11 ms·

Although this is blogspam, it's a blogspam that I can actually support... This is being covered a lot more widely because FB didn't just pay the guy. I know it

Although this is blogspam, it's a blogspam that I can actually support... This is being covered a lot more widely because FB didn't just pay the guy. I know it wasn't about money for FB, but this is easily done a lot more damage then they would have expected and because of their inadequate handling of a single bug report, I can only feel satisfied as I think this will go down as a good case study of how not to be so dismissive with critical bugs. (I still think they should pay the guy, and it should be double the $5k he would have expected to receive).

short_circut 13y ago
Dismissive and ignored? Did you read what he submitted to them? It made no sense. He vaguely stated that there was a bug and his education. His bug report was nonsensical. I am not even slightly surprised they ignored it. And he violated the TOS before he even ever tried to post to Zuckerberg's wall.
- mcphilip 13y ago
  I don't think it is as cut and dry as that. The reply that 'this is not a bug' showed a lack of concern that the reporter may have been having difficulties correctly submitting information about what would be a very significant defect, if true. A community member taking the time and interest to try and go through proper channels to submit a vulnerability should, IMO, be given more respect than was shown by FB.
  - Oculus 13y ago
    The problem here is that if FB took every single bug report that they got 100% seriously, they'd never get to the real bug reports, but would just constantly be sifting through the spam. You have to make educated guesses on whether or not a report is just useless spam. This report, the way it read, shoots off a lot of spam flags. I understand why he got dismissed so easily and frankly it is his fault. Nobody has enough staff to hold hands with every single bug submitter regardless of what they send.
    - walid 13y ago
      Hardly anyone files a bug for fun. I can't imagine that the masses would file bugs since they don't know what they are in the first place. So when anyone files a bug and attach their name with it, they should be taken seriously. What was more important was that he made it clear that he made a post on someone else's timeline without him being friends with them. Red flag right there.
      - madeofpalk 13y ago
        In the original thread a Facebook security researcher mentioned that they receive a lot of reports that just aren't bugs ("I view source and my password is there in plaintext!")
    - iyulaev 13y ago
      Replying "this is not a bug" is equivalent to saying "I have read and understood your report, and this is not a bug, it is a feature." First off, it's not a dismissal, it's an acknowledgement. Second, since it's not a bug but rather a feature, then how does using the feature violate the ToS? The correct reply might be something like "cannot understand or reproduce, can you explain more clearly?" along with some bug report guidelines.
      - yogo 13y ago
        Exactly! In any kind of support role the number one pattern you observe is that there is always a lack of information. Maybe they are flooded to the point where they really cannot respond to these reports, but from what I've seen over 2/3 of support requests and bug reports require extracting more information from the submitter (even when the form specifically states to provide as much detail as possible with examples). I just chalked this up to a guy that was so excited to have discovered such a major flaw on facebook in disbelief. And yes they have rules and guidelines in place to protect users but clearly this was a case where a little creativity in handling situations would have helped educate the developer that this isn't how things are done at FB and get him on the right path while acknowledging his contribution without celebrating it... amateurs. This was almost guaranteed to be a publicity incident but then again maybe any publicity is good publicity :).
- donohoe 13y ago
  It was tough enough to read his post to MZ wall. Clearly there was a language gap and the original bug report suffered as a result. I don't its such a big deal overall.
- ethanbond 13y ago
  Not figuring out a way to communicate with someone clearly having difficulty communicating is dismissive.
- zobzu 13y ago
  The fact that hes not english native and that communication seems hard for him does not mean that: - he did not do all this in good faith. it seems like he genuinely did. Sure there are TOS. But given his english, do you really think he understood them? Of course not. Good faith is a higher morale value (even thus Americans are pretty much used to "if it passed as law/text, morale values are irrelevant, cuz lawyers+money is all that matters) - $500 is less than peanuts for FB. Finding these bugs, even if they have to read into the guy's submission more than usual, is critical for FB. Refusing the bounty means that next time it'll be left unfixed and the bad guys will probably get it instead. All in all, FB's not wrong per say, but it's still a bad move from FB, morally and PR-wise.
  - LandoCalrissian 13y ago
    I think the important part too, is when he technically violated the TOS it was only to get their attention because he was otherwise being ignored. I don't see any reason they should not want to pay him.
    - jack-r-abbit 13y ago
      FWIW, his initial bug report included a link to a post he made on a non-friend's wall. So his first TOS violation was prior to his first attempt to file a bug. The second TOS violation (posting on Zuck's wall) was what got him press time.
  - rmc 13y ago
    Of course "good faith" goes both ways. Facebook has to act in good faith. If they don't, they can't demand others do to them.
- efuquen 13y ago
  Having dealt with fellow developers that don't have perfect english or thick accents I think it's quite unprofessional to dismiss someone's complaint without even trying to understand them. It's great for us native English speakers that it's such a dominant language but I think we should all give a little more respect for others where it's clearly not their first language and they're the ones having to go out of their way to communicate with us. I for one am glad I don't have to deal with the bilingualism, with a bit more empathy and less dismissiveness the whole thing could have been avoided.
  - lttlrck 13y ago
    I agree with that completely, however, common-sense should have told him that demonstrating an exploit on third-party was a really dumb idea. It has nothing to do with TOS or language barriers. That is why he isn't getting paid (yet?)
