[HN Gopher] I found a Vulnerability. They found a Lawyer
___________________________________________________________________
I found a Vulnerability. They found a Lawyer
Author : toomuchtodo
Score : 200 points
Date : 2026-02-20 19:19 UTC (3 hours ago)
(HTM) web link (dixken.de)
(TXT) w3m dump (dixken.de)
| xvxvx wrote:
| I've worked in I.T. For nearly 3 decades, and I'm still astounded
| by the disconnect between security best practices, often with
| serious legal muscle behind them, and the reality of how
| companies operate.
|
| I came across a pretty serious security concern at my company
| this week. The ramifications are alarming. My education, training
| and experience tells me one thing: identify, notify, fix. Then
| when I bring it to leadership, their agenda is to take these
| conversations offline, with no paper trail, and kill the
| conversation.
|
| Anytime I see an article about a data breach, I wonder how long
| these vulnerabilities were known and ignored. Is that just how
| business is conducted? It appears so, for many companies. Then
| why such a focus on security in education, if it has very little
| real-world application?
|
| By even flagging the issue and the potential fallout, I've put my
| career at risk. These are the sort of things that are supposed to
| lead to commendations and promotions. Maybe I live in
| fantasyland.
| calvinmorrison wrote:
| > By even flagging the issue and the potential fallout, I've
| put my career at risk.
|
| Simple as. Not your company? not your problem? Notify, move on.
| dspillett wrote:
| I read that post as him talking about their company, in the
| sense of the company they were working for. If that was the
| case, then an exploit of an unfixed security issue could very
| much affect them either just as part of the company if the
| fallout is enough to massively harm business, or specifically
| if they had not properly documented their concerns so "we
| didn't know" could be the excuse from above and they could be
| blamed for not adequately communicating the problem.
|
| For an external company "not your company, not your problem"
| for security issues is not a good moral position IMO. "I
| can't risk the fallout in my direction that I'm pretty sure
| will result from this" is more understandable because of how
| often you see whistle-blowers getting black-listed, but I'd
| still have a major battle with the pernickety prick that is
| my conscience1 and it would likely win out in the end.
|
| [1] oh, the things I could do if it wasn't for conscience and
| empathy :)
| refulgentis wrote:
| > These are the sort of things that are supposed to lead to
| commendations and promotions. Maybe I live in fantasyland.
|
| I had a bit of a feral journey into tech, poor upbringing =>
| self taught college dropout waiting tables => founded iPad
| point of sale startup in 2011 => sold it => Google in 2016 to
| 2023
|
| It was absolutely astounding to go to Google, and find out that
| all this work to ascend to an Ivy League-esque employment
| environment...I had been chasing a ghost. Because Google, at
| the end of the day, was an agglomeration of people, suffered
| from the same incentives and disincentives as any group, and
| thus also had the same boring, basic, social problems as any
| group.
|
| Put more concretely, couple vignettes:
|
| - Someone with ~5 years experience saying approximately: "You'd
| think we'd do a postmortem for this situation, but, you know
| how that goes. The people involved think they're an
| organization-wide announcement that you're coming for them, and
| someone higher ranked will get involved and make sure A) it
| doesn't happen or B) _you_ end up looking stupid for writing
| it. "
|
| - A horrible design flaw that made ~50% of users take 20
| seconds to get a query answered was buried, because a manager
| involved was the one who wrote the code.
| xvxvx wrote:
| I would get fired at Google within seconds then. I'm more
| than happy to shine a light on bullshit like that.
| bubblewand wrote:
| I've seen into some moderately high levels of "prestigious"
| business and government circles and I've yet to find _any_
| level at which everyone suddenly becomes as competent and
| sharp as I 'd have expected them to be, as a child and young
| adult (before I saw what I've seen and learned that the norm
| is morons and liars running everything and operating
| terrifically dysfunctional organizations... everywhere,
| apparently, regardless how high up the hierarchy you go). And
| actually, not only is there no step at which they suddenly
| become so, people don't even seem to gradually tend to
| brighter or generally better, on average, as you move
| "upward"... at all! Or perhaps only weakly so.
|
| Whatever the selection process is for _gestures broadly at
| everything_ , it's not selecting for being both (hell, often
| not for either) able and willing to do a good job, so far as
| what the job is apparently supposed to be. This appears to
| hold for just about everything, reputation and power be
| damned. Exceptions of high-functioning small groups or
| individuals in positions of power or prestige exist, as they
| do at "lower" levels, but aren't the norm anywhere as far as
| I've been able to discern.
