[HN Gopher] I found a Vulnerability. They found a Lawyer
       ___________________________________________________________________
        
       I found a Vulnerability. They found a Lawyer
        
       Author : toomuchtodo
       Score  : 200 points
       Date   : 2026-02-20 19:19 UTC (3 hours ago)
        
 (HTM) web link (dixken.de)
 (TXT) w3m dump (dixken.de)
        
       | xvxvx wrote:
       | I've worked in I.T. For nearly 3 decades, and I'm still astounded
       | by the disconnect between security best practices, often with
       | serious legal muscle behind them, and the reality of how
       | companies operate.
       | 
       | I came across a pretty serious security concern at my company
       | this week. The ramifications are alarming. My education, training
       | and experience tells me one thing: identify, notify, fix. Then
       | when I bring it to leadership, their agenda is to take these
       | conversations offline, with no paper trail, and kill the
       | conversation.
       | 
       | Anytime I see an article about a data breach, I wonder how long
       | these vulnerabilities were known and ignored. Is that just how
       | business is conducted? It appears so, for many companies. Then
       | why such a focus on security in education, if it has very little
       | real-world application?
       | 
       | By even flagging the issue and the potential fallout, I've put my
       | career at risk. These are the sort of things that are supposed to
       | lead to commendations and promotions. Maybe I live in
       | fantasyland.
        
         | calvinmorrison wrote:
         | > By even flagging the issue and the potential fallout, I've
         | put my career at risk.
         | 
         | Simple as. Not your company? not your problem? Notify, move on.
        
           | dspillett wrote:
           | I read that post as him talking about their company, in the
           | sense of the company they were working for. If that was the
           | case, then an exploit of an unfixed security issue could very
           | much affect them either just as part of the company if the
           | fallout is enough to massively harm business, or specifically
           | if they had not properly documented their concerns so "we
           | didn't know" could be the excuse from above and they could be
           | blamed for not adequately communicating the problem.
           | 
           | For an external company "not your company, not your problem"
           | for security issues is not a good moral position IMO. "I
           | can't risk the fallout in my direction that I'm pretty sure
           | will result from this" is more understandable because of how
           | often you see whistle-blowers getting black-listed, but I'd
           | still have a major battle with the pernickety prick that is
           | my conscience1 and it would likely win out in the end.
           | 
           | [1] oh, the things I could do if it wasn't for conscience and
           | empathy :)
        
         | refulgentis wrote:
         | > These are the sort of things that are supposed to lead to
         | commendations and promotions. Maybe I live in fantasyland.
         | 
         | I had a bit of a feral journey into tech, poor upbringing =>
         | self taught college dropout waiting tables => founded iPad
         | point of sale startup in 2011 => sold it => Google in 2016 to
         | 2023
         | 
         | It was absolutely astounding to go to Google, and find out that
         | all this work to ascend to an Ivy League-esque employment
         | environment...I had been chasing a ghost. Because Google, at
         | the end of the day, was an agglomeration of people, suffered
         | from the same incentives and disincentives as any group, and
         | thus also had the same boring, basic, social problems as any
         | group.
         | 
         | Put more concretely, couple vignettes:
         | 
         | - Someone with ~5 years experience saying approximately: "You'd
         | think we'd do a postmortem for this situation, but, you know
         | how that goes. The people involved think they're an
         | organization-wide announcement that you're coming for them, and
         | someone higher ranked will get involved and make sure A) it
         | doesn't happen or B) _you_ end up looking stupid for writing
         | it. "
         | 
         | - A horrible design flaw that made ~50% of users take 20
         | seconds to get a query answered was buried, because a manager
         | involved was the one who wrote the code.
        
           | xvxvx wrote:
           | I would get fired at Google within seconds then. I'm more
           | than happy to shine a light on bullshit like that.
        
