4 ms·

He should have gone to the black market, better yet sat on it. How long did it take Facebook to come forward with its user privacy violations?

tyleraldrich 8y ago
You didn't read the article. "09.08.2018 20:10 CEST : a 5000$ bounty is awarded – the server was in a separate VLAN with no users’ specific data."
- jwilk 8y ago
  From the HN guidelines: Please don't insinuate that someone hasn't read an article.
  - Kiro 8y ago
    Not applicable when it's obvious that the poster hasn't read the article, like in this case.
    - dang 8y ago
      It's applicable precisely in that case.
  - Sohcahtoa82 8y ago
    To be fair, it's a hard rule to follow sometimes when someone makes it painfully clear that they didn't actually read the article.
    - pvg 8y ago
      It's not a hard rule to follow. You can just say 'The article says X'.
meowface 8y ago
He deserves a higher payout, but 1) telling him to be unethical rather than reporting it responsibly and accepting a not-insignificant reward is stupid, and 2) there's almost no chance this would've garnered more than $5,000 on any black market. This is not something that would grant a cybercriminal access to sensitive or profitable information, unless Facebook is wrong in their assessment of how segmented the server is... and even then, much more work would be required for the attacker (more than an average vuln buyer is probably capable of).
- komali2 8y ago
  Not to mention this way he can actually report it on his taxes and get the money plopped straight into his bank account, whereas black market is a hell of a lot more uncertain if you even get paid.
chias 8y ago
What would you guess the going rate on the black market would be for an RCE on some error-log collection box that happens to be in use by Facebook? My guess is "less than $5000".
- brainkim 8y ago
  The only code they executed was "sleep(100)" If they started dumping env variables/snooping around they would have done a lot more than $5000 worth of damage.
  - throwawaymath 8y ago
    How are you quantifying that?

tyleraldrich 8y ago

You didn't read the article. "09.08.2018 20:10 CEST : a 5000$ bounty is awarded – the server was in a separate VLAN with no users’ specific data."

jwilk 8y ago
From the HN guidelines: Please don't insinuate that someone hasn't read an article.
- Kiro 8y ago
  Not applicable when it's obvious that the poster hasn't read the article, like in this case.
  - dang 8y ago
    It's applicable precisely in that case.
- Sohcahtoa82 8y ago
  To be fair, it's a hard rule to follow sometimes when someone makes it painfully clear that they didn't actually read the article.
  - pvg 8y ago
    It's not a hard rule to follow. You can just say 'The article says X'.

meowface 8y ago

He deserves a higher payout, but 1) telling him to be unethical rather than reporting it responsibly and accepting a not-insignificant reward is stupid, and 2) there's almost no chance this would've garnered more than $5,000 on any black market. This is not something that would grant a cybercriminal access to sensitive or profitable information, unless Facebook is wrong in their assessment of how segmented the server is... and even then, much more work would be required for the attacker (more than an average vuln buyer is probably capable of).

komali2 8y ago
Not to mention this way he can actually report it on his taxes and get the money plopped straight into his bank account, whereas black market is a hell of a lot more uncertain if you even get paid.

chias 8y ago

What would you guess the going rate on the black market would be for an RCE on some error-log collection box that happens to be in use by Facebook? My guess is "less than $5000".

brainkim 8y ago
The only code they executed was "sleep(100)" If they started dumping env variables/snooping around they would have done a lot more than $5000 worth of damage.
- throwawaymath 8y ago
  How are you quantifying that?