    - AsymetricCom 13y ago
      I think it's more telling that the lack of professionalism displayed by an unemployed developer is the focus, and not the fact that an unemployed developer with a lack or professionalism discovered this hack. This could have been exploited so much worse than it was. Just because he didn't follow unwritten rules of disclosure, doesn't mean that Facebook didn't majorly mess up here. The details of the dev and his behavior are quite trivial, in this case.
      - jack-r-abbit 13y ago
        > Just because he didn't follow unwritten rules of disclosure Are you refering to those unwritten rule that are written here: https://www.facebook.com/whitehat https://www.facebook.com/whitehat
        lewispollard 13y ago
        Someone in another thread pointed out that that page doesn't get translated when you set the language to Arabic, seems likely that the guy just couldn't understand the whitehat TOS for that reason.
- thezilch 13y ago
  I read it, but I don't assume to know the reporter knows how we do things, especially in light of security. The FB responses were absolutely dismissive, and I hope they have learned to, at least, setup some boilerplate responses. Perhaps they already have those, and the responder was simply doing a bad job. I suppose you've never received a bug report (much less a security report) from a client that hasn't the foggiest on even the difference between that blue "e" symbol that has the internets and that "orange swirly thing." Hindsight may be 20/20, but I'd absolutely expect my support or security team to respond with instruction on how and what steps should be taken to diligently report issues. FB did not even try to correct the wrong and dissuade the reporter from abusing users' pages.
- wereHamster 13y ago
  To all hackers: If you speak perfect english, please proceed to submit exploits to the FB security team and collect $5k on your way out. If not, post to blackhat forums and receive $10k. Or use the exploit to manipulate FB stock price (I'm sure posting as Mark would move the stock price significantly, if only for a few minutes. But that's enough to earn a lot more than $5k).
  - dsl 13y ago
    He posted on Mark's wall, not as him. Also, relative to other places you could be spending your time, FB security issues yield relatively little in the blackhat market because of their highly responsive abuse and security teams.
    - rmc 13y ago
      He posted on Mark's wall, not as him. Sure this bug was like that. But what if someone discovers a bug that allows you to post as the person?
      - dsl 13y ago
        What if I was able to send a fake press release on behalf of a company?[1] What if I hacked the Twitter account of a major press organization?[2] Eventually the SEC will require traders to seek independent verification before executing based on social data, or put stops in place similar to the flash crash protections. 1. http://www.sec.gov/news/press/2009/2009-226.htm http://www.sec.gov/news/press/2009/2009-226.htm 2. http://www.forbes.com/sites/jakezamansky/2013/05/01/the-twitter-crash-is-flash-crash-redux/ http://www.forbes.com/sites/jakezamansky/2013/05/01/the-twit...
        whatusername 13y ago
        Hell -- you don't even have to "hack" in to anything to do damage with a Press Release. Just Publish it anyway - most of the press is too lazy to double-check http://www.smh.com.au/business/mining-and-resources/hoax-press-release-sparks-whitehaven-plunge-20130107-2cc47.html http://www.smh.com.au/business/mining-and-resources/hoax-pre...
- rohunati 13y ago
  his first language is Arabic.
- skeletonjelly 13y ago
  Can we not get into this again? There are plenty of threads on the validity of this as a bug report.
macspoofing 13y ago
I can understand FB. They are trying to enforce some (reasonable) guidelines around white hat disclosure, namely, don't mess user data! I think they should be a little lenient in this case since it seems like he messed with only Zuckerberg's account, and because of the PR around it.
- rgbrenner 13y ago
  "they should be a little lenient in this case since it seems like he messed with only Zuckerberg's account" No, he posted to another persons account first (that was his initial bug report). Then he posted again to Zuckerberg's account when they ignored him. Also, it's too late to prevent the bad PR.. paying him now will only tell every other hacker that they can do whatever they want to facebook accounts/users, as long as they embarrass facebook with it afterward.
  - lightcatcher 13y ago
    I believe part of the whitehat payment program is to avoid the exact sort of PR Facebook is receiving from this episode. I agree that the guy should not be paid; he didn't follow the agreement.
  - toomuchtodo 13y ago
    You're right. Not paying him now tells hackers, "Sell your exploit; it'll be easier and less hassle."
    - webvictim 13y ago
      I hope that any credible hacker would be able to realise that to get paid for a white hat vulnerability, you have to use it in a white hat way - i.e. show your working in accordance with the security team's guidelines. Deliberately posting to other people's timelines "for exposure" isn't white hat in the slightest.
      - toomuchtodo 13y ago
ck2 13y ago
Have you see the interview on CNN with this guy? http://www.cnn.com/2013/08/19/tech/social-media/zuckerberg-facebook-hack/ http://www.cnn.com/2013/08/19/tech/social-media/zuckerberg-f... He is rather poor and had a tiny broken laptop that is missing five keys. He could have used that money and really tried to get them to see the problem. They should pay him just out of realizing what idiots they were. Someone should at least send him a better laptop.
- 001sky 13y ago
  r/random acts of laptop
__voidcast__ 13y ago
When I first saw the blog of this guy, just looking at the initial bug reports he mailed, I understood the nature of the bug this guy had discovered. It's strange that the people who are responsible for maintaining security at Facebook, failed to grasp that idea. It could be that they get so many bug reports a day, they have gotten in the habit of making fast initial judgments(which is natural). Maybe they made an initial judgement about this guy and then being biased, they failed at their job. If Facebook does not have a review of bug reports that they dismiss, and if this guy had not posted on MZ's profile, this bug would probably still exist.
FedRegister 13y ago
This is being covered a lot more widely because it's a distraction.