           | bubblewand wrote:
           | I've seen into some moderately high levels of "prestigious"
           | business and government circles and I've yet to find _any_
           | level at which everyone suddenly becomes as competent and
           | sharp as I 'd have expected them to be, as a child and young
           | adult (before I saw what I've seen and learned that the norm
           | is morons and liars running everything and operating
           | terrifically dysfunctional organizations... everywhere,
           | apparently, regardless how high up the hierarchy you go). And
           | actually, not only is there no step at which they suddenly
           | become so, people don't even seem to gradually tend to
           | brighter or generally better, on average, as you move
           | "upward"... at all! Or perhaps only weakly so.
           | 
           | Whatever the selection process is for _gestures broadly at
           | everything_ , it's not selecting for being both (hell, often
           | not for either) able and willing to do a good job, so far as
           | what the job is apparently supposed to be. This appears to
           | hold for just about everything, reputation and power be
           | damned. Exceptions of high-functioning small groups or
           | individuals in positions of power or prestige exist, as they
           | do at "lower" levels, but aren't the norm anywhere as far as
           | I've been able to discern.
        
           | dspillett wrote:
           | _> A horrible design flaw that made ~50% of users take 20
           | seconds to get a query answered was buried, because a manager
           | involved was the one who wrote the code._
           | 
           | Maybe not when it is as much as 20 seconds, but an old
           | manager of mine would save fixing something like that for a
           | "quick win" at some later time! He would even have artificial
           | delays put in, enough to be noticeable and perhaps reported
           | but not enough to be massively inconvenient, so we could take
           | them out during the UAT process - it didn't change what the
           | client finally got, but it seemed to work especially if they
           | thought they'd forced us to spend time on performance issues
           | (those talking to us at the client side could report this
           | back up their chain as a win).
        
             | pixl97 wrote:
             | There is a term for this but I can't remember what it's
             | called.
             | 
             | Effectively you put in on purpose bugs for an inspector to
             | find so they don't dig too deep for difficult to solve
             | problems.
        
         | dspillett wrote:
         | _> I came across a pretty serious security concern at my
         | company this week. The ramifications are alarming. [...] Then
         | when I bring it to leadership, their agenda is to take these
         | conversations offline, with no paper trail, and kill the
         | conversation._
         | 
         | I was in a very similar position some years ago. After a couple
         | of rounds of "finish X for sale Y then we'll prioritise those
         | issue", which I was young and scared enough to let happen, and
         | pulling on heartstrings ("if we don't get this sale some people
         | will have to go, we risk that to [redacted] and her new kids,
         | can we?") I just started fixing the problems and ignoring other
         | tasks. I only got away with the insubordination because there
         | were things I was the bus-count-of-one on at the time and when
         | they tried to butter me up with the promise of some training
         | courses, I had taken & passed some of those exams and had the
         | rest booked in (the look of "good <deity>, he got an escape
         | plan and is close to acting on it" on the manager's face during
         | that conversation was _wonderful_!).
         | 
         | The really worrying thing about that period is that a client
         | had a pen-test done on their instance of the app, and _it
         | passed_. I don 't know how, but I know I'd never trust that
         | penetration testing company (they have long since gone out of
         | business, I can't think why).
        
           | tracker1 wrote:
           | I wish I could recall the name of a pen test company I worked
           | with when I wrote my auth system... They were pretty great
           | and found several serious issues.
           | 
           | At least compared to our internal digital security group
           | would couldn't fathom, "your test is wrong for how this app
           | is configured, that path leads to a different app and default
           | behavior" it's not actually a failure... to a canned test for
           | a php exploit. The app wasn't php, it was an SPA and always
           | delivered the same default page unless in the /auth/* route.
           | 
           | After that my response became, show me an actual exploit with
           | an actual data leak you can show me and I'll update my code
           | instead of your test.
        
       | refulgentis wrote:
       | Wish they named them. Usually I don't recommend it. But the
       | combination of:
       | 
       | A) in EU; GDPR will trump whatever BS they want to try B) no
       | confirmation affected users were notified C) aggro threats D)
       | nonsensical threats, sourced to Data Privacy Officer w/seemingly
       | 0 scruples and little experience
       | 
       | Due to B), there's a strong _responsibility_ rationale.
       | 
       | Due to rest, there's a strong _name and shame_ rationale. Sort of
       | equivalent to a bad Yelp review for a restaurant, but for SaaS.
        
