4 ms·

Harvard student loses Facebook internship after pointing out privacy flaws

55 points by huac 11y ago

kelukelugames 11y ago
The moral of the story is never upset your employer. Being right doesn't matter.
- voxic11 11y ago
  Eh it sounds like he ended up getting at least as much experience as he would have at facebook, and he did some public good too.
- mehrdada 11y ago
  FB wasn't his employer, yet. Actually, the moral of the story, as I see it, is these days you can upset whoever you want as long as you are a good engineer. He got another job; probably less boring than a random internship offered to hundreds of people. Do the right thing.[1] [1]: http://paulgraham.com/good.html http://paulgraham.com/good.html
  - argonaut 11y ago
    Yes, which is why they didn't fire him, they only rescinded his offer. Also, "probably?" We have no idea. It sounds like you're just trying to justify the intern's actions.
- mindcrime 11y ago
  > The moral of the story is never upset your employer. How did you arrive at that conclusion? Losing an internship at Facebook isn't exactly the end of the world. > Being right doesn't matter. It does to some people, some of the time. Jobs come and go, and you can't always control that. But you can control your own principles, integrity and dignity.
  - kelukelugames 11y ago
    Thanks for pointing that out. I should have written "If you want to keep your job then never upset your (future) employer."
nso95 11y ago
Can you really call it a flaw when they did it on purpose?
nickpsecurity 11y ago
A bit ironic given Zuckerberg's own actions at his University.
- stephenr 11y ago
  This isn't irony, it's hypocrisy.
  - nickpsecurity 11y ago
    Agreed
stephenr 11y ago
Yeah, this is hardly surprising. Facebook and Zuckerberg honestly are a good example of "Do as I say not as I do". Facebook doesn't track your location constantly so you can know where your wife or sister is when you message them - they track you so they can serve you ads. It's good to hear that he got a job somewhere else, but honestly I would question the morals/ethics/human decency/whatever you want to call it, of anyone that would go to work for Facebook, given how user-hostile the company is when it comes to privacy.
- craftkiller 11y ago
  I wouldn't question their ethics since Facebook isn't exactly invading your privacy, you're giving away your privacy by using them. This isn't like Lenovo or the NSA spying on you since in those instances there was a reasonable expectation of privacy. Facebook is a platform designed around you sharing as much information as possible, so it should be assumed they're tracking your location to advertise at you.
  - stephenr 11y ago
    Facebook don't invade my privacy because I don't use it. However there are numerous cases where people have been caught out because Facebook was sharing information they expected to be private or limited to their friends. Yes there is an aspect of personal responsibility here, but there is also a strong aspect of basic human decency which is pretty much at odds with Facebook's business model. Good companies don't ask "what information can we get from users and how can we make money from it?" Good companies ask "what is the minimum amount of information we can collect to provide our product/service. OK, are we sure we need that much? How do we protect that information?"
apetresc 11y ago
That seems fine. This wasn't a responsible security disclosure, they're not punishing a whistleblower. Publishing an extension to the Chrome Web Store that lets anyone exploit the bug is NOT the responsible way for anyone to "highlight" a security issue unless normal channels have repeatedly failed (which was not the case here), let alone someone who is working for them.
Mikushi 11y ago
>this mapping tool scraped Facebook data in a way that violated our terms, and those terms exist to protect people’s privacy and safety Really? They're not even trying at Facebook anymore. Terms mean jack shit to a malicious attacker, which is exactly who would exploit such appalling code.
- argonaut 11y ago
  It's hardly an exploit. All it really is is a feature that this guy happened to disagree with, and he demonstrated his disagreement by showing how it could be used to track your location on a map. To "exploit" this, you the user would have to proactively send chat messages over a prolonged period of time to the "attacker," so I hardly call this an attack.

55 points by huac 11y ago

kelukelugames 11y ago

The moral of the story is never upset your employer. Being right doesn't matter.

voxic11 11y ago
Eh it sounds like he ended up getting at least as much experience as he would have at facebook, and he did some public good too.
mehrdada 11y ago
FB wasn't his employer, yet. Actually, the moral of the story, as I see it, is these days you can upset whoever you want as long as you are a good engineer. He got another job; probably less boring than a random internship offered to hundreds of people. Do the right thing.[1] [1]: http://paulgraham.com/good.html http://paulgraham.com/good.html
- argonaut 11y ago
  Yes, which is why they didn't fire him, they only rescinded his offer. Also, "probably?" We have no idea. It sounds like you're just trying to justify the intern's actions.
mindcrime 11y ago
> The moral of the story is never upset your employer. How did you arrive at that conclusion? Losing an internship at Facebook isn't exactly the end of the world. > Being right doesn't matter. It does to some people, some of the time. Jobs come and go, and you can't always control that. But you can control your own principles, integrity and dignity.
- kelukelugames 11y ago
  Thanks for pointing that out. I should have written "If you want to keep your job then never upset your (future) employer."

nso95 11y ago

Can you really call it a flaw when they did it on purpose?

nickpsecurity 11y ago

A bit ironic given Zuckerberg's own actions at his University.

stephenr 11y ago
This isn't irony, it's hypocrisy.
- nickpsecurity 11y ago
  Agreed

stephenr 11y ago

Yeah, this is hardly surprising. Facebook and Zuckerberg honestly are a good example of "Do as I say not as I do". Facebook doesn't track your location constantly so you can know where your wife or sister is when you message them - they track you so they can serve you ads. It's good to hear that he got a job somewhere else, but honestly I would question the morals/ethics/human decency/whatever you want to call it, of anyone that would go to work for Facebook, given how user-hostile the company is when it comes to privacy.

craftkiller 11y ago
I wouldn't question their ethics since Facebook isn't exactly invading your privacy, you're giving away your privacy by using them. This isn't like Lenovo or the NSA spying on you since in those instances there was a reasonable expectation of privacy. Facebook is a platform designed around you sharing as much information as possible, so it should be assumed they're tracking your location to advertise at you.
- stephenr 11y ago
  Facebook don't invade my privacy because I don't use it. However there are numerous cases where people have been caught out because Facebook was sharing information they expected to be private or limited to their friends. Yes there is an aspect of personal responsibility here, but there is also a strong aspect of basic human decency which is pretty much at odds with Facebook's business model. Good companies don't ask "what information can we get from users and how can we make money from it?" Good companies ask "what is the minimum amount of information we can collect to provide our product/service. OK, are we sure we need that much? How do we protect that information?"

apetresc 11y ago

That seems fine. This wasn't a responsible security disclosure, they're not punishing a whistleblower. Publishing an extension to the Chrome Web Store that lets anyone exploit the bug is NOT the responsible way for anyone to "highlight" a security issue unless normal channels have repeatedly failed (which was not the case here), let alone someone who is working for them.

Mikushi 11y ago

>this mapping tool scraped Facebook data in a way that violated our terms, and those terms exist to protect people’s privacy and safety Really? They're not even trying at Facebook anymore. Terms mean jack shit to a malicious attacker, which is exactly who would exploit such appalling code.

argonaut 11y ago
It's hardly an exploit. All it really is is a feature that this guy happened to disagree with, and he demonstrated his disagreement by showing how it could be used to track your location on a map. To "exploit" this, you the user would have to proactively send chat messages over a prolonged period of time to the "attacker," so I hardly call this an attack.