4 ms·

Here is what's happening right now: FB: He's an experienced bug bounty hunter and should know where reasonable borders are. All the experienced security guys

Here is what's happening right now: FB: He's an experienced bug bounty hunter and should know where reasonable borders are. All the experienced security guys itt: He's an experienced bug bounty hunter and should know where reasonable borders are or at least not pivot/escalate without asking. Also never dump and hold data. Everyone else: What he did isn't technically against the rules FB wrote, so they are screwing him, despite it also being written that they have sole discretion.

sangnoir 11y ago
> All the experienced security guys itt... Ah, so those who disagree are inexperienced? No true scottsman indeed!
- meowface 11y ago
  How is that a "no true scotsman"? Most people in this thread commenting have not indicated they work in the infosec industry. (For the record, I do, though I'm not sure I'd flatter myself by saying I'm "experienced" exactly.)
  - sangnoir 11y ago
    The problems I have with your absolute statement: * You are stating that all (not some) experienced security folks are agreeing unanimously. The implication is that those show disagree are not "experienced security guys" (as you called them: "everyone else") - they are the ones who aren't true scotsman * you assume those who don't explicitly indicate that they work in infosec industry do not work in the infosec industry * also, you do you need to be "experienced" in the infosec industry to be correct / wrong.
    - meowface 11y ago
      I wasn't the one who made the comment you're referring to. I'm just saying there is no evidence of a "no true Scotsman" here, as far as I can tell.
      - sangnoir 11y ago
        apologies - didn't notice you weren't OP. IMO, the "no true Scotsman" is implied (might be unintentional)
        meowface 11y ago
        The general theme of the thread seems to be security industry people, like tptacek (or commenters self-identifying as being in the industry), expressing concern with the researcher's actions (while still admitting Facebook didn't handle it well). The primarily negative comments don't seem to have a specific affiliation tied to them. And given HN's demographic, odds are much more of them are developers than are infosec people. I don't think the person you were replying to was suggesting that any infosec people who fully support the researcher aren't real infosec workers. I just don't think he saw any who even claimed to be.
        Retric 11y ago
        I disagree; this is non customer, non-financial data which is often considered fair game because downloading data is useful to locate many security bugs. Source code or config data is a prime target, but so is network diagrams etc. Defense in depth means every defense needs to be validated not just the outer layers. PS: Further, if FB says they know about a bug then anything he downloaded could easily be in the wild and should be investigated.
        voronoff 11y ago
        This. Literally every single person who identified themselves as in the security fields that I saw said the researcher went too far. What's really getting to me is the overwhelming number of responses containing idea that everything that isn't explicitly banned is permitted, despite the recipient saying "No" (even indirectly/without justification) at some point. How to deal with the grey area of consent is something that every adult should know, and it's worrying to me that so many here seem to feel entitled to whatever they can take as long as it wasn't explicitly forbidden. Obviously FB should update their policy, but at the same time it's important that we as the community use this as an opportunity to learn and discuss where the implicit boundaries are, where one needs clear-cut agreement to proceed. Consent is sexy.
meowface 11y ago
I'm a security guy and I think what he did towards the end is dubious and strange, but again, he was following their guidelines as written.

sangnoir 11y ago

> All the experienced security guys itt... Ah, so those who disagree are inexperienced? No true scottsman indeed!

meowface 11y ago
How is that a "no true scotsman"? Most people in this thread commenting have not indicated they work in the infosec industry. (For the record, I do, though I'm not sure I'd flatter myself by saying I'm "experienced" exactly.)
- sangnoir 11y ago
  The problems I have with your absolute statement: * You are stating that all (not some) experienced security folks are agreeing unanimously. The implication is that those show disagree are not "experienced security guys" (as you called them: "everyone else") - they are the ones who aren't true scotsman * you assume those who don't explicitly indicate that they work in infosec industry do not work in the infosec industry * also, you do you need to be "experienced" in the infosec industry to be correct / wrong.
  - meowface 11y ago
    I wasn't the one who made the comment you're referring to. I'm just saying there is no evidence of a "no true Scotsman" here, as far as I can tell.
    - sangnoir 11y ago
      apologies - didn't notice you weren't OP. IMO, the "no true Scotsman" is implied (might be unintentional)
      - meowface 11y ago
        The general theme of the thread seems to be security industry people, like tptacek (or commenters self-identifying as being in the industry), expressing concern with the researcher's actions (while still admitting Facebook didn't handle it well). The primarily negative comments don't seem to have a specific affiliation tied to them. And given HN's demographic, odds are much more of them are developers than are infosec people. I don't think the person you were replying to was suggesting that any infosec people who fully support the researcher aren't real infosec workers. I just don't think he saw any who even claimed to be.
        Retric 11y ago
        I disagree; this is non customer, non-financial data which is often considered fair game because downloading data is useful to locate many security bugs. Source code or config data is a prime target, but so is network diagrams etc. Defense in depth means every defense needs to be validated not just the outer layers. PS: Further, if FB says they know about a bug then anything he downloaded could easily be in the wild and should be investigated.
        voronoff 11y ago
        This. Literally every single person who identified themselves as in the security fields that I saw said the researcher went too far. What's really getting to me is the overwhelming number of responses containing idea that everything that isn't explicitly banned is permitted, despite the recipient saying "No" (even indirectly/without justification) at some point. How to deal with the grey area of consent is something that every adult should know, and it's worrying to me that so many here seem to feel entitled to whatever they can take as long as it wasn't explicitly forbidden. Obviously FB should update their policy, but at the same time it's important that we as the community use this as an opportunity to learn and discuss where the implicit boundaries are, where one needs clear-cut agreement to proceed. Consent is sexy.

meowface 11y ago

I'm a security guy and I think what he did towards the end is dubious and strange, but again, he was following their guidelines as written.