10 ms·

>this would have gone better for all parties if he had used a test account and included some kind of repro instructions Clearly, but that's not really somethin

>this would have gone better for all parties if he had used a test account and included some kind of repro instructions Clearly, but that's not really something you can control. From your perspective, the other side of the tradeoff with "hurting real user accounts" is "leaving open a huge security hole", not "being mean to whitehats when they screw up". I don't disagree that the guidelines seem quite reasonable prima facie and perfectly fair to to the whitehat in some moral sense, but it's unclear if they're actually working. It boils down to, if you had to choose between finding out about this security hole the way you did or not find out about it at all, which would you choose? How many not-quite-so-aggressive versions of this guy are out there, and how many holes are you leaving on the table? Edited to add: If an important way of finding vulnerabilities is people breaking the rules, then the rules suck, regardless of their intrinsic fairness. It could well be that keeping not-great-communicator/guideline-follower whitehats from reporting some number of bugs through questionable means is actually worth those flaws sticking around. Of course I don't see the daily flow of vulnerability reports to FB (or all the ones that don't ever get reported), so I don't know. But it sounds like a harder question than you make it out to be.

tptacek 13y ago
Again: how exactly do you propose that they write a policy that compensates people for violating the security of their users? Not the security of Facebook, but the integrity of their actual users. We all know this person had good intentions. But good intentions aren't always enough. Facebook doesn't appear to be freaking out at him. They just can't pay him for having demonstrated a vulnerability by hacking someone's account.
- loceng 13y ago
  Firstly, no idea how you can conclude he hacked an account. A bit strong of language there? Second, does reason not come into play here? You don't have to write a policy to compensate people for violating privacy - however if you have a human making decisions, and not just a drone following written orders, then the ability to make compromises exist. Just no one at Facebook wants to engage and be human it seems.
  - tingletech 13y ago
    In as much as he posted on another account's timeline without permission, he "hacked" it in the "unauthorized access" sense of hacked. re: reason; where does his reason come into play? It does not seem reasonable to post to M.Z.'s timeline, I'd guess he did that because he was P.O.ed at being dis'ed by the support people. In the bureaucratic theory I am aware, if you have rules (policies, proceudres, standards etc.) you need to apply them consistently. Sometimes the rule will allow for discretion, sometimes not. I don't see room for discretion here.
    - loceng 13y ago
      I believe you're comprehending his actions wrongly. He stated before he'd be able to post even onto M.Z.'s timeline, to announce that this isn't a narrow scope issue, and that it was to gain attention. I see no malicious or angered. If of course M.Z. all of a sudden sees some guy, who isn't a friend, posting to his wall - you think he might actually look into it, right? Yeah, rules that don't take into account reason are inhumane. Similarly why we don't just give everyone 10 years in prison because they committed a crime - you take into account all aspects - and not just apply "oh but he committed a crime, so this is the result."
      - tingletech 13y ago
        Rules that are not applied consistently are arbitary. No one said anything about a crime. Denial of the bounty is not brutal.
  - saraid216 13y ago
    > Firstly, no idea how you can conclude he hacked an account. A bit strong of language there? This is like... the textbook definition of a hack. > however if you have a human making decisions, and not just a drone following written orders, then the ability to make compromises exist. Just no one at Facebook wants to engage and be human it seems. I love that this statement is downthread of a Facebook engineer's comment that states he considers the guidelines reasonable. It's as if you're just a drone following written orders without the ability to make compromises.
