4 ms·
You seem to be making an awful lot of excuses to not just pay someone who brought to light a critical exploit. Do you work on the security team or are you a la
by vehementi 13y ago
You seem to be making an awful lot of excuses to not just pay someone who brought to light a critical exploit. Do you work on the security team or are you a lawyer (maybe with a panicking accountant looking over your shoulder) trying to find fine print reasons say, "Aha! We can save money to our bottom line in this instance!" ? Do you know how silly it looks for you to make these excuses?
- tptacek 13y agoThis is pretty silly. Facebook obviously doesn't care about the dollars here; if anything, I'd imagine they want to be paying more bounties.
- vehementi 13y agoOh man! If only they could fix the situation!
- tptacek 13y agoYou're willfully ignoring what the situation actually is.
- vehementi 13y agoThe situation is the guy in good faith tried to give them repro steps and report a critical bug. Technically he fucked up and didn't do it on a white hat account. No harm was intended or done. They are denying him his reward based on a technicality. If that FB employee is not some lawyer trying to cover their asses, then he should want to pay this person and make it happen via some exception. If they truly didn't care about the money and wanted to pay more bounties they would do this. There is no danger of ruining the integrity of the ToS as another replier suggested. In future incidents they are free to not make an exception. In this case, it was all in good faith and the guy didn't know the proper procedure.
- tptacek 13y agoThey're not "denying him the reward". He demonstrated the vulnerability on someone's actual account. They can't pay people to fuck with other people's accounts. That's not what bug bounties are about. Only on a message board is this hard to understand.
- vehementi 13y ago"Paying people to fuck with people's accounts" is a pretty dishonest way to frame this.
- tptacek 13y agoNo, you just refuse to think about the larger picture. I went out of my way to say that this person wasn't deliberately harming anyone. You're acting as if there's no precedent implicated in Facebook learning of someone violating both their normal ToS and the terms of their bug bounty program by compromising someone else's account, and then paying them a reward. You're wrong about that.
- chris_wot 13y agoI went out of my way to say that this person wasn't deliberately harming anyone. Saying someone fucked with another person's account implies otherwise.
- prab97 13y agoHe didn't f* up Zuck's account. Just making a wall post on some account doesn't f* that account in any way.
- webvictim 13y agoIt's still a violation of privacy though, and these are viewed as serious by the ToS.
- ceol 13y ago
- arjie 13y agoI remember a comment by you saying that most exploits are not that valuable. How valuable would this one have been?
- esailija 13y agoIt looks like preserving the integrity of their ToS to me. If you believe it is because of $500, you are a total idiot and I will not talk to you.
- hrjet 13y agoIf you think good hackers report security bugs for $500, I am tempted to call you a total idiot too (though I will not). Consider what motivates people more deeply.
- esailija 13y agoThat is a vague reply with no apparent relevance to anything I said except the amount $500 which was not to be taken literally. My point was that facebook isn't doing this to save money and believing so is idiotic.
- hrjet 13y agoMy point is that people asking for a monetary reward might indirectly be asking for recognition, not the money per se. Thinking otherwise might be idiotic too, but that's besides the point.