| dspillett wrote:
| _> A horrible design flaw that made ~50% of users take 20
| seconds to get a query answered was buried, because a manager
| involved was the one who wrote the code._
|
| Maybe not when it is as much as 20 seconds, but an old
| manager of mine would save fixing something like that for a
| "quick win" at some later time! He would even have artificial
| delays put in, enough to be noticeable and perhaps reported
| but not enough to be massively inconvenient, so we could take
| them out during the UAT process - it didn't change what the
| client finally got, but it seemed to work especially if they
| thought they'd forced us to spend time on performance issues
| (those talking to us at the client side could report this
| back up their chain as a win).
| pixl97 wrote:
| There is a term for this but I can't remember what it's
| called.
|
| Effectively you put in on purpose bugs for an inspector to
| find so they don't dig too deep for difficult to solve
| problems.
| dspillett wrote:
| _> I came across a pretty serious security concern at my
| company this week. The ramifications are alarming. [...] Then
| when I bring it to leadership, their agenda is to take these
| conversations offline, with no paper trail, and kill the
| conversation._
|
| I was in a very similar position some years ago. After a couple
| of rounds of "finish X for sale Y then we'll prioritise those
| issue", which I was young and scared enough to let happen, and
| pulling on heartstrings ("if we don't get this sale some people
| will have to go, we risk that to [redacted] and her new kids,
| can we?") I just started fixing the problems and ignoring other
| tasks. I only got away with the insubordination because there
| were things I was the bus-count-of-one on at the time and when
| they tried to butter me up with the promise of some training
| courses, I had taken & passed some of those exams and had the
| rest booked in (the look of "good <deity>, he got an escape
| plan and is close to acting on it" on the manager's face during
| that conversation was _wonderful_!).
|
| The really worrying thing about that period is that a client
| had a pen-test done on their instance of the app, and _it
| passed_. I don 't know how, but I know I'd never trust that
| penetration testing company (they have long since gone out of
| business, I can't think why).
| tracker1 wrote:
| I wish I could recall the name of a pen test company I worked
| with when I wrote my auth system... They were pretty great
| and found several serious issues.
|
| At least compared to our internal digital security group
| would couldn't fathom, "your test is wrong for how this app
| is configured, that path leads to a different app and default
| behavior" it's not actually a failure... to a canned test for
| a php exploit. The app wasn't php, it was an SPA and always
| delivered the same default page unless in the /auth/* route.
|
| After that my response became, show me an actual exploit with
| an actual data leak you can show me and I'll update my code
| instead of your test.
| refulgentis wrote:
| Wish they named them. Usually I don't recommend it. But the
| combination of:
|
| A) in EU; GDPR will trump whatever BS they want to try B) no
| confirmation affected users were notified C) aggro threats D)
| nonsensical threats, sourced to Data Privacy Officer w/seemingly
| 0 scruples and little experience
|
| Due to B), there's a strong _responsibility_ rationale.
|
| Due to rest, there's a strong _name and shame_ rationale. Sort of
| equivalent to a bad Yelp review for a restaurant, but for SaaS.
| mzi wrote:
| Dan Europe has a flow as discussed in the article and both the
| foundation and the regulated insurance branch is registered in
| Malta.
| Nextgrid wrote:
| EU GDPR has very little enforcement. So while the regulation
| _in theory_ prevents that, in practice you can just ignore it.
| If you 're lucky a token fine comes up years down the line.
| vaylian wrote:
| > Instead, I offered to sign a modified declaration confirming
| data deletion. I had no interest in retaining anyone's personal
| data, but I was not going to agree to silence about the
| disclosure process itself.
|
| Why sign anything at all? The company was obviously not
| interested in cooperation, but in domination.
| desireco42 wrote:
| I think the problem is the process. Each country should have a
| reporting authority and it should be the one to deal with
| security issues.
|
| So you never report to actual organization but to the security
| organization, like you did. And they would be more equiped to
| deal with this, maybe also validate how serious this issue is.
| Assign a reward as well.
|
| So you are researcher, you report your thing and can't be sued or
| bullied by organization that is offending in the first place.
