4 ms·

Facebook pays for security loopholes

17 points by narad 15y ago

reemrevnivek 15y ago
I wasn't sure from the title if the article was about: 1. Facebook paying security researchers to find and report vulnerabilities. 2. Facebook paying (in user data, public image, and lawsuits) for vulnerabilities exploited by malicious security researchers. It's the former. As such, it reminds me of the "What does $1265 of bugs look like?" discussion recently at http://news.ycombinator.com/item?id=2927914 http://news.ycombinator.com/item?id=2927914 , where the author of open-source software paid between $1 and $50 for various bug levels. Does it make any sense for a company like Facebook to offer tiny bounties on code style, spelling errors, and harmless bugs?
- jgeralnik 15y ago
  Facebook's code is not open source, so no, code style bugs does not make sense.
  - deleted 15y ago
    [deleted]
jgeralnik 15y ago
"Facebook should consider setting up a "walled garden" that only allowed vetted applications from approved developers to connect to the social networking site, he said." No. Just no.
helipad 15y ago
£25,000 seems like small change for identifying potentially disastrous security holes.
jeffwhelpley 15y ago
I think this is working. I haven't gotten as much spam on Facebook as I did a year ago.
dave1010uk 15y ago
Direct link to Facebook's bug bounty program: http://www.facebook.com/whitehat/bounty/ http://www.facebook.com/whitehat/bounty/ Mozilla (http://www.mozilla.org/security/bug-bounty.html http://www.mozilla.org/security/bug-bounty.html) and Chromium (http://dev.chromium.org/Home/chromium-security/vulnerability-rewards-program http://dev.chromium.org/Home/chromium-security/vulnerability...) have bug bounties too and I'm sure many other projects do.
- nbpoole 15y ago
  Google also has a security bug bounty program on its web applications: http://www.google.com/about/corporate/company/security.html http://www.google.com/about/corporate/company/security.html and http://googleonlinesecurity.blogspot.com/2010/11/rewarding-web-application-security.html http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w....
wslh 15y ago
A security professional does this money in a few hours of work, so the "prize" is not very attractive. And what's interesting is that within the security ecosystem there are proven ways to win authority and reputability.
HannibalLecter 15y ago
Bug bounties are nice to see but look how little they are spending. Cheap jerks are spending $40k only to fix critical security bugs. I mean these guys have more money than the Catholic Church and they spend so little getting bugs fixed. Am I the only one partially infuriated by this doing-things-on-the-cheap attitude at Facebook? The guy that closed those bugs should have taken a years salary for doing so. They can afford it and he greatly improved their service. You know what will end up happening right? Someone is going to start bidding against the bugs on Facebook for the solutions so they can be used to exploit the site.

17 points by narad 15y ago

I wasn't sure from the title if the article was about: 1. Facebook paying security researchers to find and report vulnerabilities. 2. Facebook paying (in user data, public image, and lawsuits) for vulnerabilities exploited by malicious security researchers. It's the former. As such, it reminds me of the "What does $1265 of bugs look like?" discussion recently at http://news.ycombinator.com/item?id=2927914 http://news.ycombinator.com/item?id=2927914 , where the author of open-source software paid between $1 and $50 for various bug levels. Does it make any sense for a company like Facebook to offer tiny bounties on code style, spelling errors, and harmless bugs?

jgeralnik 15y ago
Facebook's code is not open source, so no, code style bugs does not make sense.
- deleted 15y ago
  [deleted]

jgeralnik 15y ago

"Facebook should consider setting up a "walled garden" that only allowed vetted applications from approved developers to connect to the social networking site, he said." No. Just no.

helipad 15y ago

£25,000 seems like small change for identifying potentially disastrous security holes.

jeffwhelpley 15y ago

I think this is working. I haven't gotten as much spam on Facebook as I did a year ago.

dave1010uk 15y ago

Direct link to Facebook's bug bounty program: http://www.facebook.com/whitehat/bounty/ http://www.facebook.com/whitehat/bounty/ Mozilla (http://www.mozilla.org/security/bug-bounty.html http://www.mozilla.org/security/bug-bounty.html) and Chromium (http://dev.chromium.org/Home/chromium-security/vulnerability-rewards-program http://dev.chromium.org/Home/chromium-security/vulnerability...) have bug bounties too and I'm sure many other projects do.

nbpoole 15y ago
Google also has a security bug bounty program on its web applications: http://www.google.com/about/corporate/company/security.html http://www.google.com/about/corporate/company/security.html and http://googleonlinesecurity.blogspot.com/2010/11/rewarding-web-application-security.html http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w....

wslh 15y ago

A security professional does this money in a few hours of work, so the "prize" is not very attractive. And what's interesting is that within the security ecosystem there are proven ways to win authority and reputability.

HannibalLecter 15y ago

Bug bounties are nice to see but look how little they are spending. Cheap jerks are spending $40k only to fix critical security bugs. I mean these guys have more money than the Catholic Church and they spend so little getting bugs fixed. Am I the only one partially infuriated by this doing-things-on-the-cheap attitude at Facebook? The guy that closed those bugs should have taken a years salary for doing so. They can afford it and he greatly improved their service. You know what will end up happening right? Someone is going to start bidding against the bugs on Facebook for the solutions so they can be used to exploit the site.