         | mzi wrote:
         | Dan Europe has a flow as discussed in the article and both the
         | foundation and the regulated insurance branch is registered in
         | Malta.
        
         | Nextgrid wrote:
         | EU GDPR has very little enforcement. So while the regulation
         | _in theory_ prevents that, in practice you can just ignore it.
         | If you 're lucky a token fine comes up years down the line.
        
       | vaylian wrote:
       | > Instead, I offered to sign a modified declaration confirming
       | data deletion. I had no interest in retaining anyone's personal
       | data, but I was not going to agree to silence about the
       | disclosure process itself.
       | 
       | Why sign anything at all? The company was obviously not
       | interested in cooperation, but in domination.
        
       | desireco42 wrote:
       | I think the problem is the process. Each country should have a
       | reporting authority and it should be the one to deal with
       | security issues.
       | 
       | So you never report to actual organization but to the security
       | organization, like you did. And they would be more equiped to
       | deal with this, maybe also validate how serious this issue is.
       | Assign a reward as well.
       | 
       | So you are researcher, you report your thing and can't be sued or
       | bullied by organization that is offending in the first place.
        
         | ikmckenz wrote:
         | That's almost what we already have with the CVE system, just
         | without the legal protections. You report the vulnerability to
         | the NSA, let them have their fun with it, then a fix is
         | coordinated to be released much further down the line.
         | Personally I don't think it's the best idea in the world, and
         | entrenching it further seems like a net negative.
        
           | desireco42 wrote:
           | Yeah, something like that, nothing too much, just to exclude
           | individual to deal with evil corps
        
           | ylk wrote:
           | This is not how CVEs work at all. You can be pretty vague
           | when registering it. In fact they're usually annoyingly so
           | and some companies are known for copy and pasting random text
           | into the fields that completely lead you astray when trying
           | to patch diff.
           | 
           | Additionally, MITRE doesn't coordinate a release date with
           | you. They can be slow to respond sometimes but in the end you
           | just tell them to set the CVE to public at some date and
           | they'll do it. You're also free to publish information on the
           | vulnerability before MITRE assigned a CVE.
        
         | PaulKeeble wrote:
         | If the government wasn't so famous for also locking people up
         | that reported security issues I might agree, but boy they are
         | actually worse.
         | 
         | Right now the climate in the world is whistleblowers get their
         | careers and livihoods ended. This has been going on for quite a
         | while.
         | 
         | The only practical advice is ignore it exists, refuse to ever
         | admit to having found a problem and move on. Leave zero paper
         | trail or evidence. It sucks but its career ending to find these
         | things and report them.
        
         | janalsncm wrote:
         | Does it have to be a government? Why not a third party non-
         | profit? The white hat gets shielded, and the non-profit has
         | credible lawyers which makes suing them harder than
         | individuals.
         | 
         | The idea is to make it easier to fix the vulnerability than to
         | sue to shut people up.
         | 
         | For credit assignment, the person could direct people to the
         | non profit's website which would confirm discovery by CVE
         | without exposing too many details that would allow the company
         | to come after the individual.
         | 
         | This business of going to the company directly and hoping they
         | don't sue you is bananas in my opinion.
        
       | viccis wrote:
       | This is somewhat related, but I know of a fairly popular iOS
       | application for iPads that stores passwords either in plaintext
       | or encrypted (not as digests) because they will email it to you
       | if you click Forgot Password. You also cannot change it. I have
       | no experience with Apple development standards, so I thought I'd
       | ask here if anyone knows whether this is something that should be
       | reported to Apple, if Apple will do anything, or if it's even in
       | violation of any standards?
        
         | greggsy wrote:
         | If anything it's just a violation of industry expectations. You
         | as a consumer just don't need to use the product.
        
