links up in
| a non pay walled link? You can't even read the first sentence
| of this article.
| Galanwe wrote:
| These paywall things are such a bane... I do have a
| registration at Bloomberg from work, but I get logged out of
| the website so frequently that it's basically faster to read
| from a paywall bypass. This is absurd.
| pvg wrote:
| https://news.ycombinator.com/item?id=10178989
|
| https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que.
| ..
| politelemon wrote:
| The paywall workaround doesn't work, I get stuck in an
| infinite captcha loop. I'll now be told to inspect my DNS
| settings, which is a step too far in terms of bypass. IMO
| the article ought to be flagged.
| dang wrote:
| No paywall workaround works for everybody unfortunately.
| They're there for the ones they work for.
| voidwtf wrote:
| How does a paywalled article jump to the top so quickly?
|
| edit: it appears that paywall articles are ok per dang,
| apologies for the noise
| lokar wrote:
| You can get his newsletter for free via email, which everyone
| should do.
| _jal wrote:
| ...assumes that people's complaint with paywalls is about
| paying money, and does not answer the question.
| andylynch wrote:
| Quite. He's the best writer in his field, and one of the
| best commentators on any topic full stop.
| wslh wrote:
| Bloomberg and Matt Levine together help with antigravity.
| SparkyMcUnicorn wrote:
| Didn't know it was paywalled, since I use "Bypass Paywalls
| Clean"[0].
|
| [0] https://gitlab.com/magnolia1234/bypass-paywalls-chrome-
| clean
| cosmojg wrote:
| Ooh, this is wonderful! Thanks!
| dang wrote:
| Only if there are workarounds; otherwise not (see https://hn.
| algolia.com/?dateRange=all&page=0&prefix=true&que...).
|
| This is in the FAQ at
| https://news.ycombinator.com/newsfaq.html and there's more
| explanation here:
|
| https://hn.algolia.com/?dateRange=all&page=0&prefix=false&so.
| ..
|
| https://news.ycombinator.com/item?id=10178989
| AnonCoward42 wrote:
| Has anyone else the problem that they get endless captchas and
| no way to use archive.ph? Or maybe knows a solution.
|
| Edit: This is on Firefox and with uBlock Origin only. It works
| with the same setup in my VM however.
|
| Edit2: Changing DNS (to NextDNS in my case) worked.
| toomuchtodo wrote:
| Don't use 1.1.1.1 from Cloudflare, disable the Cloudflare
| resolver in Firefox, or turn off Private Relay on Apple+/iOS.
| Those are the usual suspects.
| AnonCoward42 wrote:
| Huh, that was it. Changing to NextDNS already works. That's
| a weird one. Thank you for your suggestion!
| ferbivore wrote:
| Archive.is and Cloudflare have a long-standing feud over
| EDNS Client Subnet support. Archive.is refuses to serve
| Cloudflare DNS users and Cloudflare refuses to work
| around it.
| ratsmack wrote:
| Yes... this has been a problem for a while now for a lot of
| people.
| cfeduke wrote:
| I have that problem but it probably some something to do with
| some combination of browser addons I have installed. When I
| launch the link in a Private Firefox window they seem to
| work.
| cosmojg wrote:
| Weirdly, this only happens for me in Chrome despite using the
| same extensions there that I use in Firefox. I initially
| fixed the problem in both browsers by switching my DNS
| provider from Cloudflare to Quad9 (which also noticeably
| improved network performance more than I'd ever expect a
| change in DNS provider to do so), but then the problem
| returned in Chrome, and since Firefox is my daily driver, I
| haven't bothered to figure out why just yet.
|
| Originally, it had something to do with how Archive.today
| handles Cloudflare's EDNS configuration. Now, though, it
| appears that it might be caused by something else.
|
| See: https://en.wikipedia.org/wiki/Archive.today#Cloudflare_D
| NS_a...
| ratsmack wrote:
| That's just one more vector for targeted spam and illicit data
| collection. I prefer to keep my exposure to a minimum.
| grammarxcore wrote:
| Assuming you're interested enough in the content to actually
| care about subscribing, using single-purpose email aliases is
| the best way to handle these two problems. For the rare thing
| I want to subscribe to, I have a unique email and tuned
| subscription preferences. I can turn off the email if I'm
| done with the content and not worry about trying to figure
| out how to cancel the sub.