| ikmckenz wrote:
| That's almost what we already have with the CVE system, just
| without the legal protections. You report the vulnerability to
| the NSA, let them have their fun with it, then a fix is
| coordinated to be released much further down the line.
| Personally I don't think it's the best idea in the world, and
| entrenching it further seems like a net negative.
| desireco42 wrote:
| Yeah, something like that, nothing too much, just to exclude
| individual to deal with evil corps
| ylk wrote:
| This is not how CVEs work at all. You can be pretty vague
| when registering it. In fact they're usually annoyingly so
| and some companies are known for copy and pasting random text
| into the fields that completely lead you astray when trying
| to patch diff.
|
| Additionally, MITRE doesn't coordinate a release date with
| you. They can be slow to respond sometimes but in the end you
| just tell them to set the CVE to public at some date and
| they'll do it. You're also free to publish information on the
| vulnerability before MITRE assigned a CVE.
| PaulKeeble wrote:
| If the government wasn't so famous for also locking people up
| that reported security issues I might agree, but boy they are
| actually worse.
|
| Right now the climate in the world is whistleblowers get their
| careers and livihoods ended. This has been going on for quite a
| while.
|
| The only practical advice is ignore it exists, refuse to ever
| admit to having found a problem and move on. Leave zero paper
| trail or evidence. It sucks but its career ending to find these
| things and report them.
| janalsncm wrote:
| Does it have to be a government? Why not a third party non-
| profit? The white hat gets shielded, and the non-profit has
| credible lawyers which makes suing them harder than
| individuals.
|
| The idea is to make it easier to fix the vulnerability than to
| sue to shut people up.
|
| For credit assignment, the person could direct people to the
| non profit's website which would confirm discovery by CVE
| without exposing too many details that would allow the company
| to come after the individual.
|
| This business of going to the company directly and hoping they
| don't sue you is bananas in my opinion.
| viccis wrote:
| This is somewhat related, but I know of a fairly popular iOS
| application for iPads that stores passwords either in plaintext
| or encrypted (not as digests) because they will email it to you
| if you click Forgot Password. You also cannot change it. I have
| no experience with Apple development standards, so I thought I'd
| ask here if anyone knows whether this is something that should be
| reported to Apple, if Apple will do anything, or if it's even in
| violation of any standards?
| greggsy wrote:
| If anything it's just a violation of industry expectations. You
| as a consumer just don't need to use the product.
| tokyobreakfast wrote:
| >whether this is something that should be reported to Apple, if
| Apple will do anything
|
| Lmao Apple will not do anything for _actual malware_ when
| reported with receipts, besides sending you a form letter
| assuring you "experts will look into it, now fuck off" then
| never contact you again. Ask me how I know. To their credit, I
| suspected they ran it through useless rudimentary automated
| checks which passed and they were back in business like a day
| later.
|
| If your expectation is they will do something about _shitty
| coding practices_ half the App Store would be banned.
| jopsen wrote:
| > Apple will not do anything for actual malware when reported
| with receipts, besides sending you a form letter assuring you
| "experts will look into it, now fuck off"
|
| Ask while you are in an EU country, request appeal and
| initiate Out-of-court dispute resolution.
|
| Or better yet: let the platform suck, and let this be the
| year of the linux desktop on iPhone :)
| wizzwizz4 wrote:
| I used to say "submit it to Plain Text Offenders:
| https://plaintextoffenders.com/", but the site appears defunct
| since... 2012!? How time flies...
| tracker1 wrote:
| FWIW, some types of applications may be better served with
| encryption over hashing for password access. Email being one of
| them, given the varying ways to authenticate, it gets pretty
| funky to support. This is why in things like O365 you have a
| separate password issued for use with legacy email apps.
| projektfu wrote:
| Another comment says the situation was fake. I don't know, but to
| avoid running afoul of the authorities, it's possible to document
| this without actually accessing user data without permission. In
| the US, the Computer Fraud and Abuse Act and various state laws
| are written extremely broadly and were written at a time when
| most access was either direct dial-up or internal. The meaning of
| abuse can be twisted to mean rewriting a URL to access the next
| user, or inputting a user ID that is not authorized to you.
|
| Generally speaking, I think case law has avoided shooting the
| messenger, but if you use your unauthorized access to find PII on
| minors, you may be setting yourself up for problems, regardless
| if the goal is merely dramatic effect. You can, instead, document
| everything and hypothesize the potential risks of the
| vulnerability without exposing yourself to accusation of
| wrongdoing.