         | tokyobreakfast wrote:
         | >whether this is something that should be reported to Apple, if
         | Apple will do anything
         | 
         | Lmao Apple will not do anything for _actual malware_ when
         | reported with receipts, besides sending you a form letter
         | assuring you  "experts will look into it, now fuck off" then
         | never contact you again. Ask me how I know. To their credit, I
         | suspected they ran it through useless rudimentary automated
         | checks which passed and they were back in business like a day
         | later.
         | 
         | If your expectation is they will do something about _shitty
         | coding practices_ half the App Store would be banned.
        
           | jopsen wrote:
           | > Apple will not do anything for actual malware when reported
           | with receipts, besides sending you a form letter assuring you
           | "experts will look into it, now fuck off"
           | 
           | Ask while you are in an EU country, request appeal and
           | initiate Out-of-court dispute resolution.
           | 
           | Or better yet: let the platform suck, and let this be the
           | year of the linux desktop on iPhone :)
        
         | wizzwizz4 wrote:
         | I used to say "submit it to Plain Text Offenders:
         | https://plaintextoffenders.com/", but the site appears defunct
         | since... 2012!? How time flies...
        
         | tracker1 wrote:
         | FWIW, some types of applications may be better served with
         | encryption over hashing for password access. Email being one of
         | them, given the varying ways to authenticate, it gets pretty
         | funky to support. This is why in things like O365 you have a
         | separate password issued for use with legacy email apps.
        
       | projektfu wrote:
       | Another comment says the situation was fake. I don't know, but to
       | avoid running afoul of the authorities, it's possible to document
       | this without actually accessing user data without permission. In
       | the US, the Computer Fraud and Abuse Act and various state laws
       | are written extremely broadly and were written at a time when
       | most access was either direct dial-up or internal. The meaning of
       | abuse can be twisted to mean rewriting a URL to access the next
       | user, or inputting a user ID that is not authorized to you.
       | 
       | Generally speaking, I think case law has avoided shooting the
       | messenger, but if you use your unauthorized access to find PII on
       | minors, you may be setting yourself up for problems, regardless
       | if the goal is merely dramatic effect. You can, instead, document
       | everything and hypothesize the potential risks of the
       | vulnerability without exposing yourself to accusation of
       | wrongdoing.
       | 
       | For example, the article talks about registering divers. The
       | author could ask permission from the next diver to attempt to set
       | their password without reading their email, and that would
       | clearly show the vulnerability. No kids "in harm's way".
        
         | alphazard wrote:
         | Instead of understanding all of this, and when it does or does
         | not apply, it's probably better to disclose vulnerabilities
         | anonymously over Tor. It's not worth the hassle of being forced
         | to hire a lawyer, just to be a white hat.
        
           | cptskippy wrote:
           | Part of the motivation of reporting is clout and reputation.
           | That sounds harsh or critical but for some folks their
           | reputation directly impacts their livelihood. Sure the data
           | controller doesn't care, but if you want to get hired or
           | invited to conferences then the clout matters.
        
       | kazinator wrote:
       | > _vulnerability in the member portal of a major diving insurer_
       | 
       | What are the odds an insurer would reach for a lawyer? They
       | probably have several on speed dial.
        
         | cptskippy wrote:
         | What makes you think they don't retain them in-house?
        
           | tracker1 wrote:
           | Depends on the usage... in-house counsel may open up various
           | liabilities of their own, depending on how things present.
        
       | kazinator wrote:
       | Why does someone with a .de website insure their diving using
       | some company based in Malta?
       | 
       | Based on this interaction, you have wonder what it's like to file
       | a claim with them.
        
         | som wrote:
         | Divers Alert Network, which is probably the most well known
         | dive membership (and insurance) org out there is registered in
         | Malta in Europe.
        
         | ImPostingOnHN wrote:
         | It is probably among the standard forms required to participate
         | in a diving class/excursion for travelers from other countries;
         | and, Malta was probably chosen as the official HQ for legal or
         | liability shelter reasons.
        
