4 ms·

How about: I learned that responsible disclosure can both improve user privacy and prevent bad publicity for my company?

by andor 11y ago

DanBC 11y ago
> This wasn’t a new concern: In 2012, CNET had brought this issue to Facebook’s and the public’s attention.
CydeWeys 11y ago
Yup. He seems too young and idealistic. Of course you don't publicly release anything that is damaging to your employer. That should never even have occurred to him. Companies have these kinds of training all the time. Maybe if he'd lasted long enough to actually get to the internship he would've learned it. I'm glad that he noticed the privacy flaw, but someone who is about to become an employee of Facebook is the worst person to publicly release it. Maybe the notoriety he's gained from this will be worth it in the end, but I know a lot of companies probably won't want anything to do with him given the (lack of) judgment he's demonstrated from this.
- ivraatiems 11y ago
  > Of course you don't publicly release anything that is damaging to your employer. I think that is a really, really dangerous line of thinking. Sometimes, employers do bad things. Sometimes (perhaps often), there is not a satisfactory way to rectify those bad things within the company. Sometimes, what's good for the public outweighs what's good for your employer. It is absolutely reasonable to have a conscience and say "wait, this isn't something I can let slide." Now, did that happen here? I'm not sure. This individual made a judgment call, as you said. I don't know if I would have made the same call. But I simply don't feel that loyalty to one's employer is as important a value as privacy or safety. If that makes me unhireable in Silicon Valley, I guess I don't want to work in Silicon Valley.
- eternalban 11y ago
  > .. Companies have these kinds of training all the time. Two broad category of workers emerge from elite institutions. > .. (lack of judgement) he's demonstrated .. Well, to this reader (at least) our fellow geek here has established which of the above subset of workers he belong to. You're correct that he has demonstrated that he is unfit for say the Facebooks, GoldmanSachs, Googles, ... of the world. But who knows? Possibly Aran Khanan will follow up with his debut [1] and become a future LEADER in this space. [1]: http://techscience.org/a/2015081101/ http://techscience.org/a/2015081101/
jessedhillon 11y ago
Responsible disclosure of what? He didn't discover a new exploit, he designed a tool for visualizing conversations.
jlarocco 11y ago
I don't think that's so clear cut. The leak was publicized in 2013 by somebody else, and it wasn't fixed for two years until the events in this article. Clearly Facebook didn't think it was a bug or a security issue, or they wouldn't have taken two years to fix it. IMO the kid dodged a bullet when the internship was rescinded. Looks like hubris and shitty company culture, and he can probably get something better.
patcheudor 11y ago
Yes! Yes! and Yes! Facebook offers a bug bounty program, use it! I just did and got paid $2000 this month for reporting a crypto related flaw. The thing is, if a company offers a bounty program and you choose to go around it and publicly disclose you are sort of a jerk and to more than just the company. Another researcher had already found and reported the bug. Facebook was already working on a fix. The researcher was likely waiting for the terms of the bug bounty program to be met so they could then publish and spin it into a Black Hat, DEF CON, CanSec talk, then this kid comes along and takes the thunder. That's a real dick move.
- discardorama 11y ago
  > Facebook offers a bug bounty program, use it! How is this a bug? It's a feature of FB Messenger! He didn't have to exploit any bugs to get at the data. He just took what FB gave him and displayed it on a map. Why would this be eligible for a bug bounty?
- anon8418 11y ago
  Yes, the college student is the real dick here... As others have mentioned, the security issue the student highlighted was a known issue. I think going through official channels is the right thing to do for mission critical zero day type of vulnerabilities. Bringing increased attention to a known, unfixed, issue, doesn't seem like a jerk move to me.
raesene9 11y ago
I don't think so in this case. The company knew about the feature (per the story they were informed in 2012) so private disclosure would have likely gone nowhere. This is another sad example in a long list of security/privacy issues that only gets fixed by what sometimes gets called "stunt hacking" or flashily disclosing the issue. Take android security patching as a great example. Security pros have been lamenting the lack of a security patch process on android for years and years, Samsung et al have done very little about it. Now Stagefright comes along and gets the press and all of a sudden Samsung are committing to regular security patches.. Another good example is the car hacking stuff that Chris Valasek and Charlie Miller did. without the press furory around their release, do we think a recall would've happened for those cars... I don't think so. It's an unfortunate truth in security which is full disclousre gets the results that private disclosure often doesn't.