|
| For example, the article talks about registering divers. The
| author could ask permission from the next diver to attempt to set
| their password without reading their email, and that would
| clearly show the vulnerability. No kids "in harm's way".
| alphazard wrote:
| Instead of understanding all of this, and when it does or does
| not apply, it's probably better to disclose vulnerabilities
| anonymously over Tor. It's not worth the hassle of being forced
| to hire a lawyer, just to be a white hat.
| cptskippy wrote:
| Part of the motivation of reporting is clout and reputation.
| That sounds harsh or critical but for some folks their
| reputation directly impacts their livelihood. Sure the data
| controller doesn't care, but if you want to get hired or
| invited to conferences then the clout matters.
| kazinator wrote:
| > _vulnerability in the member portal of a major diving insurer_
|
| What are the odds an insurer would reach for a lawyer? They
| probably have several on speed dial.
| cptskippy wrote:
| What makes you think they don't retain them in-house?
| tracker1 wrote:
| Depends on the usage... in-house counsel may open up various
| liabilities of their own, depending on how things present.
| kazinator wrote:
| Why does someone with a .de website insure their diving using
| some company based in Malta?
|
| Based on this interaction, you have wonder what it's like to file
| a claim with them.
| som wrote:
| Divers Alert Network, which is probably the most well known
| dive membership (and insurance) org out there is registered in
| Malta in Europe.
| ImPostingOnHN wrote:
| It is probably among the standard forms required to participate
| in a diving class/excursion for travelers from other countries;
| and, Malta was probably chosen as the official HQ for legal or
| liability shelter reasons.
| vablings wrote:
| Absolutely horrible according to DIVE TALK
|
| https://www.youtube.com/watch?v=O7NsjpiPK7o
|
| Insurance company would not cover a decompression chamber for
| someone who has severe decompression sickness, it is a life-
| threatening condition that requires immediate remediation.
|
| The idea that you possible neurological DCS and you must argue
| on the phone with an insurance rep about if you need to be
| life-flighted to the nearest chamber is just.... Mind blowing
| 0sdi wrote:
| Is this Divers Alert Network (DAN) Europe, and it's insurance
| subsidiary, IDA Insurance Limited?
| locusofself wrote:
| Another commenter basically deduced this
| stevage wrote:
| Since the author is apparently afraid to name the organisation in
| question, it seems the legal threats have worked perfectly.
| tuhgdetzhh wrote:
| If you follow the jurisdictional trail in the post, the field
| narrows quickly. The author describes a major international
| diving insurer, an instructor driven student registration
| workflow, GDPR applicability, and explicit involvement of CSIRT
| Malta under the Maltese National Coordinated Vulnerability
| Disclosure Policy. That combination is highly specific.
|
| There are only a few globally relevant diving insurers. DAN
| America is US based. DiveAssure is not Maltese. AquaMed is
| German. The one large diving insurer that is actually
| headquartered and registered in Malta is DAN Europe. Given that
| the organization is described as being registered in Malta and
| subject to Maltese supervisory processes, DAN Europe becomes
| the most plausible candidate based on structure and
| jurisdiction alone.
| pavel_lishin wrote:
| Or maybe in the diving community, "Maltese insurance company
| for divers" is about as subtle as "Bird-themed social network
| with blue checkmarks".
| saxelsen wrote:
| There's pretty much only one global insurer affiliated with
| dive schools, so this is spot on
| frederikvs wrote:
| I'm a diver, DAN is the only company I can name that
| specialises in diving insurance.
|
| Huh, apparently they're registered in Malta, what a
| coincidence...
| bpavuk wrote:
| checks out with both Perplexity[0] and top Google results
|
| [0]: https://www.perplexity.ai/search/maltese-scuba-diving-
| insura...
| bpavuk wrote:
| well, it is. quick search revealed a name of a certain big
| player, although there are some other local companies whose
| policies can be extended to "extreme sports"
|
| https://www.reddit.com/r/scuba/comments/1r9fn7u/apparently_a.
| ..
| da_chicken wrote:
| Maybe.
|
| Or maybe they took what they know to sell to the black hats.
| undebuggable wrote:
| > the portal used incrementing numeric user IDs
|
| > every account was provisioned with a static default password
|
| Hehehe. I failed countless job interviews for mistakes much less
| serious than that. Yet someone gets the job while making worse
| mistakes, and there are plenty of such systems on production
| handling real people's data.