         | vablings wrote:
         | Absolutely horrible according to DIVE TALK
         | 
         | https://www.youtube.com/watch?v=O7NsjpiPK7o
         | 
         | Insurance company would not cover a decompression chamber for
         | someone who has severe decompression sickness, it is a life-
         | threatening condition that requires immediate remediation.
         | 
         | The idea that you possible neurological DCS and you must argue
         | on the phone with an insurance rep about if you need to be
         | life-flighted to the nearest chamber is just.... Mind blowing
        
       | 0sdi wrote:
       | Is this Divers Alert Network (DAN) Europe, and it's insurance
       | subsidiary, IDA Insurance Limited?
        
         | locusofself wrote:
         | Another commenter basically deduced this
        
       | stevage wrote:
       | Since the author is apparently afraid to name the organisation in
       | question, it seems the legal threats have worked perfectly.
        
         | tuhgdetzhh wrote:
         | If you follow the jurisdictional trail in the post, the field
         | narrows quickly. The author describes a major international
         | diving insurer, an instructor driven student registration
         | workflow, GDPR applicability, and explicit involvement of CSIRT
         | Malta under the Maltese National Coordinated Vulnerability
         | Disclosure Policy. That combination is highly specific.
         | 
         | There are only a few globally relevant diving insurers. DAN
         | America is US based. DiveAssure is not Maltese. AquaMed is
         | German. The one large diving insurer that is actually
         | headquartered and registered in Malta is DAN Europe. Given that
         | the organization is described as being registered in Malta and
         | subject to Maltese supervisory processes, DAN Europe becomes
         | the most plausible candidate based on structure and
         | jurisdiction alone.
        
         | pavel_lishin wrote:
         | Or maybe in the diving community, "Maltese insurance company
         | for divers" is about as subtle as "Bird-themed social network
         | with blue checkmarks".
        
           | saxelsen wrote:
           | There's pretty much only one global insurer affiliated with
           | dive schools, so this is spot on
        
           | frederikvs wrote:
           | I'm a diver, DAN is the only company I can name that
           | specialises in diving insurance.
           | 
           | Huh, apparently they're registered in Malta, what a
           | coincidence...
        
             | bpavuk wrote:
             | checks out with both Perplexity[0] and top Google results
             | 
             | [0]: https://www.perplexity.ai/search/maltese-scuba-diving-
             | insura...
        
           | bpavuk wrote:
           | well, it is. quick search revealed a name of a certain big
           | player, although there are some other local companies whose
           | policies can be extended to "extreme sports"
           | 
           | https://www.reddit.com/r/scuba/comments/1r9fn7u/apparently_a.
           | ..
        
         | da_chicken wrote:
         | Maybe.
         | 
         | Or maybe they took what they know to sell to the black hats.
        
       | undebuggable wrote:
       | > the portal used incrementing numeric user IDs
       | 
       | > every account was provisioned with a static default password
       | 
       | Hehehe. I failed countless job interviews for mistakes much less
       | serious than that. Yet someone gets the job while making worse
       | mistakes, and there are plenty of such systems on production
       | handling real people's data.
        
         | tracker1 wrote:
         | Literally found the same issue in a password system, on top of
         | passwords being clear text in the database... cleared all
         | passwords, expanded the db field to hold a longer hash (pw
         | field was like 12 chars), setup "recover password" feature and
         | emailed all users before End of Day.
         | 
         | My own suggestion to anyone reading this... version your
         | password hashing mechanics so you can upgrade hashing methods
         | as needed in the future. I usually use
         | "v{version}.{salt}.{hash}" where salt and the resulting hash
         | are a base64 string of the salt and result. I could use
         | multiple db fields for the same, but would rather not... I
         | could also use JSON or some other wrapper, but feel the dot-
         | separated base64 is good enough.
         | 
         | I have had instances where hashing was indeed upgraded later,
         | and a password was (re)hashed at login with the new encoding if
         | the version changed... after a given time-frame, will notify
         | users and wipe old passwords to require recovery process.
         | 
         | FWIW, I really wish there were better guides for moderately
         | good implementations of login/auth systems out there. Too many
         | applications for things like SSO, etc just become a morass of
         | complexity that isn't always necesssary. I did write a nice
         | system for a former employer that is somewhat widely
         | deployed... I tried to get permission to open-source it, but
         | couldn't get buy in over "security concerns" (the irony). Maybe
         | someday I'll make another one.
        
