Has anyone here dealt with the Tesla vulnerability reporting process before?

In particular, does anyone have experience with how honest or accommodating they are?

I was reading tesla.com/about/security and it seems like it's worded in such a way that their lawyers will always be able to find an excuse to sue. I mean, their Responsible Disclosure Guidelines require that you both 1) report any security vulnerability you find within 7 days of discovery, and 2) provide a working PoC. I can imagine a situation where it takes longer than 7 days to develop a PoC, meaning you technically violated their guidelines (opening you up to lawsuits).

@AreWeNotTooSmart Not necessarily possible if the vulnerability is in their network. It means that they would know that I knew of the bug for more than 7 days.

@forest what do you mean by "in their network", what way?

@AreWeNotTooSmart Well, consider a bug in their GSM/LTE/whatever network (just an example). In poking around, I'd likely be triggering log events.

Yeah i agree with that

Could anyone point me to products that offer RBAC or ABAC services through an API (I know product recommendations are generally off topic, but I was hoping somebody is chat could maybe point me in the right direction)

What's up, hackers?

Is the gibson hacked already?

@Jacco Chat is usually a perfectly reasonable place to ask off-topic things. Obviously though it comes with no guarantee of answers. Take this comment for instance. The person posting it doesn't know the answer to your question, making this comment unhelpful at best.

@forest I had a look at this, and it doesn't evoke a sense of trust

It seems more written in a way like "We have been told offensive security is good, but we don't really believe in it. So if you hack our cars, we'll sue you"

You may have better chances if you work for a bigger company and have some sort of contract

@Jacco Sorry, no clue what RBAC or ABAC is

Also, look in the list of "hackers" below

2013 it was also almost exclusively individuals who found vulns

And 2014 onward, it was mostly universities and other groups

This comment: security.stackexchange.com/questions/215628/…

Hello there @AreWeNotTooSmart

Your question made quite the stir

(((unexpected)))

But seriously, did you attempt to change the domain controller admin password?

What do you mean by "RBAC or ABAC services"? How can you provide access control as a service?

@MechMK1 It was rather meaned to be a sort of test , just a probe

@AreWeNotTooSmart But for what reason? To see if you could?

@A.Hersean, By Access Control as a service I mean that applications call an external service to check if a user has permission to do something within the application.

Yes, and it worked also ;)

Thereby basically offloading the role/access rights management to an external service.

@AreWeNotTooSmart And what was the plan after that? You changed the password of the domain controller, and then?

The use case for an ABAC/RBAC SaaS solution is that many mid-size companies build in-house software, but have limited resources. While at the same time being big enough that things like (immutable) audit trails and GUI-based configuration of access rights are becoming important

@Jacco You can always ask on Software Recommendations

A stack exchange site precisely for software recommendations

I then said to our local admins i changed it to a default user password, they didn't understand and asked how i did it, answered "our teacher gave me full access".. it could just be anyone

@AreWeNotTooSmart That's a very dangerous thing to do, as I pointed out in my answer. In a realistic worst case, they could expel you from school

It really is. Performing unauthorized penetration testing is always a dangerous thing. However, what you did really wasn't penetration testing - it was much, much, shadier.

I don't know how old you are, but if you are still in your teens, you might have it written off as "youthful overenthusiasm"

But let me give you a word of advice: Always get a PtA

@forest speak to Ian Tabor (mintynet on twitter) - he is involved with the UK's car hacking community, and was part of the car hacking squad at Defcon this year - which had a Tesla for seriously hacking on

it may have also been physically abused, with stickers, scratches, and a sledghammer to the bonnet

@MechMK1 probably

one of the badges I got could do that, and it was free :-)

I think that's really cool

Sadly, I'm not 1337 enough to port doom to a tesla :D

@MechMK1 me neither

well worth getting over to Defcon if you can - so much to learn from smart folks

and funprojects and swag

That's sadly not possible, due to multiple personal reasons

It would be cool, but I feel like most of those talks would just be way over my head anyways

I still feel like I'm barely above a script kiddie these days :/

I mean, yeah, I've been in the business for not even a year, so there's lot of room to grow, but still

@MechMK1 they have everything from 101 up to seriously 1337

I'd like to get into binary exploitation a bit more

But it's so hard to find something that I feel like is on my level

your local dc chapter or equivalent should be able to help with that

"Local" is nice if you live in the middle of nowhere, but I'll keep an eye out. YouTube is where I get most of my conference stuff from

@MechMK1 that works too, but obviously is a bit more removed

@RoryAlsop Yes of course, but personal attendance just isn't possible for me in my current situation

@MechMK1 fair enough

I've trouble with exposing information online for some reason, i want to share a block of personal information so it may be visible to entities on the internet, that appears on the right side of the returned search results

Does anyone have a whitepaper or information to done that?

