4 ms·

What a load of crap. I understand that English is not your first language (no I don't; I'll deride your command of it at every turn, going forward) and of cour

What a load of crap. I understand that English is not your first language (no I don't; I'll deride your command of it at every turn, going forward) and of course that's perfectly fine, people usually don't expect perfect English on the internet. However you have written the report quite lazily and haven't taken the time to clearly explain the steps (every whitehat reporter CAN NOT be expected to understand how or what to adequately include in a PoC; it is _Facebook_ who is shown to be lazy in their responses, failing to point the reporter to the rules, appropriate [localized] steps, and ANYTHING of value to help the reporter). For example you have said "mark profile" instead of "Mark Zuckerberg's profile" (lol, idiot). That's just ambiguous language (see, I really don't understand nor can forgive you for being an English speaker) and confuses the reader. They probably receive a lot of wrong reports every day so if you make mistakes like that you are less likely to be taken seriously (unlike the mistakes made by Facebook; woe is them who can't be arsed to not even have boilerplate guidance and just shrug off reporters; cool story bro). [...] you failed to communicate clearly (idiot).

borplk 13y ago
Very informative commentary with your "lol" and "idiot" brackets. Maybe Facebook sucks and can't be bothered with helping the reporter. That does not make it ok for the reporter to go ahead and exploit it. And for what it's worth, I'm not a English speaker either so I can understand and forgive someone for not being a English speaker too. His report is very short and lazily written. It's not about the level of language skills. It's about the time and effort he put in on disclosing the vulnerability. Using simple language he could have written a step by step guide explaining the problem. The point is, regardless of Facebook's behavior, it is not ok for him to go ahead and exploit the bug on two different users one of them being the CEO of the company. And he did not put in enough effort to make them understand what he's talking about. He could have given it another shot with more details. Facebook is not trying to "save" money on the bounty program. The budget is already allocated and no one is sitting there crying over the couple of thousands of dollars and trying to stop people from getting it. If anything, he has caused damage to Facebook's image and reputation due to the negative publicity, greater than the amount he was going to be paid. So yes, if you post on Mark Zuckerberg's profile and create a news shit-storm of negative publicity against Facebook they are not going to thank you and pay you money.
- thezilch 13y ago
  I am sorry to have used your post as an example, but it's just ludicrous to expect everyone to know the rules. You keep deriding the reporter as lazy or lacking of simple things! His hack was lame; no one was hurt. Not even Facebook; nine 9s of their users don't won't know or care about such incidents. There's no telling that, had he used a whitehat account to repro the PoC, would they have paid any more attention; assuming the PoC can be performed on a whitehat account. It's not a stretch to think that a PoC against a real user should generate MORE attention. The point is, Facebook failed to educate the reporter. They can improve their process. As you say, the bounty is really immaterial; I don't even mention it. However, the system is not there to make Facebook's life easier; if they care to only handle and reward pristine reports, they have another thing coming.

borplk 13y ago

Very informative commentary with your "lol" and "idiot" brackets. Maybe Facebook sucks and can't be bothered with helping the reporter. That does not make it ok for the reporter to go ahead and exploit it. And for what it's worth, I'm not a English speaker either so I can understand and forgive someone for not being a English speaker too. His report is very short and lazily written. It's not about the level of language skills. It's about the time and effort he put in on disclosing the vulnerability. Using simple language he could have written a step by step guide explaining the problem. The point is, regardless of Facebook's behavior, it is not ok for him to go ahead and exploit the bug on two different users one of them being the CEO of the company. And he did not put in enough effort to make them understand what he's talking about. He could have given it another shot with more details. Facebook is not trying to "save" money on the bounty program. The budget is already allocated and no one is sitting there crying over the couple of thousands of dollars and trying to stop people from getting it. If anything, he has caused damage to Facebook's image and reputation due to the negative publicity, greater than the amount he was going to be paid. So yes, if you post on Mark Zuckerberg's profile and create a news shit-storm of negative publicity against Facebook they are not going to thank you and pay you money.

thezilch 13y ago
I am sorry to have used your post as an example, but it's just ludicrous to expect everyone to know the rules. You keep deriding the reporter as lazy or lacking of simple things! His hack was lame; no one was hurt. Not even Facebook; nine 9s of their users don't won't know or care about such incidents. There's no telling that, had he used a whitehat account to repro the PoC, would they have paid any more attention; assuming the PoC can be performed on a whitehat account. It's not a stretch to think that a PoC against a real user should generate MORE attention. The point is, Facebook failed to educate the reporter. They can improve their process. As you say, the bounty is really immaterial; I don't even mention it. However, the system is not there to make Facebook's life easier; if they care to only handle and reward pristine reports, they have another thing coming.