4 ms·

The problem here is that if FB took every single bug report that they got 100% seriously, they'd never get to the real bug reports, but would just constantly be

by Oculus 13y ago

The problem here is that if FB took every single bug report that they got 100% seriously, they'd never get to the real bug reports, but would just constantly be sifting through the spam. You have to make educated guesses on whether or not a report is just useless spam. This report, the way it read, shoots off a lot of spam flags. I understand why he got dismissed so easily and frankly it is his fault. Nobody has enough staff to hold hands with every single bug submitter regardless of what they send.

walid 13y ago
Hardly anyone files a bug for fun. I can't imagine that the masses would file bugs since they don't know what they are in the first place. So when anyone files a bug and attach their name with it, they should be taken seriously. What was more important was that he made it clear that he made a post on someone else's timeline without him being friends with them. Red flag right there.
- madeofpalk 13y ago
  In the original thread a Facebook security researcher mentioned that they receive a lot of reports that just aren't bugs ("I view source and my password is there in plaintext!")
iyulaev 13y ago
Replying "this is not a bug" is equivalent to saying "I have read and understood your report, and this is not a bug, it is a feature." First off, it's not a dismissal, it's an acknowledgement. Second, since it's not a bug but rather a feature, then how does using the feature violate the ToS? The correct reply might be something like "cannot understand or reproduce, can you explain more clearly?" along with some bug report guidelines.
- yogo 13y ago
  Exactly! In any kind of support role the number one pattern you observe is that there is always a lack of information. Maybe they are flooded to the point where they really cannot respond to these reports, but from what I've seen over 2/3 of support requests and bug reports require extracting more information from the submitter (even when the form specifically states to provide as much detail as possible with examples). I just chalked this up to a guy that was so excited to have discovered such a major flaw on facebook in disbelief. And yes they have rules and guidelines in place to protect users but clearly this was a case where a little creativity in handling situations would have helped educate the developer that this isn't how things are done at FB and get him on the right path while acknowledging his contribution without celebrating it... amateurs. This was almost guaranteed to be a publicity incident but then again maybe any publicity is good publicity :).
- Oculus 13y ago
  I definitely agree with you on this. The response from the engineer could've been better. Some sort of canned response would have worked. IMHO, the whole ToS business was a way to give him a slap on the wrist for embarrassing them.
  - webvictim 13y ago
    Embarrassment is a very relative thing - it looks to me like the majority of comments on this HN post are saying the guy was in the wrong for breaking the TOS and I have to say I agree. Facebook haven't been embarrassed, they've just upheld a policy which says that they won't pay anyone who doesn't play by the rules. Quite fair, in my opinion.
    - synchronise 13y ago
      It is within our right however to protest against Facebook's decision, especially with the way it conducted itself before with the 'This is not a bug' response it gave.
    - fnordfnordfnord 13y ago
      >they've just upheld a policy which says that they won't pay anyone who doesn't play by the rules. Quite fair, in my opinion. My first thought is to say to facebook "Oh, I thought you were interested in fixing bugs. I'll know better what to do next time." Are you forgetting that the purpose of the bounty program is to protect facebook users by discovering and fixing bugs before spammers get the chance to use them? And that spammers pay real money for bugs like this one? It's an awfully high standard to hold people to, considering the fb ToS is not translated to the guy's native language.
santosha 13y ago
At USENIX this year, Chris Evans gave a talk about how Google does their VRP. Specifically, he mentioned that there weren't many false positive reports at all, way fewer than he expected there would be. In general, most bugs have something to them. Google has a long history of following up on bug reports with little or nothing to go on, because they take their jobs seriously, and aren't antagonistic to community bug hunters. FB would do well to take a leaf out of their book.
- Oculus 13y ago
  As I mentioned in the reply above, the engineer's response could've been many times better, but you have to agree the bug submitter gave them practically nothing to work with.
  - shiven 13y ago
    Clearly, any website the size of FB and its huge resources, needs to have an option for bug submitters to submit bugs in their NATIVE language. I bet if the submitter had written the bug report in Arabic, and FB had a professional translator on their security team (with some technical background), things might have been very different and we may not even be having this discussion.
  - santosha 13y ago
    Sure, the guy's bug report was terrible. However, the blame is squarely on FB. It's the security team's job to follow up, and to ask for more information if they don't have all the details. Contrast this with how Google responded when someone posted a Youtube video showing a Chrome exploit - they guessed that it was a Flash-based vector, collected millions of sample files and fuzzed for days to eventually discover the bug - based on a YouTube video that they could have also discarded as 'not a bug' based on lack of evidence.