@schroeder Is that process of publicity allied to the asking person?

@AreWeNotTooSmart I'm not sure what you are asking

@shroeder For example, if you lookup a person who is well known (like working for a company or local doctor)

Then that information is displayed by most of the browsers on the right side

Like in a Google search?

Yeah indeed.

you want to seed the search results so that particular info comes up?

Is this practically possible?

For Google, that's the Knowledge Panel

Let me Google that for you :P yoast.com/all-about-googles-knowledge-panels

This is very interesting.

I love people who don't even attempt at asking a question

@AreWeNotTooSmart thanks for the rabbit hole ....

I wish there was some boilerplate text or copypasta that basically tells people we're not here to work for them

Or more concisely: "We provide answers, not solutions."

What exactly is your stance on questions that could easily be googled?

Something akin to "What does XSS stand for?"

Where you could literally copy/paste the question title into google and would get a good answer

@MechMK1 we have a meta question for this. This question gets asked about once a year in a new meta exploration.

I am aware, and actually why I came here

Because I wanted to get people's individual views, rather than a community consensus

And I think it makes a difference if a question mentions stuff like "I searched for X, but all I could find where things related to Y"

Every time I probe those situations, they were not searching for X. I have asked people to post their search terms, and they are nothing like what they post.

If I can google the title of the post and get an answer in under 3 minutes, then I shut it down. Because, I mean, c'mon

I absolutely agree with you on that

BUT, I have done this exercise and it took me a while. And that, to me, is legit.

even when I am sure that something is searchable

I mean, I would also agree if someone were to say that results came out inconclusive

And then cite the results, and why they would conflict with each other

er, then that's a different problem and not a "searchable" problem. The question would be phrased differently

I'm totally cool with that, and that's a legit reason to post

"A says X, but B says Y. How do I apply this knowledge to my situation?"

Yes, same here. Any effort prior asking a question evokes infinitely more willingness to help

even if it's totally obvious, they did the work, analysed the situation, and need help

Yes, and depending on the topic, it's difficult to tell knowledgable people apart from total quacks coughtime.aicough

"simple" or "obvious" questions are fine. But not when the question is searchable. "We are not a replacement for google"

Some would consider this desirable

I disagree with it though. Stack Exchange should be high quality

What about questions that are good but insanely hard to understand

yeah, it becomes a quality thing, and somethign that the community needs to review on occasion

And let's face it: Users who ask questions such as "What does XSS mean?" are usually not those who end up crating high quality content

@AreWeNotTooSmart Depends. Usually, good questions can be phrased in a way that makes them understandable.

Some questions can be so extremely specific though, that they are not "not understandable" because they are written poorly, but because they require so much in-depth knowledge, that you don't even know what's happening

For me, a good example is Electrical Engineering. I have no idea about electronics, and I could not tell a good question from a bad one, aside form horrible formatting.

But the question body can be written in a way that makes the overall very complex

Then it should be edited to be more clear

provide context where necessary, remove unnecessary clutter

For example, when I worked in a team in an open-source project, we used to get a lot of bug reports from people who were not necessarily programmers

That's an option

And some of the reports included so much excruciating detail, for something as simple as a spelling mistake

@AreWeNotTooSmart that's where I spend most of my time here: getting to understand the question that wants to be asked and guiding the post to that point

The report could just have been: "In the German localization, the phrase "Status berichten" sounds unintuitive and should be replaced by "Status absenden", yet they choose to explain their windows version, what GPU they have, a full DXDIAG log, etc.

@schroeder And if I could upvote edits, I would

@MechMK1 lol

I'm serious. Some questions are like digging through a pile of dirt to recover a pebble

Broken english, lots of unimportant data, lots of completely unrelated gibberish, "I heard from my friend that...", etc.

And then suddenly an edit and the question is readable

@MechMK1, That's dutch rather than german, mag ik nog een blikje bier

But by far my favourite are people who just randomly mark some words as bold for absolutely no reason at all, presumably because they saw that the editor supported it, and they felt obligated to use it.

