3 ms·

The author clearly has a language barrier. Not all bug reports are going to come with sterling reports to back them. In the end, Ḱhalil fell back on the lingua

by s_q_b 13y ago

The author clearly has a language barrier. Not all bug reports are going to come with sterling reports to back them. In the end, Ḱhalil fell back on the lingua franca of the internet: a working demonstration. The onus is on the organization, not the bug reporter, to vet the information. From what I see, there was more than enough in the report to conclude there was a problem, and follow up. If Facebook security fails in coding the application, in QR, and when a user files a bug report, it is awfully hard to place the blame with the bug reporter.

ressaid1 13y ago
I agree, and in the end, they finally broke the language barrier and comprehended the bug which I am sure they are working on fixing. They were able to get all the benefit of his work, why screw him on a measly little bounty?
dylangs1030 13y ago
This isn't a good summary of the events. His "lingua franca" is technically illegal, and violates Facebook's explicit and easily accessible Terms of Service. There's nothing obfuscated about this. It's very straightforward. Yes, he found a security vulnerability. That doesn't earn you points "just cause." You still need to report it with responsible disclosure and not exploit it for the lulz and attention. He could have done things differently - especially, he could have asked to talk to a Facebook employee who understands Arabic. Or tried to put more effort into a second security report. Frankly, posting on Mark Zuckerberg's wall about this is childish and just attention-grabbing. It's not a responsible disclosure.
- avalaunch 13y ago
  In another thread it was mentioned that the terms of service aren't available in Arabic.
  - borplk 13y ago
    I believe that was referring to the terms of service of the whitehat program not Facebook's TOS itself.
    - avalaunch 13y ago
      Aren't the whitehat term's of service those that were talking about? They're the most relevant terms to this discussion.
  - dylangs1030 13y ago
    That's not Facebook's problem...should they also write Esperanto terms of service and Swahili terms of service just because security researchers exist who speak those languages?
    - s_q_b 13y ago
      Might help if hundreds of millions of people spoke Esperanto.
    - avalaunch 13y ago
      And the bug wasn't this hacker's problem. It's important to remember that this guy went out of his way to help Facebook. As such, they should be a bit more understanding when someone that speaks Esperanto submits a bug without doing so in a way that perfectly adheres to their terms of service. They should step back and take a subjective view instead of trying to make it black and white. Was he acting maliciously? Did he knowingly violate the terms or was it out of ignorance? Was he trying to hurt Facebook by violating the terms or help them?

by s_q_b 13y ago

ressaid1 13y ago

I agree, and in the end, they finally broke the language barrier and comprehended the bug which I am sure they are working on fixing. They were able to get all the benefit of his work, why screw him on a measly little bounty?

dylangs1030 13y ago

This isn't a good summary of the events. His "lingua franca" is technically illegal, and violates Facebook's explicit and easily accessible Terms of Service. There's nothing obfuscated about this. It's very straightforward. Yes, he found a security vulnerability. That doesn't earn you points "just cause." You still need to report it with responsible disclosure and not exploit it for the lulz and attention. He could have done things differently - especially, he could have asked to talk to a Facebook employee who understands Arabic. Or tried to put more effort into a second security report. Frankly, posting on Mark Zuckerberg's wall about this is childish and just attention-grabbing. It's not a responsible disclosure.

avalaunch 13y ago
In another thread it was mentioned that the terms of service aren't available in Arabic.
- borplk 13y ago
  I believe that was referring to the terms of service of the whitehat program not Facebook's TOS itself.
  - avalaunch 13y ago
    Aren't the whitehat term's of service those that were talking about? They're the most relevant terms to this discussion.
- dylangs1030 13y ago
  That's not Facebook's problem...should they also write Esperanto terms of service and Swahili terms of service just because security researchers exist who speak those languages?
  - s_q_b 13y ago
    Might help if hundreds of millions of people spoke Esperanto.
  - avalaunch 13y ago
    And the bug wasn't this hacker's problem. It's important to remember that this guy went out of his way to help Facebook. As such, they should be a bit more understanding when someone that speaks Esperanto submits a bug without doing so in a way that perfectly adheres to their terms of service. They should step back and take a subjective view instead of trying to make it black and white. Was he acting maliciously? Did he knowingly violate the terms or was it out of ignorance? Was he trying to hurt Facebook by violating the terms or help them?