| impostervt wrote:
| How do you generate so many email addresses? Host your own
| domain?
| BytesAndGears wrote:
| Yes, in my case, but also fastmail includes unlimited
| @fastmail.com email addresses, delivered to your normal
| inbox, and can even be generated on the fly by password
| managers like Bitwarden.
| cosmojg wrote:
| I used to do this, but it started causing a lot of problems
| when I needed to talk to customer support, especially the
| surprisingly numerous companies which still store email
| addresses as an immutable record of account identity.
| dang wrote:
| We detached this subthread from
| https://news.ycombinator.com/item?id=38294034.
| eganist wrote:
| > [stub for offtopicness]
|
| Is this a new thing? Because I love this.
| pvg wrote:
| stubbed around for a while
| https://hn.algolia.com/?q=by%3Adang+stub
| otikik wrote:
| > Do you think ... do you think the ransomware collective's
| lawyers wrote that? Do you think they hired a former SEC
| enforcement lawyer to do their whistleblower submissions?
|
| My bet is: a machine wrote that. A lot of the hackers out there
| are not native English speakers, and they don't speak legalese.
| They fed the raw facts to an LLM and this is what came out
| through the other end.
| ReactiveJelly wrote:
| Passing text through a popular llm might throw off stylometry,
| too
| eganist wrote:
| Interesting. At least against public companies, this could be a
| viable alternative for reporting serious issues that aren't taken
| seriously in said companies' vulnerability disclosure programs.
| ("Hey, E Corp clearly knew about this risk")
|
| It might also result in a ton of spam to the SEC and maybe drive
| companies to close their VDPs if opportunistic bounty kiddies
| clog the programs with SEC threats over their clickjacking
| submission.
|
| Interesting indeed. If only for the resulting detritus, at least
| until any of this ends up in the courts.
| toomuchtodo wrote:
| https://www.sec.gov/tcr
| PeterisP wrote:
| No, that's not an alternative avenue for reporting serious
| issues, because that only applies to "material breaches" (i.e.
| the vulnerability was not only exploitable but actually
| exploited, and the attack did damage, and the damage is so
| large that it makes a difference to the financials of the
| company) so someone has to commit a bunch of felonies before
| the issue becomes reportable to SEC, and reporting it is not a
| magic get-out-of-jail-free card.
| araes wrote:
| The Rivian portion is interesting because it seems like there's
| an implied failure mode not being acknowledged, where Rivian
| pretends to work, absorbs lots of money, then says "through some
| mysterious circumstances we have failed!".
|
| I'd have to read the full bond document, yet it seems like until
| its all over (and I guess everybody agrees it all equaled out),
| there's still $15 billion of municipal bonds outstanding. What
| happens if Rivian belly flops again? Last I saw they couldn't
| sell a truck for $100,000 without losing money.
|
| Also, how do I do this with my property taxes, so the area and I
| agree I don't pay property taxes? Guess its an exploit only for a
| certain caste.
|
| Also, also, thank you @super_linear for the link.
| fallingknife wrote:
| It's _up to_ 15 billion, and they are only issued in tranches
| when Rivian pays the money to the government entity. It 's a
| tax break, but the state takes no credit risk.
| psunavy03 wrote:
| This seems to be missing the whole mens rea element on multiple
| fronts. To commit fraud requires intent.
|
| First, it's silly to expect a company to be making public
| disclosures before it has its ducks in a row and can explain
| precisely what happened with a reasonable degree of accuracy.
|
| Second, the idea that the act of being hacked is prima facie
| evidence of prior securities fraud is absurd. Assuming that a
| company took good-faith efforts to secure its systems, it wasn't
| lying (see mens rea above) when it said things like "we use
| strong passwords." I'm sure there's a point of gross incompetence
| or negligence that could get the company in hot water, but
| barring that, sometimes you just lose. Sometimes the robber picks
| your house and sometimes the hacker picks your company.
| ethanbond wrote:
| The actual issue at (this) hand is the lack of _reporting_ the
| breach, and the rule is not that you have to disclose "once
| you have your ducks in a row." You have to disclose soon after
| determining that it's _material_. Still a little squishy, but
| not quite as squishy as ducks.
