3 ms·
Assuming that's true (and I personally don't believe Stamos would flagrantly fabricate a detailed story like this publicly), this is a game changer. It's fully
by dsacco 11y ago
Assuming that's true (and I personally don't believe Stamos would flagrantly fabricate a detailed story like this publicly), this is a game changer. It's fully reasonable to escalate to an employer if they seem to be affiliated with the security researcher's report.
Also worth noting that this is frequently done in the security industry - folks will often credit not only themselves but also the companies they work with and are associated with in a security report.
- blazespin 11y agoNo, Alex just assumed. Why didn't he just ask Wes if he was doing this for Synack?
- tptacek 11y agoHe "assumed" because the researcher signed up for the Facebook bounty program as an employee of Synack and used his Synack email to communicate with Facebook. He wasn't guessing. He didn't look the guy up on LinkedIn.
- thaumasiotes 11y ago> He didn't look the guy up on LinkedIn. I don't really see how else you can interpret the defense "he has written blog posts that are used by Synack for marketing purposes". And it's pointed out all over the thread, but no part of "the researcher signed up for the Facebook bounty program as an employee of Synack and used his Synack email to communicate with Facebook" is uncontested, nor is it supported by the text of Alex Stamos' response. You've just read in what you want to see.
- sangnoir 11y ago> At this point, it was reasonable to believe that Wes was operating on behalf of Synack > He "assumed" because the researcher signed up for the Facebook bounty program as an employee of Synack and used his Synack email to communicate with Facebook. He wasn't guessing. He didn't look the guy up on LinkedIn This is a load of bolony / ass-covering by Alex - Facebook's bounty program explicitly deals with individuals only, not companies and Alex knows this. From https://www.facebook.com/whitehat/ https://www.facebook.com/whitehat/ > We only pay individuals edit: down-voters, please point out the faults in my logic.
- easuter 11y agoFrom Wes' updated post: > I never contacted Facebook or Alex using my work email account. It was only after Alex contacted my employer via email that I sent a reply from my work account. Alex indirectly contacted me at work, not the other way around.
- Artemis2 11y agoWhy not ask directly Wes if he is working on the behalf of his company? Seems shady at least to resort immediately to his employer.