6 ms·

"As you can see at https://www.facebook.com/whitehat https://www.facebook.com/whitehat, in order to qualify for a payout you must "make a good faith effort to a

"As you can see at https://www.facebook.com/whitehat https://www.facebook.com/whitehat, in order to qualify for a payout you must "make a good faith effort to avoid privacy violations" and "use a test account instead of a real account when investigating bugs." I just looked at it, then switched Facebook to Arabic and the TOS is magically still in English (edit - and right aligned really badly as the page evidently expects arabic). If you demand that the TOS is followed by people who do not have English as a first language, try offering a translation. This guy has done you all a service. The chances are that he may not have been able to clearly read the TOS that you wish him to abide by. He should get paid. edit - hmm, was about to check the situation with other languages, however now all the buttons are in arabic so I stopped bothering after the fourth random page.

tptacek 13y ago
They can't pay people to violate their terms of use or to try to violate the privacy of their users. Even if they wanted to, they're probably not allowed to do that.
- spyder 13y ago
  So if a security bug was discovered using methods that are against the TOS then the information about the bug is worthless for them and it's better to sold it elsewhere.
  - Udo 13y ago
    An argument could be made it wasn't so much the discovery of the bug but rather the manner of reporting it that was a ToS violation.
    - hrjet 13y ago
      The payment would ofcourse be for discovering the bug.
  - goblin89 13y ago
    The whitehat page explicitly says that you must “not interact with other accounts without the consent of their owners” in order to qualify for the bounty. So yes, apparently Facebook can deny payment and suspend your account if they can reasonably suspect that you violated someone's privacy during bug discovery. However, it seems that if you don't give them any clues in your report, they'll close their eyes and won't investigate carefully that possibility.
- loceng 13y ago
  They wouldn't paying him to violate the terms ... and it's not like Facebook has any problem with changing a user's privacy settings without permission - except I guess we probably somewhere in the agreements agreed to allow that, or not hold them accountable - probably both..
  - walid 13y ago
    hahaha funny point
- drewcrawford 13y ago
  Well according to Facebook, "this is not a bug". Which means the feature works as intended. If he is using Facebook as it is intended, then how can he be breaking the TOS? When an employee whose job it is to evaluate security issues says "this is not a bug", that determination carries the force of law the same way as if it appeared in the TOS. You cannot rely on people to follow some nebulous "spirit of the TOS" when meanwhile your employees have already made a contrary specific determination for how it applies to this particular bug.
- TheNewAndy 13y ago
  Creating a test account is also kind of a violation of the TOS anyway: "You will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission. You will not create more than one personal account."
  - jtdowney 13y ago
    They specifically allow accounts to be created for whitehat purposes at https://www.facebook.com/whitehat/accounts/ https://www.facebook.com/whitehat/accounts/
    - alxndr 13y ago
      Interestingly, from that page: "Please use a test account instead of a real account when investigating security vulnerabilities. When you are unable to reproduce a security vulnerability with a test account, it is acceptable to use a real account, except for automated testing."
- tejli 13y ago
  You must be Mark Zuckerberg
- toomuchtodo 13y ago
  Good point. Lesson learned: Find a security hole, report it to Facebook, and they don't respond after two attempts? Sell it as a zero day. Incentives matter. And there is always money to be had somewhere else.
emhart 13y ago
Great point and I hope the FB security team take notice of your post. Whether or not this guy gets paid, I certainly hope they spend the money to get proper translation of their policies in every language they operate in.
cdcarter 13y ago
https://www.facebook.com/legal/terms?locale=ar_AR https://www.facebook.com/legal/terms?locale=ar_AR It's translated. I believe it requires you to be in a local to get this page to display automatically. It certainly exists for people creating accounts in arabic, and absolutely includes the relevant lines.
- moocowduckquack 13y ago
  Does that page include the whitehat programme TOS, or is it just the general TOS?
jimbob99 13y ago
Yes because if you go to Saudi Arabia and murder someone, you can get away with it because their law is written in Arabic and not English, therefore it doesn't apply to you. Newsflash - it doesn't work that way. The terms can be in Swahili and they still apply to you. Hacking somebody's Facebook to demonstrate a "bug" is black hat and not white hat. This was a real hack of a real person and this guy should be imprisoned in his home country, then extradited to the US to face cyber terrorism charges.
- FunnyDuck 13y ago
  Why the hell would a non-US resident be extradited by his home country to the US to face some bogus charges? What's that hillbilly logic? How would US react if foreign countries were asking the US to extradite their own citizens to say, Iran?

