6 ms·

Actually his write up makes pretty clear that he didn't use his company email until after Alex went over his head to the CEO. Second, everything else being equ

Actually his write up makes pretty clear that he didn't use his company email until after Alex went over his head to the CEO. Second, everything else being equal, Alex going to the CEO without calling or mailing the researcher first was a mistake. Going to someone's boss and saying "please do something, I don't want to get the lawyers involved" IS an implicit legal threat, both to synack and the researcher.

tptacek 11y ago
I like how we're talking about Stamos warning a guy running around with stolen AWS credentials for all of Instagram in the same fashion as we'd talk about a DMCA threat. "Implicit legal threat"? There's nothing "implicit" or subtle about what was happening here.
- yarou 11y ago
  Then why the immediate escalation? Wouldn't it have made more sense to contact the researcher directly, rather than using his position of power to pressure the researcher's company's CEO? Why not assume good faith? (Which is what I would think a white hat bug bounty program should assume)
- blazespin 11y ago
  LAUGH .. I love it, even his staunch defender friend says he's lying: " I did not threaten legal action against Synack or Wes " https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics/10153799951452929 https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...
- ossreality 11y ago
  I get your point in these threads, but unless I'm misunderstanding, who cares about stolen, potentially undeleted Amazon creds? Revoke the key in the portal and be done with it? Given who I'm replying to, I'm assuming that I'm missing some key piece of the puzzle. (And I totally acknowledge it doesn't change the circumstances of what either side has done, I'm just curious)
  - argonaut 11y ago
    The point is, having those is a prosecute-able offense, if Facebook chose to prosecute. So it's a big threshold to cross legally, even if not meaningful from a programmer's perspective.
    - sangnoir 11y ago
      Facebook's terms say they will not prosecute /report whitehats to law-enforcement. Facebook could prosecute, at the price of some goodwill from the security industry (or part of it). I'm sure a competent lawyer to mount a robust defence for the security researcher (beyond reasonable doubt, IMO).
      - argonaut 11y ago
        You're missing my point and talking about something entirely different from what I'm talking about. I'm not talking about whether Facebook will prosecute and what the consequences of that will be (whether they'll win or lose whatever). I'm just pointing out that taking AWS keys is a big deal, because it's legally a big deal.
        sangnoir 11y ago
        Facebook's disclosure policy reads: >If you give us reasonable time to respond to your report before making any information public, and make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service during your research, we will not bring any lawsuit against you or ask law enforcement to investigate you. IANAL: but it could be argued (in court) that he had Facebook's permission to getting the AWS keys. In his opinion (and mine) he made good faith efforts to avoid privacy violations. Facebook's official disclosure policy has legal weight. There is legal concept (whose name is escaping me) that could apply that in laymen's terms say the official disclosure policy gives him Facebook's tacit approval - I first heard about it in the Oracle v Google where Google argued a blog post congratulating Google provided tacit approval.
- brazzledazzle 11y ago
  You seem levelheaded throughout the thread and make good points more articulately than I ever could but this seems a bit emotionally involved. It's possible that we're all correct: This guy could be a wildcard researcher that plays fast and loose and the CSO could be covering his own ass. You say he's building a first rate application security team. Is it hard to believe that he could have made the mistake of focusing almost exclusively on that?
yeukhon 11y ago
I am not sure what part of "he has interacted with us using a synack.com email address," invalidates my reading that he was using his company's email?
- hectormalot 11y ago
  Bottom of his post he replies to Alex his post: > I never contacted Facebook or Alex using my work email account. It was only after Alex contacted my employer via email that I sent a reply from my work account. Alex indirectly contacted me at work, not the other way around. If that is true, it is either poor judgement from Alex, or bad intent to call Synack
- brazzledazzle 11y ago
  It says nothing about who initiated contact using his company email address. It could have said, "he contacted us using" or "his facebook account was associated with" but instead it says "he has interacted with us using". Sometimes what's not said tells us as much if not more.
brazzledazzle 11y ago
What Alex wrote is a bit interesting given his update (emphasis my own): >At this point, it was reasonable to believe that Wes was operating on behalf of Synack. His account on our portal mentions Synack as his affiliation, he has interacted with us using a synack.com email address, and he has written blog posts that are used by Synack for marketing purposes. According to Alex this is the timeline: 1. Researcher not happy with sum 2. Researcher already in contact using Synack email address 3. Alex calls Synack CEO From the researcher's blog: >I never contacted Facebook or Alex using my work email account. It was only after Alex contacted my employer via email that I sent a reply from my work account. Alex indirectly contacted me at work, not the other way around. This means that Alex is lying, is telling exactly the facts needed to come to a specific conclusion and nothing more or the researcher is lying. And he's "written blog posts that are used by Synack"? Come now. Reads a lot like someone looking for a third item so they can make it a comma separated list of reasons. His post smells like bullshit.

