4 ms·

I thought the whole idea behind whitehat reports was to keep these exploits off the hands of malicious hackers. Whoever made the decision not to pay this guy s

I thought the whole idea behind whitehat reports was to keep these exploits off the hands of malicious hackers. Whoever made the decision not to pay this guy should check with Mark Zuckerberg. If Mark is still adhering to "the hacker way" he should embrace such clever ways of reporting exploits and invite any whitehat to test them on his or better, {the idiot who decided not to pay}'s profile. Hacking and finding exploits requires thinking outside the box, by imposing rules and "terms of service" on them, Facebook might be defeating the whole purpose of the whitehat program. Any exploit violates Facebook's terms anyways. By not paying, Facebook is telling the whitehat community "go ahead, do our QA for us, we will only pay you if we feel like it"

unreal37 13y ago
That's not true. There was a very easy way to find and demonstrate this bug without violating the TOS. The TOS clearly says, you can't target someone with your hack without their permission. The hacker could have created two accounts he owned and controlled, who are not Facebook friends. He could have used one to post to the other's wall. Viola, bug proven and bounty collected.
- jnbiche 13y ago
  Yeah, and he breaks their terms of service even there, since you're only supposed to create a single personal account under your true name.
  - avalaunch 13y ago
    They have special whitehat accounts which you are allowed to set up for testing. You can have as many of those as you like.
  - unreal37 13y ago
    My company creates Facebook apps and have multiple FB accounts for testing purposes. They're not going to kick him off FB for having two accounts, come on.
- vpeters25 13y ago
  Hackers don't read TOS nor manuals. Facebook should not expect from whitehats the same standards of bug reporting of their QA department. Most hackers are self-taught, one of the reason they are able to think outside the box and find exploits. The whitehat program's priority should be to FIND EXPLOITS so they can be patched. Not having every single hacker in the world expend hours reading TOS and instructions on how to properly report such exploit. Here is a thought: pay him less for not following procedures, but pay him anyways. Or better: pay a bonus to reports that follow proper procedures.
borplk 13y ago
If a person is whitehat, it is understood, and by definition, they will not use the found bug for a bad purpose or sell it on black market. Whitehat does not mean "I will responsibly disclose the vulnerability for as long as there's good money and rewards otherwise I will exploit it or sell it to someone else". Facebook or any other company with bounty programs are not competing against the black market and trying to out-bid the bad guys by attracting the black hat hackers to wear a white hat and disclose the bug to Facebook for some money. "we will only pay you if we feel like it" Facebook isn't saying that. They are saying "we can not pay you because you violated our terms of service" which is truly an under-statement. It should be like "we can not pay you because you exploited the bug on our CEO's profile and another one of our users and have created negative PR and damaged our reputation" But even if they did say "we will only pay you if we feel like it", as far as whitehats are concerned that should not change their incentives and behavior because, again, whitehats, by definition are not those who disclose the bugs for money and rewards. If you are a grey/black hat only wearing the white hat when the money is good enough then Facebook is not interested in dealing with you in the first place.

unreal37 13y ago

That's not true. There was a very easy way to find and demonstrate this bug without violating the TOS. The TOS clearly says, you can't target someone with your hack without their permission. The hacker could have created two accounts he owned and controlled, who are not Facebook friends. He could have used one to post to the other's wall. Viola, bug proven and bounty collected.

jnbiche 13y ago
Yeah, and he breaks their terms of service even there, since you're only supposed to create a single personal account under your true name.
- avalaunch 13y ago
  They have special whitehat accounts which you are allowed to set up for testing. You can have as many of those as you like.
- unreal37 13y ago
  My company creates Facebook apps and have multiple FB accounts for testing purposes. They're not going to kick him off FB for having two accounts, come on.
vpeters25 13y ago
Hackers don't read TOS nor manuals. Facebook should not expect from whitehats the same standards of bug reporting of their QA department. Most hackers are self-taught, one of the reason they are able to think outside the box and find exploits. The whitehat program's priority should be to FIND EXPLOITS so they can be patched. Not having every single hacker in the world expend hours reading TOS and instructions on how to properly report such exploit. Here is a thought: pay him less for not following procedures, but pay him anyways. Or better: pay a bonus to reports that follow proper procedures.

borplk 13y ago

If a person is whitehat, it is understood, and by definition, they will not use the found bug for a bad purpose or sell it on black market. Whitehat does not mean "I will responsibly disclose the vulnerability for as long as there's good money and rewards otherwise I will exploit it or sell it to someone else". Facebook or any other company with bounty programs are not competing against the black market and trying to out-bid the bad guys by attracting the black hat hackers to wear a white hat and disclose the bug to Facebook for some money. "we will only pay you if we feel like it" Facebook isn't saying that. They are saying "we can not pay you because you violated our terms of service" which is truly an under-statement. It should be like "we can not pay you because you exploited the bug on our CEO's profile and another one of our users and have created negative PR and damaged our reputation" But even if they did say "we will only pay you if we feel like it", as far as whitehats are concerned that should not change their incentives and behavior because, again, whitehats, by definition are not those who disclose the bugs for money and rewards. If you are a grey/black hat only wearing the white hat when the money is good enough then Facebook is not interested in dealing with you in the first place.