tptacek 13y ago

They can't pay people to violate their terms of use or to try to violate the privacy of their users. Even if they wanted to, they're probably not allowed to do that.

spyder 13y ago
So if a security bug was discovered using methods that are against the TOS then the information about the bug is worthless for them and it's better to sold it elsewhere.
- Udo 13y ago
  An argument could be made it wasn't so much the discovery of the bug but rather the manner of reporting it that was a ToS violation.
  - hrjet 13y ago
    The payment would ofcourse be for discovering the bug.
- goblin89 13y ago
  The whitehat page explicitly says that you must “not interact with other accounts without the consent of their owners” in order to qualify for the bounty. So yes, apparently Facebook can deny payment and suspend your account if they can reasonably suspect that you violated someone's privacy during bug discovery. However, it seems that if you don't give them any clues in your report, they'll close their eyes and won't investigate carefully that possibility.
loceng 13y ago
They wouldn't paying him to violate the terms ... and it's not like Facebook has any problem with changing a user's privacy settings without permission - except I guess we probably somewhere in the agreements agreed to allow that, or not hold them accountable - probably both..
- walid 13y ago
  hahaha funny point
drewcrawford 13y ago
Well according to Facebook, "this is not a bug". Which means the feature works as intended. If he is using Facebook as it is intended, then how can he be breaking the TOS? When an employee whose job it is to evaluate security issues says "this is not a bug", that determination carries the force of law the same way as if it appeared in the TOS. You cannot rely on people to follow some nebulous "spirit of the TOS" when meanwhile your employees have already made a contrary specific determination for how it applies to this particular bug.
TheNewAndy 13y ago
Creating a test account is also kind of a violation of the TOS anyway: "You will not provide any false personal information on Facebook, or create an account for anyone other than yourself without permission. You will not create more than one personal account."
- jtdowney 13y ago
  They specifically allow accounts to be created for whitehat purposes at https://www.facebook.com/whitehat/accounts/ https://www.facebook.com/whitehat/accounts/
  - alxndr 13y ago
    Interestingly, from that page: "Please use a test account instead of a real account when investigating security vulnerabilities. When you are unable to reproduce a security vulnerability with a test account, it is acceptable to use a real account, except for automated testing."
tejli 13y ago
You must be Mark Zuckerberg
toomuchtodo 13y ago
Good point. Lesson learned: Find a security hole, report it to Facebook, and they don't respond after two attempts? Sell it as a zero day. Incentives matter. And there is always money to be had somewhere else.

emhart 13y ago

Great point and I hope the FB security team take notice of your post. Whether or not this guy gets paid, I certainly hope they spend the money to get proper translation of their policies in every language they operate in.

cdcarter 13y ago

https://www.facebook.com/legal/terms?locale=ar_AR https://www.facebook.com/legal/terms?locale=ar_AR It's translated. I believe it requires you to be in a local to get this page to display automatically. It certainly exists for people creating accounts in arabic, and absolutely includes the relevant lines.

moocowduckquack 13y ago
Does that page include the whitehat programme TOS, or is it just the general TOS?

jimbob99 13y ago

Yes because if you go to Saudi Arabia and murder someone, you can get away with it because their law is written in Arabic and not English, therefore it doesn't apply to you. Newsflash - it doesn't work that way. The terms can be in Swahili and they still apply to you. Hacking somebody's Facebook to demonstrate a "bug" is black hat and not white hat. This was a real hack of a real person and this guy should be imprisoned in his home country, then extradited to the US to face cyber terrorism charges.

FunnyDuck 13y ago
Why the hell would a non-US resident be extradited by his home country to the US to face some bogus charges? What's that hillbilly logic? How would US react if foreign countries were asking the US to extradite their own citizens to say, Iran?