short_circut 13y ago

Dismissive and ignored? Did you read what he submitted to them? It made no sense. He vaguely stated that there was a bug and his education. His bug report was nonsensical. I am not even slightly surprised they ignored it. And he violated the TOS before he even ever tried to post to Zuckerberg's wall.

mcphilip 13y ago
I don't think it is as cut and dry as that. The reply that 'this is not a bug' showed a lack of concern that the reporter may have been having difficulties correctly submitting information about what would be a very significant defect, if true. A community member taking the time and interest to try and go through proper channels to submit a vulnerability should, IMO, be given more respect than was shown by FB.
- Oculus 13y ago
  The problem here is that if FB took every single bug report that they got 100% seriously, they'd never get to the real bug reports, but would just constantly be sifting through the spam. You have to make educated guesses on whether or not a report is just useless spam. This report, the way it read, shoots off a lot of spam flags. I understand why he got dismissed so easily and frankly it is his fault. Nobody has enough staff to hold hands with every single bug submitter regardless of what they send.
  - walid 13y ago
    Hardly anyone files a bug for fun. I can't imagine that the masses would file bugs since they don't know what they are in the first place. So when anyone files a bug and attach their name with it, they should be taken seriously. What was more important was that he made it clear that he made a post on someone else's timeline without him being friends with them. Red flag right there.
    - madeofpalk 13y ago
      In the original thread a Facebook security researcher mentioned that they receive a lot of reports that just aren't bugs ("I view source and my password is there in plaintext!")
  - iyulaev 13y ago
    Replying "this is not a bug" is equivalent to saying "I have read and understood your report, and this is not a bug, it is a feature." First off, it's not a dismissal, it's an acknowledgement. Second, since it's not a bug but rather a feature, then how does using the feature violate the ToS? The correct reply might be something like "cannot understand or reproduce, can you explain more clearly?" along with some bug report guidelines.
    - yogo 13y ago
      Exactly! In any kind of support role the number one pattern you observe is that there is always a lack of information. Maybe they are flooded to the point where they really cannot respond to these reports, but from what I've seen over 2/3 of support requests and bug reports require extracting more information from the submitter (even when the form specifically states to provide as much detail as possible with examples). I just chalked this up to a guy that was so excited to have discovered such a major flaw on facebook in disbelief. And yes they have rules and guidelines in place to protect users but clearly this was a case where a little creativity in handling situations would have helped educate the developer that this isn't how things are done at FB and get him on the right path while acknowledging his contribution without celebrating it... amateurs. This was almost guaranteed to be a publicity incident but then again maybe any publicity is good publicity :).
donohoe 13y ago
It was tough enough to read his post to MZ wall. Clearly there was a language gap and the original bug report suffered as a result. I don't its such a big deal overall.
ethanbond 13y ago
Not figuring out a way to communicate with someone clearly having difficulty communicating is dismissive.
zobzu 13y ago
The fact that hes not english native and that communication seems hard for him does not mean that: - he did not do all this in good faith. it seems like he genuinely did. Sure there are TOS. But given his english, do you really think he understood them? Of course not. Good faith is a higher morale value (even thus Americans are pretty much used to "if it passed as law/text, morale values are irrelevant, cuz lawyers+money is all that matters) - $500 is less than peanuts for FB. Finding these bugs, even if they have to read into the guy's submission more than usual, is critical for FB. Refusing the bounty means that next time it'll be left unfixed and the bad guys will probably get it instead. All in all, FB's not wrong per say, but it's still a bad move from FB, morally and PR-wise.
- LandoCalrissian 13y ago
  I think the important part too, is when he technically violated the TOS it was only to get their attention because he was otherwise being ignored. I don't see any reason they should not want to pay him.
  - jack-r-abbit 13y ago