- icambron 13y ago
  Not sure what you mean by "again". > They just can't pay him for having demonstrated a vulnerability by hacking someone's account. I don't see why that is. They already provide the following caveat: > When you are unable to reproduce a bug with a test account, it is acceptable to use a real account, except for automated testing.[1] So I don't think there's some kind of legal issue there, if that's what you mean. And you could provide other caveats, like, "you can use a real account if no one is listening to you" (I grant that this may not have helped here either). I'll reiterate what I said above, which is that the policy is fine, as long as everyone recognizes that it has a strong potential to reduce the security of Facebook. And that ought to raise some sort of alarm, right? [1] https://www.facebook.com/whitehat https://www.facebook.com/whitehat
  - tptacek 13y ago
    Immediately following that quote: Do not interact with other accounts without the consent of their owners.
  - webvictim 13y ago
    He didn't try to reproduce the bug with a test account though. If he had and it hadn't worked, the fact that he then used a real account would've been acceptable.
- jasonlotito 13y ago
  > how exactly do you propose that they write a policy that compensates people for violating the security of their users? Not the security of Facebook, but the integrity of their actual users. In the appropriate language: https://news.ycombinator.com/item?id=6231153 https://news.ycombinator.com/item?id=6231153 Otherwise, you should make some good faith effort to not assume devious intentions on someone making a good faith effort to report problems. > They just can't pay him for having demonstrated a vulnerability by hacking someone's account. Technically, according to the security person at Facebook, it wasn't a bug. When he did the same thing again on Mark Z's account, it suddenly became hacking. Yeah, he didn't follow a procedure that wasn't available to him in his native language, but he made a good faith attempt to report the bug, and did so several times. > But good intentions aren't always enough. Several attempts to contact them despite being told the actions he was taken was not a bug despite clearly explaining why it was?
- rapind 13y ago
  "Can't pay him" sounds like bureaucracy BS. I'd argue that it's in their best interest to find a way to pay him. Why make people jump through hoops to report an exploit in your product? However, it also sounds to me like an opportunity for a bug / exploit reporting proxy business that validates, reproduces, and polishes reports in bulk. You most certainly could extract a much higher bounty per report.
  - adambenayoun 13y ago
    "Can't pay him" doesn't sound like bureaucracy BS, they don't pay him because he violated the TOS, it's on purpose. We could argue this is stupid and the TOS should be changed, but I can understand why they specify that in the process of reporting a bug you use a test account. Violating a real user privacy to report a bug isn't the proper way to report a bug. If they made an exception with this guy then they would have to make more exceptions and possibly set a bad precedent.
    - rapind 13y ago
      I disagree. I don't think that making a case by case assessment is opening the floodgates (that argument is exactly what I would call bureaucracy BS). For an exploit of this severity I would expect them to be grateful to someone who was obviously not being malicious regardless of some silly policy.
      - DominikR 13y ago
        How would you feel if he found an exploit that allowed him to make all your private messages public and proceeded to report this by leaking your inbox? I'm no fan of Facebook, but even I can see why they can't ever encourage such irresponsible behaviour.
        rapind 13y ago
        As stated, a case by case assessment would most definitely capture this fictional scenario appropriately.

