by consolidating all tools into one tool, the bus factor is now 1. by consolidating all tools into one tool, the quality of individual tools decreases (eg. phone flashlight is adequate for small jobs but is much less effective than a torch). every single god damn person on the train sits there with their head buried in their consolidated tool screen, nobody socializes. there seems to be plenty of issues, privacy notwithstanding.
I don't intend to disagree, merely to suggest that while doing the right thing one would be best off considering the potential aspects inflicted to themselves, in this case colonoscopy deaths are one in ten thousand from memory
I can run a linear regression and get the same result every time or I can go to chat.com and get A/B tested upon. yes these are cherry picked examples. they're also the ones that apply to me personally. for a higher level version of this argument please see my response to the other responder.
when concept A applies to concept B in practice, a lack of theoretical connection between A and B is basically irrelevant to me as a lay person. people don't seem to grasp this argument well here so I'll be very clear, yes you are entirely correct, concurrently there isn't much reason for me to care about correctness when my eyes and ears tell me something else
you didn't have the guts to write me a response or to really acknowledge what the guy you're responding to here said. the things you say could be genuinely true , I'm not gonna absorb any of it since you're out here calling me a bitch while behaving like one yourself. was your goal to wave the finger or to inspire change in others? coz only one of those things happened today. by this point if you're an average human you'll have switched your brain off - on the off chance you're different, it's time to listen to the pot by tool
> or to really acknowledge what the guy you're responding to here said
I did? "If these odds aren't good enough for you to live up to your values, what are?" is a genuine question. Note that you didn't answer the question.
And everything said before _was_ a response to privilege, but to be more explicit: if you have the _privilege_ of discovering a vuln and the technical knowhow of recognizing its magnitude and potential effect on others, is it not YOU that are using your privilege for ill? "The indifference of good men...", etc, etc.
Listen. We're all cowards and bitches, me included. We all have faults, we all take the easy path, we all could do better. Me especially. I have a history that I'm not proud of, and my character is as flawed as anyone's. I apologize again for using crass language, perhaps if you're willing to extend some charity, substitute whatever language you feel like would be more appropriate. Unfortunately if I come up with other words they'd _still_ read as negative, so I'll refrain.
when you provide the respect of directly addressing me + the concerns I voice , I'm happy to read your points and acknowledge them in return. I'm here for a discussion, those things aren't directly connected to us personally if we don't want them to be. you seem to have targeted a widespread personal connection via emotive language, I understand the technique, it's just you kinda chose the emotion of insult, which tends to be reflected like other emotions. I'm not sure how to prove your final point wrong, aside from referring back to where I previously said you're probably right ... it's just the expression does not convey your point well. no offence I don't even want to address your counter arguments, they're ethereal at best, "you didn't answer my question that was posed in a rhetorical manner" + behaving as tho an indirect response has the same impact as a direct one. to be very clear I fully agree with the idea you're trying to convey so it's quite likely that I'm simply being too lazy to properly address your arguments.
> just wanted to suggest that an individual being arrested for doing the right thing probably decreases the likelihood of them doing the right thing in future.
Agree. Again, the system sucks, and will always suck.
> so perhaps discretion is a good idea when doing the right thing, to increase chances of the right thing being done long term.
Agree. I lean utilitarian philosophically. If we lived in a society akin to Russia where Doing The Right Thing would get you thrown out of a window, then I would not be telling people to do so.
> there doesn't seem to exist a logical reason that corporations would avoid using the letter of the law to defend themselves, regardless as to how right that defense may be?
I admit I'm having trouble parsing this. But if you're saying corps use lawfare to get away with as much as they can: I agree.
I'm not saying that you should Always Do The Right Thing At The Cost of Everything. I'm only saying yall are indexing very, very hard on 2 edge cases that were dropped and led to no arrests or jailtime. My anecdote/advice does NOT apply to those living in authoritarian regimes where the tallest nail gets hammered down. (You could argue that Hong Kong is such an authoritarian regime; I won't disagree.)