         | makr17 wrote:
         | Years ago I worked for a company that bought another company.
         | Our QA folks were asked to give their site a once-over. What
         | they found is still the butt of jokes in my circle of
         | friends/former coworkers.
         | 
         | * account ids are numeric, and incrementing
         | 
         | * included in the URL after login, e.g. ?account=123456
         | 
         | * no authentication on requests after login
         | 
         | So anybody moderately curious can just increment to
         | account_id=123457 to access another account. And then try
         | 123458. And then enumerate the space to see if there is
         | anything interesting... :face-palm: :cold-sweat:
        
       | cptskippy wrote:
       | Maintaining Cybersecurity Insurance is a big deal in the US, I
       | don't know about Europe. So vulnerability disclosure is
       | problematic for data controllers because it threatens their
       | insurance and premiums. Today much of enterprise security is
       | attestation based and vulnerability disclosure potentially
       | exposes companies to insurance fraud. If they stated that they
       | maintained certain levels of security, and a disclosure
       | demonstratively proves they do not, that is grounds for dropping
       | a policy or even a lawsuit to reclaim paid funds.
       | 
       | So it sort of makes sense that companies would go on the attack
       | because there's a risk that their insurance company will catch
       | wind and they'll be on the hook.
        
       | FurryEnjoyer wrote:
       | Malta has been mentioned? As a person living here I could say
       | that workflow of the government here is bad. Same as in every
       | other place I guess.
       | 
       | By the way, I had a story when I accidentally hacked an online
       | portal in our school. It didn't go much and I was "caught" but
       | anyways. This is how we learn to be more careful.
       | 
       | I believe in every single system like that it's fairly possible
       | to find a vulnerability. Nobody cares about them and people that
       | make those systems don't have enough skill to do it right. Data
       | is going to be leaked. That's the unfortunate truth. It gets
       | worse with the come of AI. Since it has zero understanding of
       | what it is actually it will make mistakes that would cause more
       | data leaks.
       | 
       | Even if you don't consider yourself as an evil person, would you
       | still stay the same knowing real security vulnerability? Who
       | knows. Some might take advantage. Some won't and still be
       | punished for doing everything as the "textbook way".
        
       | josefritzishere wrote:
       | I find these tales of lawyerly threats completley validate the
       | hackers actions. They reported the bug to spur the company to
       | resolve it. Their reaction all but confirms that reporting it to
       | them directly would not have been productive. Their management
       | lacks good stewardship. They are not thinking about their
       | responsibility to their customers and employees.
        
       | paxys wrote:
       | When you are acting in good faith and the person/organization on
       | the other end isn't, you aren't having a productive discussion or
       | negotiation, just wasting your own time.
       | 
       | The only sensible approach here would have been to cease all
       | correspondence after their very first email/threat. The nation of
       | Malta would survive just fine without you looking out for them
       | and their online security.
        
         | czbond wrote:
         | Agree - yet, security researchers and our wider community also
         | needs to recognize that vulnerabilities are foreign to most
         | non-technical users.
         | 
         | Cold approach vulnerability reports to non-technical
         | organizations quite frankly scare them. It might be like
         | someone you've never met telling you the door on your back
         | bedroom balcony can be opened with a dummy key, and they know
         | because they tried it.
         | 
         | Such organizations don't kmow what to do. They're scared,
         | thinking maybe someone also took financial information, etc.
         | Internal strife and lots of discussions usually occur with lots
         | of wild specualation (as the norm) before any communication
         | back occurs.
         | 
         | It just isn't the same as what security forward organizations
         | do, so it often becomes as a surprise to engineers when "good
         | deed" seems to be taken as malice.
        
         | bpavuk wrote:
         | cynical. worst part? best one can do in this situation. can't
         | imagine how I could continue any further interaction with such
         | organization.
        
