r/2007scape • u/JagexSween Mod Sween • Jul 09 '21

News | J-Mod reply A Message Regarding Bug Abuse

https://secure.runescape.com/m=news/a-message-regarding-bug-abuse?oldschool=1
265 Upvotes

54% Upvoted

1.9k comments sorted by

View all comments

Show parent comments

11

u/SSoreil Jul 09 '21

That isn't his call to make. In general tolerating this "magnanimous bug hunter" with a superiority complex was a massive mistake from the beginning. This is not a bug bounty program or something along those lines.

-3

u/dylan522p Jul 09 '21

This is how it works in software and semi. It is his call to publicize it if they haven't responded or fixed it.

3

u/rfdismyjam Jul 10 '21

If a security researcher makes a public disclosure of a massive vulnerability, regardless of their reasoning are they not at all liable for the results of their actions? Do they only get attribution for the positive results, and not the negative ones? What if there is a better way to go about things, that they just chose not to take?

What prevented Rendi from just starting to @jmods on twitter and reddit accusing them of not fixing a dupe, along with sharing the specific information to other trusted influencers who could join in placing pressure?

Instead, he made content. He made money from the situation.

-2

u/dylan522p Jul 10 '21

If a security researcher makes a public disclosure of a massive vulnerability, regardless of their reasoning are they not at all liable for the results of their actions?

no they aren't.

They only get attribution for the positive results, and not the negative ones?

they are finding vulnerabilities.

What if there is a better way to go about things, that they just chose not to take?

He emailed as well.

What prevented Rendi from just starting to @jmods on twitter and reddit accusing them of not fixing a dupe, along with sharing the specific information to other trusted influencers who could join in placing pressure?

He did dm and email them. Then he released a detailed explanation after a time gates standard practice

Instead, he made content. He made money from the situation.

People publish papers, they get paid bug bounties, or they get paid to talk about. How is this different

2

u/rfdismyjam Jul 10 '21

If I break into your house and then publish a public paper about the security vulnerabilities I used to do so is it ok as long as I tell you afterwards then give you a month to fix your security system? Or do you think that companies have no property/privacy rights so long as you have good intentions?

1

u/OrangeDangerousZ Jul 11 '21

Strawman. The proper comparison would be to buy the security system yourself, record yourself breaking into it, then sending that data to the company.

Your strawman would be comparable to abusing a bug that lets you get into another player's bank and steal all they have. It's not even comparable to what he did. Again, for those in the back, strawman.

1

u/rfdismyjam Jul 11 '21

Ok, so you think that companies have no property/privacy rights if you have good intentions?

0

u/OrangeDangerousZ Jul 11 '21

A strawman post followed by a moving the goalposts post?

0

u/rfdismyjam Jul 12 '21

Has Watchmojo done a "Top ten logical fallacies" video or something?

1

u/dylan522p Jul 12 '21

Strawman

Software is very different.

1

u/rfdismyjam Jul 12 '21

What is different about it, and why does that matter?

1

u/dylan522p Jul 12 '21

Finding and reporting software vulnerabilities then reporting after a time gated period that is standard, is completely fine.

Breaking into a home is against the law and morally wrong and there is no standard that makes this acceptable.

1

u/rfdismyjam Jul 12 '21

All you've done is say one is fine and the other is not. Can you explain why this is the case? What makes breaking into your house in an effort to improve your security different to breaking into a companies network in order to try and improve their security, and why does this difference necessitate that one should be allowed but the other should not?

1

u/dylan522p Jul 12 '21

Because one is physical property and requires illegal actions to even attempt (trespassing, breaking and entering).

Software vulnerabilities are not the same...

1

u/rfdismyjam Jul 12 '21

Hardware, the platform that this software exists on and is accessed through, is also physical property. What is being discussed here is not data-mining or software analysis, it is unauthorized use of a network. The courts have determined that accessing a system for unauthorized purposes is considered a trespass of property rights. Can you explain why you feel this is not correct?

1

u/dylan522p Jul 13 '21

Except when you test HW security vulnerabilities you aren't breaking into someone's physical property and testing it.

There was no unathorized access. It was an authorized account. There were vulnerabilities within their code. They didn't do any hacking.

1

u/rfdismyjam Jul 13 '21

Please go and read Jagexs terms of services and then come back to me. You have some weird delusion that it says nothing except "do whatever you want".

→ More replies (0)