4 ms·

>> "Still, I don't understand why more people don't sell the exploits to the highest bidder. It seems counter intuitive to me." The same reasons people don't s

>> "Still, I don't understand why more people don't sell the exploits to the highest bidder. It seems counter intuitive to me." The same reasons people don't steal from shops or commit other crimes: 1. Morals 2. Risk of getting caught and subsequent punishment

tptacek 11y ago
3. Nobody wants to buy Facebook bugs besides Facebook.
- hueving 11y ago
  Yes, this particular class of bug isn't all that useful. If someone started using the exploit it wouldn't be long before a user complained that their comments were being deleted and then Facebook would figure it out in a hurry.
  - jsprogrammer 11y ago
    Presumably an Instagram rival could find it useful. If Instagram comments are gone/disappearing, then a more secure version could gain user-share from Instagram. Edit: Even CNBC is aware of data hacking[0]. Scary to know that people here don't even consider sabotage as a threat-model... [0] http://www.cnbc.com/2016/03/09/the-next-big-threat-in-hacking--data-sabotage.html http://www.cnbc.com/2016/03/09/the-next-big-threat-in-hackin...
    - curiousgal 11y ago
      haha you can't be serious right? I am sorry but I honestly found that amusing. Like Instagram engineers scratching their heads as to why comments are disappearing while there's an up-rise of users and then someone finally decides to create a secure alternative and is upheld as the savior. Realistically though if this an were to become big enough to promote an alternative then Instagram would be all over it and thus fix it within minutes.
    - tptacek 11y ago
      I see. So, the business plan here is: outbid Facebook to buy the rights to arrange the commission of, what, tens of thousands of felonies, in order to secure a marginal benefit for a competitor to the world's most popular photo sharing application, where those rights expire instantaneously as soon as one of the best security teams on the planet notices what's happening. Sounds great. Where do I invest?
      - jsprogrammer 11y ago
        Best security teams on the planet? You are talking about Instagram? I've read multiple reports of their properties being completely owned in the last few months, just here. The fact that they are still up is a testament to the researchers who reported the errors to FB. Also, many people invest in even worse and more fraudulent schemes. Publicly traded companies have scammed entire states and nations, costing dozens of billions to trillions of dollars, all while NYSE investors trade their stock like cash. Edit: If you can't deal in facts, deal in downmods and unsubstantiated platitudes.
        tptacek 11y ago
        Yes, Facebook has one of the best security teams on the planet. No, nobody is going to invest in this scheme.
    - untog 11y ago
      "Weird, some of my comments disappeared. Well, I guess it's time to completely reboot my social media profile on a new service!" - no one, ever

tptacek 11y ago

3. Nobody wants to buy Facebook bugs besides Facebook.

hueving 11y ago
Yes, this particular class of bug isn't all that useful. If someone started using the exploit it wouldn't be long before a user complained that their comments were being deleted and then Facebook would figure it out in a hurry.
- jsprogrammer 11y ago
  Presumably an Instagram rival could find it useful. If Instagram comments are gone/disappearing, then a more secure version could gain user-share from Instagram. Edit: Even CNBC is aware of data hacking[0]. Scary to know that people here don't even consider sabotage as a threat-model... [0] http://www.cnbc.com/2016/03/09/the-next-big-threat-in-hacking--data-sabotage.html http://www.cnbc.com/2016/03/09/the-next-big-threat-in-hackin...
  - curiousgal 11y ago
    haha you can't be serious right? I am sorry but I honestly found that amusing. Like Instagram engineers scratching their heads as to why comments are disappearing while there's an up-rise of users and then someone finally decides to create a secure alternative and is upheld as the savior. Realistically though if this an were to become big enough to promote an alternative then Instagram would be all over it and thus fix it within minutes.
  - tptacek 11y ago
    I see. So, the business plan here is: outbid Facebook to buy the rights to arrange the commission of, what, tens of thousands of felonies, in order to secure a marginal benefit for a competitor to the world's most popular photo sharing application, where those rights expire instantaneously as soon as one of the best security teams on the planet notices what's happening. Sounds great. Where do I invest?
    - jsprogrammer 11y ago
      Best security teams on the planet? You are talking about Instagram? I've read multiple reports of their properties being completely owned in the last few months, just here. The fact that they are still up is a testament to the researchers who reported the errors to FB. Also, many people invest in even worse and more fraudulent schemes. Publicly traded companies have scammed entire states and nations, costing dozens of billions to trillions of dollars, all while NYSE investors trade their stock like cash. Edit: If you can't deal in facts, deal in downmods and unsubstantiated platitudes.
      - tptacek 11y ago
        Yes, Facebook has one of the best security teams on the planet. No, nobody is going to invest in this scheme.
  - untog 11y ago
    "Weird, some of my comments disappeared. Well, I guess it's time to completely reboot my social media profile on a new service!" - no one, ever