@AreWeNotTooSmart "I want a little bit of beer?"

blikje is not really obvious to me, but the rest seems readable for me

@MechMK1 I appreciate the appreciation. I can get a ton of flack for it. I remember the Americal "technical writer" who blew up that I dared to edit a ... long ... post and inadvertently used UK spelling on a word.

@schroeder Oh no, such rude behavior from this particular gentleman

Some people just take themselves way too seriously

And I understand it. When I first came to StackOverflow, I hated when my questions got edited instantly. I was like "What? Was my question not good enough for you?"

back then I had this assumption that edits were only necessary if my question was really really bad

@AreWeNotTooSmart Here's a really short list of advice (in a too-long video) on how one guy did it: youtu.be/iWpaHumMxAY

Did you just update your profile picture? Man, everybody is so serious about things these days :D

@MechMK1 who? what pic?

dang - mine????

what did I mess up?

Good thing I noticed, huh?

yes, thank you

No worries

In regards to people raging, I had some fun on Super User a bit ago

Some guy had Wi-Fi problems, and someone suggested that the broadcom card in his laptop was to blame, so he wrote a long answer that was 40% broadcom rant, 40% intel advertisement and 20% guide on how to switch cards.

I edited the answer to remove 80% of it and he completely lost it

Called me a "Broadcom Shill", etc...

lol

ok - profile pic back to normal

Not the same as before :( [sadness]

should be exactly the same

Don't think so, but I could be wrong

I assume you conducted some gravatar shenanigans?

Something somewhere ....

The hidden creed of the DMZ: Some things are better left unspoken.

the DMZ is not updated :(

Probably a caching thing

ta

@schroeder Fine again for me

@MechMK1 and now for me - thanks for the notice

and you're right, it looks ... different

I'll have a look at the archive

Man google is scary. I feel like I'm about to dox you even though I am just looking for an anime picture

lol

web.archive.org/web/20180201060759im_/https://www.gravatar.com/…

This is the old screenshot

ah - cool - thanks for grabbing that

I'm happy to be public, for me, but I don't want to co-mingle my work with personal stuff. Although that line might be flexing soon.

I completely understand you

There's a reason why I chose to use MechMK1 and not Andrew O'Neil

Which is a very on-the-nose pseudonym as well, in case you were wondering :D

Likewise, A. Hersean is a pseudonym. My real name is Inigo Montoya. You killed my father, prepare to die.

lol

In all honesty, I could just use my real name as well. Not like I am of any interest to anyone anyways

You probably took the screenshot yourself, judging by the extreme non-cooperation from google

@MechMK1 Not yet. But it's a bet on the future. You do not know how your life will be in 10 years, even less 20. But internet might remember. And if you know a bit of how police investigations works, you know that anything can be used against you, even legitimate, mundane stuff. Replace "police" by someone who came to hate you for whatever absurd reason, and you get a strong incentive to stay pseudonymous.

I am so royally screwed anyways if someone were to dig up my past. I did things I am not proud of today

Not even things that would make a funny story in 20 years

I deeply regret my past, and it keeps haunting me

That's not a reason to add stuff on your plate, when that can be avoided effortlessly.

forgiving yourself is hard

I know, man...

If I could go back, I'd make the last 10 years undone

Feels weird, given that I am just 25

But I made so many mistakes

And all of them are recorded, somewhere on the net

Nothing to be done about it. Time heals all wounds, you just need enough of it

If you regret it, that's good. It means that you learned the lesson. That makes you a better person now. And you cannot change the past. So instead of looking at it like a dead weight, look at it as a foundation for who you are now, and who you might become because of it.

(I know that's easy for me to say, less for you to do it.)

I've mostly had closure with the things I have done. I feel like I had suffered enough. It's more the fear that it might come back, some day

Someone googling my name, finding a link to an archive, etc...

And if you should find it one day, then just remember that I'm different now

Anyways, I'm done with my job for today. I'll be heading home now, cook some nice dinner and play Remnant: From The Ashes

Good game, but the artstyle is a complete mess

Like if Fortnite and Metro 2033 had a baby

@MechMK1 I enjoy Metro, but fortnite does nothing for me. It's like a more annoying pubg

I'm tempted to get remnant though

@MechMK1 Hey man, I don't judge.