3 ms·

"This bug has been fixed, the affected keys have been rotated, and we have no evidence that Wes or anybody else accessed any user data."

Alupis 11y ago
Because of the sequence of events that played out...
- eastonhockey19 11y ago
  Yes and he got paid for it.
  - Alupis 11y ago
    I'm not quite sure I understand your point? Of course he got paid, that's how bug bounties work... that doesn't detract in any way from the point I made above.
    - eastonhockey19 11y ago
      And I don't understand yours. You were concerned about other people other than Wes accessing the same data via the same flaw, Alex said that did not happen.
      - dandelany 11y ago
        Alex said they "have no evidence" it happened, which is classic slippery legalese. From that phrase it is reasonable to infer either that they have evidence of absence, or absence of evidence, which are not the same thing.
        eastonhockey19 11y ago
        It's standard wording for something like this even if they had 100% evidence of absence.
        dandelany 11y ago
        Correct. It's the standard wording, whether or not they actually have evidence. Therefore we cannot assume, as you have earlier in this thread, that they do in fact have it.
      - Dr_tldr 11y ago
        But until Wes told them, they had no evidence that Wes was accessing the data! Or are you saying that they did have evidence, but chose to take a "wait and see" approach to someone gaining control of their entire platform?
      - CRConrad 11y ago
        No, he claimed _not to have any evidence_ that it did happen. "Quick, shut off the logging on those servers, so we don't have any record of who logged in on them!"
grrowl 11y ago
> and we have no evidence that Wes or anybody else accessed any user data This raises way more questions than it answers. Most notably: why aren't you recording who accesses user data?
- nostalgiac 11y ago
  Reads to me that they are recording the access and no-one did access it.
  - lstamour 11y ago
    Not necessarily. If that were the case, wouldn't they use the stronger, "and we have evidence that no data was accessed through this exploit"? The fact is: They can't possibly protect user data once the private SSL keys leak. At that point anyone can intercept user data on third-party, non-Facebook servers if they're affiliated with an ISP, wifi hotspot or other point of access. Anyone could send targeted phishing emails for their servers: How would they know, if the SSL cert looks legit and the DNS is regionally poisoned?

Alupis 11y ago

Because of the sequence of events that played out...

eastonhockey19 11y ago
Yes and he got paid for it.
- Alupis 11y ago
  I'm not quite sure I understand your point? Of course he got paid, that's how bug bounties work... that doesn't detract in any way from the point I made above.
  - eastonhockey19 11y ago
    And I don't understand yours. You were concerned about other people other than Wes accessing the same data via the same flaw, Alex said that did not happen.
    - dandelany 11y ago
      Alex said they "have no evidence" it happened, which is classic slippery legalese. From that phrase it is reasonable to infer either that they have evidence of absence, or absence of evidence, which are not the same thing.
      - eastonhockey19 11y ago
        It's standard wording for something like this even if they had 100% evidence of absence.
        dandelany 11y ago
        Correct. It's the standard wording, whether or not they actually have evidence. Therefore we cannot assume, as you have earlier in this thread, that they do in fact have it.
    - Dr_tldr 11y ago
      But until Wes told them, they had no evidence that Wes was accessing the data! Or are you saying that they did have evidence, but chose to take a "wait and see" approach to someone gaining control of their entire platform?
    - CRConrad 11y ago
      No, he claimed _not to have any evidence_ that it did happen. "Quick, shut off the logging on those servers, so we don't have any record of who logged in on them!"

grrowl 11y ago

> and we have no evidence that Wes or anybody else accessed any user data This raises way more questions than it answers. Most notably: why aren't you recording who accesses user data?

nostalgiac 11y ago
Reads to me that they are recording the access and no-one did access it.
- lstamour 11y ago
  Not necessarily. If that were the case, wouldn't they use the stronger, "and we have evidence that no data was accessed through this exploit"? The fact is: They can't possibly protect user data once the private SSL keys leak. At that point anyone can intercept user data on third-party, non-Facebook servers if they're affiliated with an ISP, wifi hotspot or other point of access. Anyone could send targeted phishing emails for their servers: How would they know, if the SSL cert looks legit and the DNS is regionally poisoned?