Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

> Also make sure the people who hire you actually own the system being tested.

I feel like an alternative take on this is “inform the local police department of your plans”



Yes. I don’t understand why this isn’t part of the game plan. I understand not informing the patrol level of the police dept, but I do t see how informing the admin above does. The deputy chief is not involved in the management of an enforcement patrol/stop.


Reaction time of the local police department might be part of the test.


Unless you're hired by the chief of police, that sounds very close to testing a system - the police - without the permission of the owner?

And there are safer ways to find the police's reaction time than having them turn up with guns drawn, finding signs of forced entry, and finding you - a non-employee - sneaking around with burglary tools.

For example, you could make a FOIA request for their internal records, ask a local journalist - or if you insist on a real-world test, have the alarm 'accidentally' tripped by a legitimate employee arriving for work early.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: