5 ms·

Knowing about your special page for reporting privacy holes would not change my decision to post it here. I think more good will come when media picks it up and

by zone411 15y ago

Knowing about your special page for reporting privacy holes would not change my decision to post it here. I think more good will come when media picks it up and some Facebook users realize that a company with your record of terrible privacy decisions and incompetence should not be used for posting anything private or even at all. If you were a startup stretched for resources or if this hole could've been exploited to install malware, I'd of course attempt to contact you first. $500 for reporting security holes for a company of your size is also insulting, BTW.

mkjones 15y ago
The idea with responsible disclosure is that you want to maximize safety of the public by incentivizing vendors to fix problems while not letting malicious actors exploit them: http://en.wikipedia.org/wiki/Responsible_disclosure http://en.wikipedia.org/wiki/Responsible_disclosure. Once the vendor has fixed the flaw (or refused to, or taken longer than a reasonable time to do so), it's generally accepted as OK to publish details. You can of course get whatever media coverage you want at that point. I'm curious - do you think responsible disclosure is a bad idea? Or is the "badness" of this bug small enough (compared to malware) that you think it's better for the common good to publicly post the repro instructions and enable many users to exploit it? I think having a bug bounty program is actually a lot better than the vast majority of sites / vendors that don't even have a whitehat disclosure program, let alone a bug bounty program. It's worth noting that this is just the base bounty - I've seen us pay out a lot more for good discoveries. $500 is also the base that Google and Mozilla offer for their programs (http://googleonlinesecurity.blogspot.com/2010/11/rewarding-web-application-security.html http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w..., http://www.mozilla.org/security/bug-bounty.html http://www.mozilla.org/security/bug-bounty.html). What would be a good price, do you think? I'm not hooked in enough to know what black market prices are like for bugs like this.
mkjones 15y ago
Ah, just realized you're the OP. I don't think there's anything particularly irresponsible about posting an already-public disclosure to HN or other aggregators. It's the first person posting it publicly without first privately disclosing that I find irresponsible.
- AndyJPartridge 15y ago
  May I ask for your opinion on the $500 bounty issue that was mentioned?
  - mkjones 15y ago
    from http://news.ycombinator.com/item?id=3321366 http://news.ycombinator.com/item?id=3321366: > I think having a bug bounty program is actually a lot better than the vast majority of sites / vendors that don't even have a whitehat [aka responsible] disclosure program, let alone a bug bounty program. It's worth noting that this is just the base bounty - I've seen us pay out a lot more for good discoveries. $500 is also the base that Google and Mozilla offer for their programs (http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w... http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w..., http://www.mozilla.org/security/bug-bounty.html http://www.mozilla.org/security/bug-bounty.html). What would be a good price, do you think? I'm not hooked in enough to know what black market prices are like for bugs like this.

by zone411 15y ago

mkjones 15y ago

The idea with responsible disclosure is that you want to maximize safety of the public by incentivizing vendors to fix problems while not letting malicious actors exploit them: http://en.wikipedia.org/wiki/Responsible_disclosure http://en.wikipedia.org/wiki/Responsible_disclosure. Once the vendor has fixed the flaw (or refused to, or taken longer than a reasonable time to do so), it's generally accepted as OK to publish details. You can of course get whatever media coverage you want at that point. I'm curious - do you think responsible disclosure is a bad idea? Or is the "badness" of this bug small enough (compared to malware) that you think it's better for the common good to publicly post the repro instructions and enable many users to exploit it? I think having a bug bounty program is actually a lot better than the vast majority of sites / vendors that don't even have a whitehat disclosure program, let alone a bug bounty program. It's worth noting that this is just the base bounty - I've seen us pay out a lot more for good discoveries. $500 is also the base that Google and Mozilla offer for their programs (http://googleonlinesecurity.blogspot.com/2010/11/rewarding-web-application-security.html http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w..., http://www.mozilla.org/security/bug-bounty.html http://www.mozilla.org/security/bug-bounty.html). What would be a good price, do you think? I'm not hooked in enough to know what black market prices are like for bugs like this.

mkjones 15y ago

Ah, just realized you're the OP. I don't think there's anything particularly irresponsible about posting an already-public disclosure to HN or other aggregators. It's the first person posting it publicly without first privately disclosing that I find irresponsible.

AndyJPartridge 15y ago
May I ask for your opinion on the $500 bounty issue that was mentioned?
- mkjones 15y ago
  from http://news.ycombinator.com/item?id=3321366 http://news.ycombinator.com/item?id=3321366: > I think having a bug bounty program is actually a lot better than the vast majority of sites / vendors that don't even have a whitehat [aka responsible] disclosure program, let alone a bug bounty program. It's worth noting that this is just the base bounty - I've seen us pay out a lot more for good discoveries. $500 is also the base that Google and Mozilla offer for their programs (http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w... http://googleonlinesecurity.blogspot.com/2010/11/rewarding-w..., http://www.mozilla.org/security/bug-bounty.html http://www.mozilla.org/security/bug-bounty.html). What would be a good price, do you think? I'm not hooked in enough to know what black market prices are like for bugs like this.