       | janalsncm wrote:
       | Three thoughts from someone with no expertise.
       | 
       | 1) If you make legal disclosure too hard, the only way you will
       | find out is via criminals.
       | 
       | 2) If other industries worked like this, you could sue an
       | architect who discovered a flaw in a skyscraper. The difference
       | is that knowledge of a bad foundation doesn't inherently make a
       | building more likely to collapse, while knowledge of a cyber
       | vulnerability is an inherent risk.
       | 
       | 3) Random audits by passers-by is way too haphazard. If a website
       | can require my real PII, I should be able to require that PII is
       | secure. I'm not sure what the full list of industries would be,
       | but insurance companies should be categorically required to have
       | an cyber audit, and laws those same laws should protect white
       | hats from lawyers and allow class actions from all users. That
       | would change the incentives so that the most basic
       | vulnerabilities are gone, and software engineers become more
       | economical than lawyers.
        
       | estebarb wrote:
       | If this was in Costa Rica the appropiate way was to contact
       | PRODHAB about the leak of personal information and Costa Rica
       | CSIRT ( csirt@micitt.go.cr ).
       | 
       | Here all databases with personal information must be registered
       | there and data must be secure.
        
       | Buttons840 wrote:
       | I've said before that we need strong legal protections for white-
       | hat and even grey-hat security researchers or hackers. As long as
       | they report what they have found and follow certain rules, they
       | need to be protected from any prosecution or legal consequences.
       | We need to give them the benefit of the doubt.
       | 
       | The problem is this is literally a matter of national security,
       | and currently we sacrifice national security for the convenience
       | of wealthy companies.
       | 
       | Also, we all have our private data leaked multiple times per
       | month. We see millions of people having their private information
       | leaked by these companies, and there are zero consequences.
       | Currently, the companies say, "Well, it's our code, it's our
       | responsibility; nobody is allowed to research or test the
       | security of our code because it is our code and it is our
       | responsibility." But then, when they leak the entire nation's
       | private data, it's no longer their responsibility. They're not
       | liable.
       | 
       | As security issues continue to become a bigger and bigger
       | societal problem, remember that we are choosing to hamstring our
       | security researchers. We can make a different choice and decide
       | we want to utilize our security researchers instead, for the
       | benefit of all and for better national security. It might cause
       | some embarrassment for companies though, so I'm not holding my
       | breath.
        
       | hbrav wrote:
       | This is extremely disappointing. The insurer in question has a
       | very good reputation within the dive community for acting in good
       | faith and for providing medical information free of charge to
       | non-members.
       | 
       | This sounds like a cultural mismatch with their lawyers. Which is
       | ironic, since the lawyers in question probably thought of
       | themselves as being risk-averse and doing everything possible to
       | protect the organisation's reputation.
        
       | snowhale wrote:
       | the NDA demand with a same-day deadline is such a classic move.
       | makes it clear they were more worried about reputation than
       | fixing anything.
        
         | pixl97 wrote:
         | Reply: "sorry, before reaching out to you I already notified a
         | major media organization with a 90 day release notice"
        
       | Hnrobert42 wrote:
       | I use a different email address for every service. About 15 years
       | ago, I began getting spam at my diversalertnetwork email address.
       | I emailed DAN to tell them they'd been breached. They responded
       | with an email telling me how to change my password.
       | 
       | I guess I should feel lucky they didn't try to have me criminally
       | prosecuted.
        
       | general1465 wrote:
       | One way how to improve cybersecurity is let cyber criminals loose
       | like predators hunting prey. Companies needs to feel fear that
       | any vulnerability in their systems is going to be weaponized
       | against them. Only then they will appreciate an email telling
       | them about security issue which has not been exploited yet.
        
       | MrQuincle wrote:
       | There should exist a vulnerability disclosure intermediary. They
       | can function as a barrier to protect the
       | scientist/researcher/enthousiast and do everything by the book
       | for the different countries.
        
         | esafak wrote:
         | Who compensates them for the risk?
        
           | pixl97 wrote:
           | That's why you just sell it on the black market and let it be
           | the intermediary.
        
             | nickorlow wrote:
             | The free market at work!
        
       ___________________________________________________________________
       (page generated 2026-02-20 23:00 UTC)