| tracker1 wrote:
| Literally found the same issue in a password system, on top of
| passwords being clear text in the database... cleared all
| passwords, expanded the db field to hold a longer hash (pw
| field was like 12 chars), setup "recover password" feature and
| emailed all users before End of Day.
|
| My own suggestion to anyone reading this... version your
| password hashing mechanics so you can upgrade hashing methods
| as needed in the future. I usually use
| "v{version}.{salt}.{hash}" where salt and the resulting hash
| are a base64 string of the salt and result. I could use
| multiple db fields for the same, but would rather not... I
| could also use JSON or some other wrapper, but feel the dot-
| separated base64 is good enough.
|
| I have had instances where hashing was indeed upgraded later,
| and a password was (re)hashed at login with the new encoding if
| the version changed... after a given time-frame, will notify
| users and wipe old passwords to require recovery process.
|
| FWIW, I really wish there were better guides for moderately
| good implementations of login/auth systems out there. Too many
| applications for things like SSO, etc just become a morass of
| complexity that isn't always necesssary. I did write a nice
| system for a former employer that is somewhat widely
| deployed... I tried to get permission to open-source it, but
| couldn't get buy in over "security concerns" (the irony). Maybe
| someday I'll make another one.
| makr17 wrote:
| Years ago I worked for a company that bought another company.
| Our QA folks were asked to give their site a once-over. What
| they found is still the butt of jokes in my circle of
| friends/former coworkers.
|
| * account ids are numeric, and incrementing
|
| * included in the URL after login, e.g. ?account=123456
|
| * no authentication on requests after login
|
| So anybody moderately curious can just increment to
| account_id=123457 to access another account. And then try
| 123458. And then enumerate the space to see if there is
| anything interesting... :face-palm: :cold-sweat:
| cptskippy wrote:
| Maintaining Cybersecurity Insurance is a big deal in the US, I
| don't know about Europe. So vulnerability disclosure is
| problematic for data controllers because it threatens their
| insurance and premiums. Today much of enterprise security is
| attestation based and vulnerability disclosure potentially
| exposes companies to insurance fraud. If they stated that they
| maintained certain levels of security, and a disclosure
| demonstratively proves they do not, that is grounds for dropping
| a policy or even a lawsuit to reclaim paid funds.
|
| So it sort of makes sense that companies would go on the attack
| because there's a risk that their insurance company will catch
| wind and they'll be on the hook.
| FurryEnjoyer wrote:
| Malta has been mentioned? As a person living here I could say
| that workflow of the government here is bad. Same as in every
| other place I guess.
|
| By the way, I had a story when I accidentally hacked an online
| portal in our school. It didn't go much and I was "caught" but
| anyways. This is how we learn to be more careful.
|
| I believe in every single system like that it's fairly possible
| to find a vulnerability. Nobody cares about them and people that
| make those systems don't have enough skill to do it right. Data
| is going to be leaked. That's the unfortunate truth. It gets
| worse with the come of AI. Since it has zero understanding of
| what it is actually it will make mistakes that would cause more
| data leaks.
|
| Even if you don't consider yourself as an evil person, would you
| still stay the same knowing real security vulnerability? Who
| knows. Some might take advantage. Some won't and still be
| punished for doing everything as the "textbook way".
| josefritzishere wrote:
| I find these tales of lawyerly threats completley validate the
| hackers actions. They reported the bug to spur the company to
| resolve it. Their reaction all but confirms that reporting it to
| them directly would not have been productive. Their management
| lacks good stewardship. They are not thinking about their
| responsibility to their customers and employees.
| paxys wrote:
| When you are acting in good faith and the person/organization on
| the other end isn't, you aren't having a productive discussion or
| negotiation, just wasting your own time.
|
| The only sensible approach here would have been to cease all
| correspondence after their very first email/threat. The nation of
| Malta would survive just fine without you looking out for them
| and their online security.
| czbond wrote:
| Agree - yet, security researchers and our wider community also
| needs to recognize that vulnerabilities are foreign to most
| non-technical users.
|
| Cold approach vulnerability reports to non-technical
| organizations quite frankly scare them. It might be like
| someone you've never met telling you the door on your back
| bedroom balcony can be opened with a dummy key, and they know
| because they tried it.