tptacek 11y ago

I like how we're talking about Stamos warning a guy running around with stolen AWS credentials for all of Instagram in the same fashion as we'd talk about a DMCA threat. "Implicit legal threat"? There's nothing "implicit" or subtle about what was happening here.

yarou 11y ago
Then why the immediate escalation? Wouldn't it have made more sense to contact the researcher directly, rather than using his position of power to pressure the researcher's company's CEO? Why not assume good faith? (Which is what I would think a white hat bug bounty program should assume)
blazespin 11y ago
LAUGH .. I love it, even his staunch defender friend says he's lying: " I did not threaten legal action against Synack or Wes " https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics/10153799951452929 https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...
ossreality 11y ago
I get your point in these threads, but unless I'm misunderstanding, who cares about stolen, potentially undeleted Amazon creds? Revoke the key in the portal and be done with it? Given who I'm replying to, I'm assuming that I'm missing some key piece of the puzzle. (And I totally acknowledge it doesn't change the circumstances of what either side has done, I'm just curious)
- argonaut 11y ago
  The point is, having those is a prosecute-able offense, if Facebook chose to prosecute. So it's a big threshold to cross legally, even if not meaningful from a programmer's perspective.
  - sangnoir 11y ago
    Facebook's terms say they will not prosecute /report whitehats to law-enforcement. Facebook could prosecute, at the price of some goodwill from the security industry (or part of it). I'm sure a competent lawyer to mount a robust defence for the security researcher (beyond reasonable doubt, IMO).
    - argonaut 11y ago
      You're missing my point and talking about something entirely different from what I'm talking about. I'm not talking about whether Facebook will prosecute and what the consequences of that will be (whether they'll win or lose whatever). I'm just pointing out that taking AWS keys is a big deal, because it's legally a big deal.
      - sangnoir 11y ago
        Facebook's disclosure policy reads: >If you give us reasonable time to respond to your report before making any information public, and make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service during your research, we will not bring any lawsuit against you or ask law enforcement to investigate you. IANAL: but it could be argued (in court) that he had Facebook's permission to getting the AWS keys. In his opinion (and mine) he made good faith efforts to avoid privacy violations. Facebook's official disclosure policy has legal weight. There is legal concept (whose name is escaping me) that could apply that in laymen's terms say the official disclosure policy gives him Facebook's tacit approval - I first heard about it in the Oracle v Google where Google argued a blog post congratulating Google provided tacit approval.
brazzledazzle 11y ago
You seem levelheaded throughout the thread and make good points more articulately than I ever could but this seems a bit emotionally involved. It's possible that we're all correct: This guy could be a wildcard researcher that plays fast and loose and the CSO could be covering his own ass. You say he's building a first rate application security team. Is it hard to believe that he could have made the mistake of focusing almost exclusively on that?

yeukhon 11y ago

I am not sure what part of "he has interacted with us using a synack.com email address," invalidates my reading that he was using his company's email?

hectormalot 11y ago
Bottom of his post he replies to Alex his post: > I never contacted Facebook or Alex using my work email account. It was only after Alex contacted my employer via email that I sent a reply from my work account. Alex indirectly contacted me at work, not the other way around. If that is true, it is either poor judgement from Alex, or bad intent to call Synack
brazzledazzle 11y ago
It says nothing about who initiated contact using his company email address. It could have said, "he contacted us using" or "his facebook account was associated with" but instead it says "he has interacted with us using". Sometimes what's not said tells us as much if not more.

brazzledazzle 11y ago

What Alex wrote is a bit interesting given his update (emphasis my own): >At this point, it was reasonable to believe that Wes was operating on behalf of Synack. His account on our portal mentions Synack as his affiliation, he has interacted with us using a synack.com email address, and he has written blog posts that are used by Synack for marketing purposes. According to Alex this is the timeline: 1. Researcher not happy with sum 2. Researcher already in contact using Synack email address 3. Alex calls Synack CEO From the researcher's blog: >I never contacted Facebook or Alex using my work email account. It was only after Alex contacted my employer via email that I sent a reply from my work account. Alex indirectly contacted me at work, not the other way around. This means that Alex is lying, is telling exactly the facts needed to come to a specific conclusion and nothing more or the researcher is lying. And he's "written blog posts that are used by Synack"? Come now. Reads a lot like someone looking for a third item so they can make it a comma separated list of reasons. His post smells like bullshit.