I disagree. A security researcher went public with a story of "I found this massive security hole and Facebook tried to avoid paying what I thought it was wort

I disagree. A security researcher went public with a story of "I found this massive security hole and Facebook tried to avoid paying what I thought it was worth, and then threatened me with legal action" The response that Alex thinks he needs to make is "my actions were reasonable because ..." From external appearances it seems as though he is more concerned about looking like a heavy-handed, lawyer-invoking, CSO than the publicity around FB having an unpatched RCE that allowed access to highly-privileged AWS keys. What he chooses to write about is reflection of what he saw as the most important news in the original blog post. I suspect he's actually right. The blog post will probably raise more bad publicity around the way FB handled the research & disclosure than the existence of the bug, and it's the piece that needs to be resolved well.