|
| Such organizations don't kmow what to do. They're scared,
| thinking maybe someone also took financial information, etc.
| Internal strife and lots of discussions usually occur with lots
| of wild specualation (as the norm) before any communication
| back occurs.
|
| It just isn't the same as what security forward organizations
| do, so it often becomes as a surprise to engineers when "good
| deed" seems to be taken as malice.
| bpavuk wrote:
| cynical. worst part? best one can do in this situation. can't
| imagine how I could continue any further interaction with such
| organization.
| janalsncm wrote:
| Three thoughts from someone with no expertise.
|
| 1) If you make legal disclosure too hard, the only way you will
| find out is via criminals.
|
| 2) If other industries worked like this, you could sue an
| architect who discovered a flaw in a skyscraper. The difference
| is that knowledge of a bad foundation doesn't inherently make a
| building more likely to collapse, while knowledge of a cyber
| vulnerability is an inherent risk.
|
| 3) Random audits by passers-by is way too haphazard. If a website
| can require my real PII, I should be able to require that PII is
| secure. I'm not sure what the full list of industries would be,
| but insurance companies should be categorically required to have
| an cyber audit, and laws those same laws should protect white
| hats from lawyers and allow class actions from all users. That
| would change the incentives so that the most basic
| vulnerabilities are gone, and software engineers become more
| economical than lawyers.
| estebarb wrote:
| If this was in Costa Rica the appropiate way was to contact
| PRODHAB about the leak of personal information and Costa Rica
| CSIRT ( csirt@micitt.go.cr ).
|
| Here all databases with personal information must be registered
| there and data must be secure.
| Buttons840 wrote:
| I've said before that we need strong legal protections for white-
| hat and even grey-hat security researchers or hackers. As long as
| they report what they have found and follow certain rules, they
| need to be protected from any prosecution or legal consequences.
| We need to give them the benefit of the doubt.
|
| The problem is this is literally a matter of national security,
| and currently we sacrifice national security for the convenience
| of wealthy companies.
|
| Also, we all have our private data leaked multiple times per
| month. We see millions of people having their private information
| leaked by these companies, and there are zero consequences.
| Currently, the companies say, "Well, it's our code, it's our
| responsibility; nobody is allowed to research or test the
| security of our code because it is our code and it is our
| responsibility." But then, when they leak the entire nation's
| private data, it's no longer their responsibility. They're not
| liable.
|
| As security issues continue to become a bigger and bigger
| societal problem, remember that we are choosing to hamstring our
| security researchers. We can make a different choice and decide
| we want to utilize our security researchers instead, for the
| benefit of all and for better national security. It might cause
| some embarrassment for companies though, so I'm not holding my
| breath.
| hbrav wrote:
| This is extremely disappointing. The insurer in question has a
| very good reputation within the dive community for acting in good
| faith and for providing medical information free of charge to
| non-members.
|
| This sounds like a cultural mismatch with their lawyers. Which is
| ironic, since the lawyers in question probably thought of
| themselves as being risk-averse and doing everything possible to
| protect the organisation's reputation.
| snowhale wrote:
| the NDA demand with a same-day deadline is such a classic move.
| makes it clear they were more worried about reputation than
| fixing anything.
| pixl97 wrote:
| Reply: "sorry, before reaching out to you I already notified a
| major media organization with a 90 day release notice"
| Hnrobert42 wrote:
| I use a different email address for every service. About 15 years
| ago, I began getting spam at my diversalertnetwork email address.
| I emailed DAN to tell them they'd been breached. They responded
| with an email telling me how to change my password.
|
| I guess I should feel lucky they didn't try to have me criminally
| prosecuted.
| general1465 wrote:
| One way how to improve cybersecurity is let cyber criminals loose
| like predators hunting prey. Companies needs to feel fear that
| any vulnerability in their systems is going to be weaponized
| against them. Only then they will appreciate an email telling
| them about security issue which has not been exploited yet.
| MrQuincle wrote:
| There should exist a vulnerability disclosure intermediary. They
| can function as a barrier to protect the
| scientist/researcher/enthousiast and do everything by the book
| for the different countries.
| esafak wrote:
| Who compensates them for the risk?
| pixl97 wrote:
| That's why you just sell it on the black market and let it be
| the intermediary.
| nickorlow wrote:
| The free market at work!
___________________________________________________________________
(page generated 2026-02-20 23:00 UTC)