5 ms·
In general you are on shaky legal ground. However, some companies (including Facebook) have a bug bounty program that provides a prescribed safe harbor that yo
by jcims 6y ago
In general you are on shaky legal ground.
However, some companies (including Facebook) have a bug bounty program that provides a prescribed safe harbor that you can operate within to discover vulnerabilities within their products or infrastructure in exchange for some kind of recognition or award.
The terms of Facebooks bounty are here: https://www.facebook.com/whitehat https://www.facebook.com/whitehat
Based on a cursory glance and the fact that this individual was awarded in their program, it appears they operated by the book.
Prosecuting activity that happens outside of these parameters has definitely happened in the past and will continue. It's not always a cut and dried decision. It can be difficult/expensive to effectively prosecute and you may find a lot of social backlash depending on the nature and impact of the activity.
- bredren 6y agoYes. Most competent tech companies permissibly allow “security research” like this. If you are genuinely trying to find exploits in good faith, and are acting within the parameters spelled out in their bug bounty program, it’s all good. You also may get paid. This blog entry sort of dramatized what happened for clicks. I actually think it’s unwise to characterize any exploit like this, because it adds a PR dimension consumer companies just don’t want or need. It sort of creates a sense of adversarial relationship which isn’t really what FB is after. But it sounds like a risky endeavor put this way and probably helps get retweets attention in the short term.
- jcims 6y agoTotally agree with your perspective here. There's security research and there's bug prospecting. Both have streaks of narcissists and showboaters but the latter seems to be thick with them. (edit: to clarify b/c this can easily be interpreted otherwise, I'm not calling the writer of this article either of those. The headline is a bit of cheap clickbait but the article is a good walkthrough of their mindset)
- markdown 6y ago> There's security research and there's bug prospecting. If the end result of your work isn't a whitepaper or something similar from which others can learn, then you can call your work "security research". Bug bounty programs are mainly targeted at bug prospectors. > Both have streaks of narcissists and showboaters but the latter seems to be thick with them. Thank god for that. Blog posts like the one this thread is about are really valuable to those of us interested in the work of others.
- jcims 6y ago>Thank god for that. Blog posts like the one this thread is about are really valuable to those of us interested in the work of others. I can see how what I said could be interpreted as 'folks that blog about their work are narcissists'. That wasn't my intent. The headline is a bit clickbaity but the explanation is a good walkthrough. This isn't the far end of the spectrum that I had in mind. Watching twitter or working for a bug bounty program is a better way to get exposed to that set.
- thaumasiotes 6y agoI worked for several bug bounty programs; showboating didn't really seem to be a major issue.
- deleted 6y ago[deleted]
- jcims 6y agoMaybe things have gotten better. I worked for one a while back and came away with a notion of the two distinct communities I described. I try to focus mostly on the positive side, which was the majority and had some amazing and inspiring folks, but the other side had some really irritating people with wholly unprofessional conduct. Bug Bounty King really spoke to me haha
- 6y ago