by Oculus 13y ago

walid 13y ago

Hardly anyone files a bug for fun. I can't imagine that the masses would file bugs since they don't know what they are in the first place. So when anyone files a bug and attach their name with it, they should be taken seriously. What was more important was that he made it clear that he made a post on someone else's timeline without him being friends with them. Red flag right there.

madeofpalk 13y ago
In the original thread a Facebook security researcher mentioned that they receive a lot of reports that just aren't bugs ("I view source and my password is there in plaintext!")

iyulaev 13y ago

Replying "this is not a bug" is equivalent to saying "I have read and understood your report, and this is not a bug, it is a feature." First off, it's not a dismissal, it's an acknowledgement. Second, since it's not a bug but rather a feature, then how does using the feature violate the ToS? The correct reply might be something like "cannot understand or reproduce, can you explain more clearly?" along with some bug report guidelines.

yogo 13y ago
Exactly! In any kind of support role the number one pattern you observe is that there is always a lack of information. Maybe they are flooded to the point where they really cannot respond to these reports, but from what I've seen over 2/3 of support requests and bug reports require extracting more information from the submitter (even when the form specifically states to provide as much detail as possible with examples). I just chalked this up to a guy that was so excited to have discovered such a major flaw on facebook in disbelief. And yes they have rules and guidelines in place to protect users but clearly this was a case where a little creativity in handling situations would have helped educate the developer that this isn't how things are done at FB and get him on the right path while acknowledging his contribution without celebrating it... amateurs. This was almost guaranteed to be a publicity incident but then again maybe any publicity is good publicity :).
Oculus 13y ago
I definitely agree with you on this. The response from the engineer could've been better. Some sort of canned response would have worked. IMHO, the whole ToS business was a way to give him a slap on the wrist for embarrassing them.
- webvictim 13y ago
  Embarrassment is a very relative thing - it looks to me like the majority of comments on this HN post are saying the guy was in the wrong for breaking the TOS and I have to say I agree. Facebook haven't been embarrassed, they've just upheld a policy which says that they won't pay anyone who doesn't play by the rules. Quite fair, in my opinion.
  - synchronise 13y ago
    It is within our right however to protest against Facebook's decision, especially with the way it conducted itself before with the 'This is not a bug' response it gave.
  - fnordfnordfnord 13y ago
    >they've just upheld a policy which says that they won't pay anyone who doesn't play by the rules. Quite fair, in my opinion. My first thought is to say to facebook "Oh, I thought you were interested in fixing bugs. I'll know better what to do next time." Are you forgetting that the purpose of the bounty program is to protect facebook users by discovering and fixing bugs before spammers get the chance to use them? And that spammers pay real money for bugs like this one? It's an awfully high standard to hold people to, considering the fb ToS is not translated to the guy's native language.

santosha 13y ago

At USENIX this year, Chris Evans gave a talk about how Google does their VRP. Specifically, he mentioned that there weren't many false positive reports at all, way fewer than he expected there would be. In general, most bugs have something to them. Google has a long history of following up on bug reports with little or nothing to go on, because they take their jobs seriously, and aren't antagonistic to community bug hunters. FB would do well to take a leaf out of their book.

Oculus 13y ago
As I mentioned in the reply above, the engineer's response could've been many times better, but you have to agree the bug submitter gave them practically nothing to work with.
- shiven 13y ago
  Clearly, any website the size of FB and its huge resources, needs to have an option for bug submitters to submit bugs in their NATIVE language. I bet if the submitter had written the bug report in Arabic, and FB had a professional translator on their security team (with some technical background), things might have been very different and we may not even be having this discussion.
- santosha 13y ago
  Sure, the guy's bug report was terrible. However, the blame is squarely on FB. It's the security team's job to follow up, and to ask for more information if they don't have all the details. Contrast this with how Google responded when someone posted a Youtube video showing a Chrome exploit - they guessed that it was a Flash-based vector, collected millions of sample files and fuzzed for days to eventually discover the bug - based on a YouTube video that they could have also discarded as 'not a bug' based on lack of evidence.