I disagree. This was not a security vulnerability; this was just a poor product decision made by Facebook (that had major privacy implications). The phrasing of

I disagree. This was not a security vulnerability; this was just a poor product decision made by Facebook (that had major privacy implications). The phrasing of their update a few weeks later supports that it was a conscious product decision since the beginning. This developer highlighted a privacy issue with Facebook's product with a public proof of concept - it's no different than other proofs of concept built by the EFF et al. Facebook decided to react to it by being idiots, but that's not too surprising anymore from their behalf.