| bastardoperator wrote:
| Exactly, someone is lying big here.
| blacksqr wrote:
| > It has come to our attention that MeridianLink, in light of a
| significant breach...
|
| SEC whistleblower information has to be original, which I presume
| means you have to have direct knowledge of infractions, rather
| than just claiming someone told you about them. So in this case a
| drawback of the hacker's plan would seem to be that they'd have
| to cop to the crime in order to be eligible for an award.
| filoleg wrote:
| > SEC whistleblower information has to be original, which I
| presume means you have to have direct knowledge of infractions,
| rather than just claiming someone told you about them.
|
| I think of it like walking outside and accidentally
| encountering a physical briefcase containing documents that
| could be used for whistleblowing. SEC would still honor the
| award for that person, right?
|
| I am not an expert on this, so it was a genuine question, not
| rhetorical. I always assumed that the "original" part was
| mostly referring to "no, we are not giving you the award
| because you are the 50th person to blow the whistle on this",
| and "direct knowledge" was referring to "you actually gotta
| have some proof of wrongdoing happening and not just try to
| gather an award from SEC because your dad working at Nintendo
| told you so." So my guess was that documents obtained through a
| hack would not be an issue for SEC, as long as you were the
| original reporter (aka no one had reported this before you) and
| the documents actually provide some evidence of the wrongdoing
| that is more substantial than just hearsay.
| JumpCrisscross wrote:
| > _walking outside and accidentally encountering a physical
| briefcase containing documents that could be used for
| whistleblowing. SEC would still honor the award for that
| person, right?_
|
| Maybe not. I doubt those materials would be admissible in
| court. (They _might_ support a search warrant.)
| filoleg wrote:
| > I doubt those materials would be admissible in court.
|
| As long as legitimacy of those documents is confirmed in
| court, why would they be inadmissible? From my perspective
| on admissibility, I don't see much of a difference between
| the whistleblower scenario and a random person walking on
| the street, noticing something that could be a crime
| evidence (e.g., a blood trail), reporting it to the
| relevant authorities, and then that blood trail being used
| as a piece of evidence in court.
|
| What about the FBI most wanted list, where they promise
| monetary awards for tips that could lead to the person on
| the poster? Because if passerby's just randomly
| encountering helpful info like that aren't qualified for
| the awards, the bar becomes almost impossible to satisfy,
| unless you are directly involved with people you are
| providing info on (which eliminates a massive group of
| whistleblowers that are third-party witnesses)
| JumpCrisscross wrote:
| > _As long as legitimacy of those documents is confirmed
| in court, why would they be inadmissible?_
|
| In the process of confirming legitimacy, you'll get the
| originals. Random stuff found on a street could be a
| fictitious creation or misconstrued.
|
| If you _saw_ who dropped off the briefcase, that might
| count as observation. I would see the SEC having a hard
| time not counting that as "original information."
|
| > _What about the FBI most wanted list, where they
| promise monetary awards for tips that could lead to the
| person on the poster?_
|
| Tips versus "information," from what I understand. That
| said, it's very much an open book [1].
|
| [1] https://www.whistleblowers.org/faq/sec-whistleblower-
| dodd-fr...
| mschuster91 wrote:
| > You might not care: If you did an illegal bad thing to the
| company (like hacking), also doing insider trading might not
| bother you. Still it adds some risk. My Fifth Law of Insider
| Trading is "don't insider trade by planting bombs at a company
| and buying put options on its stock."
|
| It's worth clicking that link: someone did _exactly this_ a few
| years ago - planted bombs on the route of the team coach of
| German soccer club BVB and placed buy orders for derivatives,
| through which his identity was discovered after a hint from a
| stock trader who also was a BVB fan [1]. The perp ended up with
| 14 years in prison.
|
| [1]
| https://de.wikipedia.org/wiki/Anschlag_auf_den_Mannschaftsbu...
| lubesGordi wrote:
| Its like a securities fraud race condition. I wonder how many of
| those there are in the legal system.
___________________________________________________________________
(page generated 2023-11-16 23:01 UTC)