tptacek 13y ago

Again: how exactly do you propose that they write a policy that compensates people for violating the security of their users? Not the security of Facebook, but the integrity of their actual users. We all know this person had good intentions. But good intentions aren't always enough. Facebook doesn't appear to be freaking out at him. They just can't pay him for having demonstrated a vulnerability by hacking someone's account.

loceng 13y ago
Firstly, no idea how you can conclude he hacked an account. A bit strong of language there? Second, does reason not come into play here? You don't have to write a policy to compensate people for violating privacy - however if you have a human making decisions, and not just a drone following written orders, then the ability to make compromises exist. Just no one at Facebook wants to engage and be human it seems.
- tingletech 13y ago
  In as much as he posted on another account's timeline without permission, he "hacked" it in the "unauthorized access" sense of hacked. re: reason; where does his reason come into play? It does not seem reasonable to post to M.Z.'s timeline, I'd guess he did that because he was P.O.ed at being dis'ed by the support people. In the bureaucratic theory I am aware, if you have rules (policies, proceudres, standards etc.) you need to apply them consistently. Sometimes the rule will allow for discretion, sometimes not. I don't see room for discretion here.
  - loceng 13y ago
    I believe you're comprehending his actions wrongly. He stated before he'd be able to post even onto M.Z.'s timeline, to announce that this isn't a narrow scope issue, and that it was to gain attention. I see no malicious or angered. If of course M.Z. all of a sudden sees some guy, who isn't a friend, posting to his wall - you think he might actually look into it, right? Yeah, rules that don't take into account reason are inhumane. Similarly why we don't just give everyone 10 years in prison because they committed a crime - you take into account all aspects - and not just apply "oh but he committed a crime, so this is the result."
    - tingletech 13y ago
      Rules that are not applied consistently are arbitary. No one said anything about a crime. Denial of the bounty is not brutal.
- saraid216 13y ago
  > Firstly, no idea how you can conclude he hacked an account. A bit strong of language there? This is like... the textbook definition of a hack. > however if you have a human making decisions, and not just a drone following written orders, then the ability to make compromises exist. Just no one at Facebook wants to engage and be human it seems. I love that this statement is downthread of a Facebook engineer's comment that states he considers the guidelines reasonable. It's as if you're just a drone following written orders without the ability to make compromises.
icambron 13y ago
Not sure what you mean by "again". > They just can't pay him for having demonstrated a vulnerability by hacking someone's account. I don't see why that is. They already provide the following caveat: > When you are unable to reproduce a bug with a test account, it is acceptable to use a real account, except for automated testing.[1] So I don't think there's some kind of legal issue there, if that's what you mean. And you could provide other caveats, like, "you can use a real account if no one is listening to you" (I grant that this may not have helped here either). I'll reiterate what I said above, which is that the policy is fine, as long as everyone recognizes that it has a strong potential to reduce the security of Facebook. And that ought to raise some sort of alarm, right? [1] https://www.facebook.com/whitehat https://www.facebook.com/whitehat
- tptacek 13y ago
  Immediately following that quote: Do not interact with other accounts without the consent of their owners.
- webvictim 13y ago
  He didn't try to reproduce the bug with a test account though. If he had and it hadn't worked, the fact that he then used a real account would've been acceptable.
jasonlotito 13y ago
> how exactly do you propose that they write a policy that compensates people for violating the security of their users? Not the security of Facebook, but the integrity of their actual users. In the appropriate language: https://news.ycombinator.com/item?id=6231153 https://news.ycombinator.com/item?id=6231153 Otherwise, you should make some good faith effort to not assume devious intentions on someone making a good faith effort to report problems. > They just can't pay him for having demonstrated a vulnerability by hacking someone's account. Technically, according to the security person at Facebook, it wasn't a bug. When he did the same thing again on Mark Z's account, it suddenly became hacking. Yeah, he didn't follow a procedure that wasn't available to him in his native language, but he made a good faith attempt to report the bug, and did so several times. > But good intentions aren't always enough. Several attempts to contact them despite being told the actions he was taken was not a bug despite clearly explaining why it was?
rapind 13y ago
"Can't pay him" sounds like bureaucracy BS. I'd argue that it's in their best interest to find a way to pay him. Why make people jump through hoops to report an exploit in your product? However, it also sounds to me like an opportunity for a bug / exploit reporting proxy business that validates, reproduces, and polishes reports in bulk. You most certainly could extract a much higher bounty per report.
- adambenayoun 13y ago
  "Can't pay him" doesn't sound like bureaucracy BS, they don't pay him because he violated the TOS, it's on purpose. We could argue this is stupid and the TOS should be changed, but I can understand why they specify that in the process of reporting a bug you use a test account. Violating a real user privacy to report a bug isn't the proper way to report a bug. If they made an exception with this guy then they would have to make more exceptions and possibly set a bad precedent.
  - rapind 13y ago
    I disagree. I don't think that making a case by case assessment is opening the floodgates (that argument is exactly what I would call bureaucracy BS). For an exploit of this severity I would expect them to be grateful to someone who was obviously not being malicious regardless of some silly policy.
    - DominikR 13y ago
      How would you feel if he found an exploit that allowed him to make all your private messages public and proceeded to report this by leaking your inbox? I'm no fan of Facebook, but even I can see why they can't ever encourage such irresponsible behaviour.
      - rapind 13y ago
        As stated, a case by case assessment would most definitely capture this fictional scenario appropriately.