How about: I learned that responsible disclosure can both improve user privacy and prevent bad publicity for my company?

by andor 11y ago

How about: I learned that responsible disclosure can both improve user privacy and prevent bad publicity for my company?

DanBC 11y ago

> This wasn’t a new concern: In 2012, CNET had brought this issue to Facebook’s and the public’s attention.

CydeWeys 11y ago

Yup. He seems too young and idealistic. Of course you don't publicly release anything that is damaging to your employer. That should never even have occurred to him. Companies have these kinds of training all the time. Maybe if he'd lasted long enough to actually get to the internship he would've learned it. I'm glad that he noticed the privacy flaw, but someone who is about to become an employee of Facebook is the worst person to publicly release it. Maybe the notoriety he's gained from this will be worth it in the end, but I know a lot of companies probably won't want anything to do with him given the (lack of) judgment he's demonstrated from this.

ivraatiems 11y ago
> Of course you don't publicly release anything that is damaging to your employer. I think that is a really, really dangerous line of thinking. Sometimes, employers do bad things. Sometimes (perhaps often), there is not a satisfactory way to rectify those bad things within the company. Sometimes, what's good for the public outweighs what's good for your employer. It is absolutely reasonable to have a conscience and say "wait, this isn't something I can let slide." Now, did that happen here? I'm not sure. This individual made a judgment call, as you said. I don't know if I would have made the same call. But I simply don't feel that loyalty to one's employer is as important a value as privacy or safety. If that makes me unhireable in Silicon Valley, I guess I don't want to work in Silicon Valley.
eternalban 11y ago
> .. Companies have these kinds of training all the time. Two broad category of workers emerge from elite institutions. > .. (lack of judgement) he's demonstrated .. Well, to this reader (at least) our fellow geek here has established which of the above subset of workers he belong to. You're correct that he has demonstrated that he is unfit for say the Facebooks, GoldmanSachs, Googles, ... of the world. But who knows? Possibly Aran Khanan will follow up with his debut [1] and become a future LEADER in this space. [1]: http://techscience.org/a/2015081101/ http://techscience.org/a/2015081101/

jessedhillon 11y ago

Responsible disclosure of what? He didn't discover a new exploit, he designed a tool for visualizing conversations.

jlarocco 11y ago

I don't think that's so clear cut. The leak was publicized in 2013 by somebody else, and it wasn't fixed for two years until the events in this article. Clearly Facebook didn't think it was a bug or a security issue, or they wouldn't have taken two years to fix it. IMO the kid dodged a bullet when the internship was rescinded. Looks like hubris and shitty company culture, and he can probably get something better.

patcheudor 11y ago

Yes! Yes! and Yes! Facebook offers a bug bounty program, use it! I just did and got paid $2000 this month for reporting a crypto related flaw. The thing is, if a company offers a bounty program and you choose to go around it and publicly disclose you are sort of a jerk and to more than just the company. Another researcher had already found and reported the bug. Facebook was already working on a fix. The researcher was likely waiting for the terms of the bug bounty program to be met so they could then publish and spin it into a Black Hat, DEF CON, CanSec talk, then this kid comes along and takes the thunder. That's a real dick move.

discardorama 11y ago
> Facebook offers a bug bounty program, use it! How is this a bug? It's a feature of FB Messenger! He didn't have to exploit any bugs to get at the data. He just took what FB gave him and displayed it on a map. Why would this be eligible for a bug bounty?
anon8418 11y ago
Yes, the college student is the real dick here... As others have mentioned, the security issue the student highlighted was a known issue. I think going through official channels is the right thing to do for mission critical zero day type of vulnerabilities. Bringing increased attention to a known, unfixed, issue, doesn't seem like a jerk move to me.

raesene9 11y ago

I don't think so in this case. The company knew about the feature (per the story they were informed in 2012) so private disclosure would have likely gone nowhere. This is another sad example in a long list of security/privacy issues that only gets fixed by what sometimes gets called "stunt hacking" or flashily disclosing the issue. Take android security patching as a great example. Security pros have been lamenting the lack of a security patch process on android for years and years, Samsung et al have done very little about it. Now Stagefright comes along and gets the press and all of a sudden Samsung are committing to regular security patches.. Another good example is the car hacking stuff that Chris Valasek and Charlie Miller did. without the press furory around their release, do we think a recall would've happened for those cars... I don't think so. It's an unfortunate truth in security which is full disclousre gets the results that private disclosure often doesn't.