    FWIW, his initial bug report included a link to a post he made on a non-friend's wall. So his first TOS violation was prior to his first attempt to file a bug. The second TOS violation (posting on Zuck's wall) was what got him press time.
- rmc 13y ago
  Of course "good faith" goes both ways. Facebook has to act in good faith. If they don't, they can't demand others do to them.
efuquen 13y ago
Having dealt with fellow developers that don't have perfect english or thick accents I think it's quite unprofessional to dismiss someone's complaint without even trying to understand them. It's great for us native English speakers that it's such a dominant language but I think we should all give a little more respect for others where it's clearly not their first language and they're the ones having to go out of their way to communicate with us. I for one am glad I don't have to deal with the bilingualism, with a bit more empathy and less dismissiveness the whole thing could have been avoided.
- lttlrck 13y ago
  I agree with that completely, however, common-sense should have told him that demonstrating an exploit on third-party was a really dumb idea. It has nothing to do with TOS or language barriers. That is why he isn't getting paid (yet?)
  - AsymetricCom 13y ago
    I think it's more telling that the lack of professionalism displayed by an unemployed developer is the focus, and not the fact that an unemployed developer with a lack or professionalism discovered this hack. This could have been exploited so much worse than it was. Just because he didn't follow unwritten rules of disclosure, doesn't mean that Facebook didn't majorly mess up here. The details of the dev and his behavior are quite trivial, in this case.
    - jack-r-abbit 13y ago
      > Just because he didn't follow unwritten rules of disclosure Are you refering to those unwritten rule that are written here: https://www.facebook.com/whitehat https://www.facebook.com/whitehat
      - lewispollard 13y ago
        Someone in another thread pointed out that that page doesn't get translated when you set the language to Arabic, seems likely that the guy just couldn't understand the whitehat TOS for that reason.
thezilch 13y ago
I read it, but I don't assume to know the reporter knows how we do things, especially in light of security. The FB responses were absolutely dismissive, and I hope they have learned to, at least, setup some boilerplate responses. Perhaps they already have those, and the responder was simply doing a bad job. I suppose you've never received a bug report (much less a security report) from a client that hasn't the foggiest on even the difference between that blue "e" symbol that has the internets and that "orange swirly thing." Hindsight may be 20/20, but I'd absolutely expect my support or security team to respond with instruction on how and what steps should be taken to diligently report issues. FB did not even try to correct the wrong and dissuade the reporter from abusing users' pages.
wereHamster 13y ago
To all hackers: If you speak perfect english, please proceed to submit exploits to the FB security team and collect $5k on your way out. If not, post to blackhat forums and receive $10k. Or use the exploit to manipulate FB stock price (I'm sure posting as Mark would move the stock price significantly, if only for a few minutes. But that's enough to earn a lot more than $5k).
- dsl 13y ago
  He posted on Mark's wall, not as him. Also, relative to other places you could be spending your time, FB security issues yield relatively little in the blackhat market because of their highly responsive abuse and security teams.
  - rmc 13y ago
    He posted on Mark's wall, not as him. Sure this bug was like that. But what if someone discovers a bug that allows you to post as the person?
    - dsl 13y ago
      What if I was able to send a fake press release on behalf of a company?[1] What if I hacked the Twitter account of a major press organization?[2] Eventually the SEC will require traders to seek independent verification before executing based on social data, or put stops in place similar to the flash crash protections. 1. http://www.sec.gov/news/press/2009/2009-226.htm http://www.sec.gov/news/press/2009/2009-226.htm 2. http://www.forbes.com/sites/jakezamansky/2013/05/01/the-twitter-crash-is-flash-crash-redux/ http://www.forbes.com/sites/jakezamansky/2013/05/01/the-twit...
      - whatusername 13y ago
        Hell -- you don't even have to "hack" in to anything to do damage with a Press Release. Just Publish it anyway - most of the press is too lazy to double-check http://www.smh.com.au/business/mining-and-resources/hoax-press-release-sparks-whitehaven-plunge-20130107-2cc47.html http://www.smh.com.au/business/mining-and-resources/hoax-pre...
rohunati 13y ago
his first language is Arabic.
skeletonjelly 13y ago
Can we not get into this again? There are plenty of threads on the validity of this as a bug report.

