October 22nd: Weak passwords found and reported. Also grabbed the AWS keys from the config file. October 24th: Server no longer reachable. Tested keys and they

October 22nd: Weak passwords found and reported. Also grabbed the AWS keys from the config file. October 24th: Server no longer reachable. Tested keys and they still worked, assumed to have went on a download spree. Seems like this is the biggest issue with how Facebook handled this case. No one looked to see what Wes accessed when he logged in with the weak credentials? No one realized he could have accessed the AWS key? To treat what Wes found as a minor bug and then fuck up like that is sort of hilarious.