> since an upcoming Tails update was slated to strip the vulnerable code, Facebook didn’t bother to do so, though the social media company had no reason to beli

> since an upcoming Tails update was slated to strip the vulnerable code, Facebook didn’t bother to do so, though the social media company had no reason to believe Tails developers had ever discovered the bug. Quite bizarre for Facebook to pay for a zero-day exploit to go after a criminal, but the only problem I have with the scenario is that Facebook didn't eventually disclose the vulnerability to the Tails team. The article notes that the Facebook team saw an upcoming update that strips the vulnerable code, but what if the Tails team reverted or delayed the update? The exploit should have been disclosed to the Tails team eventually so they can prioritize accordingly. If the exploit was eventually disclosed, it's hard to distinguish this from white-hat security research. In both cases, you have a legitimate organization discovering exploits that are responsibly disclosed, just with the added bonus of pursuing a criminal in a short time window before disclosure.