Let me phrase it this way: if you're too risk-averse to report when you see security issues because you fear charges, then you should also always stay within the speed limit, come to a complete stop at stop signs, never jaywalk, loiter or consume alcohol in public. Heck while we're at it you should also stop driving; the risk of death is much higher than that of being arrested for reporting a security issue. We all have different risk tolerances, but I think the numbers here are in my favor.
perhaps it may bear fruit being mindful that some of the online audience do spectate from such regimes. citizens reporting flaws in public infrastructure is the objectively correct decision a majority of the time. concurrently, many individuals acting in both public and private interests regarding security, vastly more than surmisable as edge cases, have been prosecuted for acts that any sane individual would deem not irrational. I don't think it's fair, comparing a jaywalking fine to a criminal charge for entering a URL (but one example given here).
> perhaps it may bear fruit being mindful that some of the online audience do spectate from such regimes
Sure, I could caveat my arguments down to nothing (unless you live in a authoriatrian government, unless you're an investigative journalist whose livelihood and sources would be threatened by your arrest, unless you're 9months pregant and cannot in good conscience undergo even imagined stress, etc. etc.) Or I could simply say "Do the Right Thing", give the base rate, and let you handle the nuances for your situation.
This is why my follow-up was a critique of cynicism. Perhaps I could've said that sometimes cynicism is well earned; there ARE people that in shitty situations where cynicism is warranted. But the vast majority of the people on HN reading that comment? Nah dawg. NGL this thread feels peak HN "well ackshully". I cannot speak in a way that is 100% correct for all people at all times.
Sure, jaywalking is not a crime in some areas. Engage with the steelman of my argument dude, don't just find the weakest example out of ~5 and go after it.
you did well addressing my arguments previously, not sure which aspect in particular caused this reversion to reactive behaviour. in the past I'd have been happy to continue being patient with you, nowadays it's impossible to discern between an angry man and an llm being directed to waste my time. sorry bud, ciao
in that case what is the central idea being pointed at by the misnomer 'toxic masculinity' ? interesting to consider that prevailing framing as being an inherent critique of masculinity as a whole. personally I dislike the phrase 'toxic positivity' for similar reasons, it's like saying that a turd may be made palatable.
did u have a way to frame that idea objectively without referring to feminism ? coz feminism embodies a similar concept to the one we apply toxic masculinity to. where feminism in contemporary practice seems to have little in common with supporting women
I think you have good intentions so I don't intend to attack you personally. just wanted to suggest that an individual being arrested for doing the right thing probably decreases the likelihood of them doing the right thing in future. so perhaps discretion is a good idea when doing the right thing, to increase chances of the right thing being done long term. there doesn't seem to exist a logical reason that corporations would avoid using the letter of the law to defend themselves, regardless as to how right that defense may be?
Deterrance not only works at the individual level, anyone reading these news reports about an innocent person being wrongly prosecuted for doing the right thing, is being trained to not do the right thing next time and just do nothing instead (because that's safer)
well I read those reports and came up with my comment above instead of running away so I'm not sure I can trust a conclusion based on your 'anyone' premise when the premise doesn't apply to me personally
i assure u that nothing special has been accomplished by my body, most definitely i am an anybody and not a somebody. the purpose of a system is what it does, we dont have anything to disagree with outside of cheeky nit picks , so i guess this is good bye !
Can confirm, not arrested but threatened with litigation/employer contacted for responsible disclosure of unsanitized user input allowing arbitrary access to protected data of presumably any user. Just a url query param value flipped from true to false. Incrementing int user id too, so enumeration is trivial and the response payload was json so no need to do anything.
It is amazing what a casual observer with a background in web dev will see if they just open devtools. It has instilled a deep aversion in me to give any service any of my data that I care about protecting.
There should be an anonymous org way to report these without putting yourself in personal jeopardy, some kind of "innocent observer" protections built in...
If your system has gaps im not at fault for discovering them sort of deal
I dont see why we should do unpaid work for megacorps. If I found a vuln, I would seriously consider releasing it on the darknet if I could even figure out how to use it. Not even try to sell it, just give it to them. I have no sympathy for the shareholders, or the corporate drones that work there. Who actually feels the damage?
they aren't being made whole by receiving "free credit monitoring" or a check for $12.83 18 months later either. maybe increasing the damages paid by the corporation is needed?
reply