undefined | Better HN

0 points3JPLW12y ago0 comments

That said, he could have gone "gray-hat" and used the source to find in-scope bugs. Such a resource would be invaluable to an exploit author or bug bounty hunter.

0 comments

7 comments · 1 top-level

eli12y ago· 6 in thread

Legally, I don't think there's much "gray" in stealing source code that doesn't belong to you.

shawabawa312y ago

> Legally, I don't think there's much "gray" in stealing source code that doesn't belong to you

I thought the whole point of gray hat is that it's possibly illegal, but not downright "evil".

i.e. Stealing source code to fix bugs = gray, stealing source code to steal credit card info = black

meowface12y ago

You're right, but it will still get you into legal trouble. Not only may you not get a bounty, but they might sue or press charges for essentially copying and scanning their source code.

Generally "gray hat" and "corporation/law-friendly" don't mix, even if there are some cases that call for it.

3JPLWOP12y ago

From Wikipedia, which agrees with my understanding of the phrase: "… such people sometimes act illegally, though in good will, to identify vulnerabilities in computing processes." My point, though, is that it's hardly out of scope when it's a valuable resource for developing novel attacks on in-scope domains.

https://en.wikipedia.org/wiki/Grey_hat

err4nt12y ago

I doubt it could have been called 'stealing' if he only accessed what was posted publicly by the authors themselves at the time.

Until he contacted Prezi, how could he be certain beyond any doubt that they weren't already aware of it? Could you explain that to me?

davorak12y ago

Using login in credentials that are not your own found in a public place to take source code is like finding someones house key on a park bench and coping their secret invention designs or trade secrets.

2 more replies

angersock12y ago

How exactly does one "steal" source code, if the original copy still remains with the authors?

j / k navigate · click thread line to collapse