macspoofing 13y ago

I can understand FB. They are trying to enforce some (reasonable) guidelines around white hat disclosure, namely, don't mess user data! I think they should be a little lenient in this case since it seems like he messed with only Zuckerberg's account, and because of the PR around it.

rgbrenner 13y ago
"they should be a little lenient in this case since it seems like he messed with only Zuckerberg's account" No, he posted to another persons account first (that was his initial bug report). Then he posted again to Zuckerberg's account when they ignored him. Also, it's too late to prevent the bad PR.. paying him now will only tell every other hacker that they can do whatever they want to facebook accounts/users, as long as they embarrass facebook with it afterward.
- lightcatcher 13y ago
  I believe part of the whitehat payment program is to avoid the exact sort of PR Facebook is receiving from this episode. I agree that the guy should not be paid; he didn't follow the agreement.
- toomuchtodo 13y ago
  You're right. Not paying him now tells hackers, "Sell your exploit; it'll be easier and less hassle."
  - webvictim 13y ago
    I hope that any credible hacker would be able to realise that to get paid for a white hat vulnerability, you have to use it in a white hat way - i.e. show your working in accordance with the security team's guidelines. Deliberately posting to other people's timelines "for exposure" isn't white hat in the slightest.
    - toomuchtodo 13y ago

ck2 13y ago

Have you see the interview on CNN with this guy? http://www.cnn.com/2013/08/19/tech/social-media/zuckerberg-facebook-hack/ http://www.cnn.com/2013/08/19/tech/social-media/zuckerberg-f... He is rather poor and had a tiny broken laptop that is missing five keys. He could have used that money and really tried to get them to see the problem. They should pay him just out of realizing what idiots they were. Someone should at least send him a better laptop.

001sky 13y ago
r/random acts of laptop

__voidcast__ 13y ago

When I first saw the blog of this guy, just looking at the initial bug reports he mailed, I understood the nature of the bug this guy had discovered. It's strange that the people who are responsible for maintaining security at Facebook, failed to grasp that idea. It could be that they get so many bug reports a day, they have gotten in the habit of making fast initial judgments(which is natural). Maybe they made an initial judgement about this guy and then being biased, they failed at their job. If Facebook does not have a review of bug reports that they dismiss, and if this guy had not posted on MZ's profile, this bug would probably still exist.

FedRegister 13y ago

This is being covered a lot more widely because it's a distraction.