3 ms·
Very informative commentary with your "lol" and "idiot" brackets. Maybe Facebook sucks and can't be bothered with helping the reporter. That does not make it
by borplk 13y ago
Very informative commentary with your "lol" and "idiot" brackets.
Maybe Facebook sucks and can't be bothered with helping the reporter.
That does not make it ok for the reporter to go ahead and exploit it.
And for what it's worth, I'm not a English speaker either so I can understand and forgive someone for not being a English speaker too.
His report is very short and lazily written. It's not about the level of language skills. It's about the time and effort he put in on disclosing the vulnerability.
Using simple language he could have written a step by step guide explaining the problem.
The point is, regardless of Facebook's behavior, it is not ok for him to go ahead and exploit the bug on two different users one of them being the CEO of the company. And he did not put in enough effort to make them understand what he's talking about. He could have given it another shot with more details.
Facebook is not trying to "save" money on the bounty program. The budget is already allocated and no one is sitting there crying over the couple of thousands of dollars and trying to stop people from getting it.
If anything, he has caused damage to Facebook's image and reputation due to the negative publicity, greater than the amount he was going to be paid.
So yes, if you post on Mark Zuckerberg's profile and create a news shit-storm of negative publicity against Facebook they are not going to thank you and pay you money.
- thezilch 13y agoI am sorry to have used your post as an example, but it's just ludicrous to expect everyone to know the rules. You keep deriding the reporter as lazy or lacking of simple things! His hack was lame; no one was hurt. Not even Facebook; nine 9s of their users don't won't know or care about such incidents. There's no telling that, had he used a whitehat account to repro the PoC, would they have paid any more attention; assuming the PoC can be performed on a whitehat account. It's not a stretch to think that a PoC against a real user should generate MORE attention. The point is, Facebook failed to educate the reporter. They can improve their process. As you say, the bounty is really immaterial; I don't even mention it. However, the system is not there to make Facebook's life easier; if they care to only handle and reward pristine reports, they have another thing coming.