Ppl have been accused of crimes for pointing out, in a 100% white-hat way, that a site lets you access other ppl's accounts just by incrementing a number in the URL. No verification against it.

If someone abuses that maliciously? Sure, go after them. But these were honest security white-hats trying to warn, before scammers exploited it.

To be fair, being accused for that is exceptional, not normal. But it has happened. More than once!

With the below tangent ramble aside, I commend the person you know for their honesty. My plan if I were ever confronted was "nuh uh, the website did that by itself".

I assume it went nowhere, but how far did that accusation actually go before the accuser died of astronomical exposure to lead paint?

When I was at university, the online course registration system was entirely home-brewed. The core issue was that the implementation did not fully map to the registration rules laid out in the faculty handbooks.

e.g. if you were a fucking idiot like me and failed calc II in the second semester, you were not eligible for a whole bunch of fucking classes in the subsequent semesters

This was a big fuckup because it effectively extended the time you spent at university by at least one year.

You had to request (fucking beg for) special permission from every faculty's Dean and each department's head administrator if you wanted them to waive the calc 2 prerequisite for a course. (Which I painstakingly did)

You would still be unable to use the piece of shit e-registration system by conventional methods and needed to stand in a 4-8 hour long physical registration queue for the rest of undergrad during every registration period.

Conventional methods. I swear on my dog's life that I did not use the client side authentication to register for anything that was not permitted by the faculty handbook. Studied that shit harder than calc II (attempt 2).

I showed someone else how to do it and he instantly proceeded to register himself for a chemistry class that neither of us could pronounce. Still no clue why the fuck he did that.

Guy needed two days in the queue for administration to unfuck that "accident".

It always confuses the hell out of me when I see an ad from someone's phone or computer when showing me a YouTube video or something. It's so jarring that I feel like I got malware on my skin lol

What firewall rules do you implement that effectively blocks YouTube ads?