homakov

That means that Homakov was likely not breaking the law, and you would expect starbacks to be more welcoming of the report.

Git has nothing to do with it: A while ago Homakov had an exploit that gave him write privileges to all GitHub repos.

If some Russian kid decides to mess with it like Homakov did a while back, we are all screwed.

Also, in the interest of full disclosure, I should state that my team has interacted with Homakov on a number of Chrome vulnerability reports.

I know Homakov is very talented, I really like his work!

Personally, while I feel that Igor Homakov has done good work, this article is the product of frustration and is a disservice to its audience.

> But Homakov seems to act as if he had some special ethical and legal right to make the fraudulent purchase, even though Starbucks had never asked for his security services.

If they then make a minor fuckup on the backend (say, forget to update OpenSSL in heartbleed-times, or look past that newest Rails vuln Egor Homakov found, or look over an intern-created SQL injection in a code review, etc), then the harm is smaller because there's simply no plaintext ever in memory on the server.

In the comments Homakov mentions that the $15 and $5 figures have been "adjusted for simplicity".

My problem is this line: "As a professional penetration tester, Homakov knows better than most people that hackers should never access someone else's computer network or account without explicit permission." He did neither of this.

The minimum amount of work you have to do to write an implementation that complies with the spec leaves you open to all sorts of security issues (as Homakov continues to detail), no two providers implement the same parts of the spec so writing clients isn't really all that easy, and the "security" features don't really seem all that secure.

However, the core issue is that people raising them are usually ignored until there's an embarrassing hack or demonstration (Homakov).

Homakov made his report today and they'll patch these bugs but did he get them all?

Homakov is perhaps willing to guide the transition.