5 ms·

Having dealt with fellow developers that don't have perfect english or thick accents I think it's quite unprofessional to dismiss someone's complaint without ev

by efuquen 13y ago

Having dealt with fellow developers that don't have perfect english or thick accents I think it's quite unprofessional to dismiss someone's complaint without even trying to understand them. It's great for us native English speakers that it's such a dominant language but I think we should all give a little more respect for others where it's clearly not their first language and they're the ones having to go out of their way to communicate with us. I for one am glad I don't have to deal with the bilingualism, with a bit more empathy and less dismissiveness the whole thing could have been avoided.

lttlrck 13y ago
I agree with that completely, however, common-sense should have told him that demonstrating an exploit on third-party was a really dumb idea. It has nothing to do with TOS or language barriers. That is why he isn't getting paid (yet?)
- AsymetricCom 13y ago
  I think it's more telling that the lack of professionalism displayed by an unemployed developer is the focus, and not the fact that an unemployed developer with a lack or professionalism discovered this hack. This could have been exploited so much worse than it was. Just because he didn't follow unwritten rules of disclosure, doesn't mean that Facebook didn't majorly mess up here. The details of the dev and his behavior are quite trivial, in this case.
  - jack-r-abbit 13y ago
    > Just because he didn't follow unwritten rules of disclosure Are you refering to those unwritten rule that are written here: https://www.facebook.com/whitehat https://www.facebook.com/whitehat
    - lewispollard 13y ago
      Someone in another thread pointed out that that page doesn't get translated when you set the language to Arabic, seems likely that the guy just couldn't understand the whitehat TOS for that reason.
      - jack-r-abbit 13y ago
        I don't view that as a valid excuse not to follow the rules. Admittedly, I don't know any other language than English. But if I was setting out to participate in a bounty program run by a company that didn't have their website in my language... I would most certainly make sure I had someone to tell me what the rules are. Other people have condemned him for not knowing English. I don't fault him for that. But there is no excuse for not knowing the rules.
        AsymetricCom 13y ago
        You still haven't explained why this matters. Facebook has a lot more responsibility than this developer. Get off your high horse. Even if Facebook wrote down these supposed "rules" they have no authority to enforce them (other then in relation of their supposed bounty program), so it's a moot point.
        jack-r-abbit 13y ago
        It matters because Facebook created their bounty program and created the rules around it. They absolutely have 100% authority to enforce them. There is nothing supposed about either the rules or the bounty program. They are not hypothetical. They both quite obviously exist and links to them prove their existence. I don't really follow what you are arguing. The developer has the responsibility to follow the rules of the program if he wants to participate in the program. He did not. Facebook has the responsibility to enforce the rules of the program. They did. So... yes... this is all moot.
        AsymetricCom 13y ago
        but this thread isnt about the bounty program.
gedrap 13y ago
I am not a native English speaker. Although I study in England (University of Manchester), I believe half of my course mates are not native speakers either. At least the ones who turn up to lectures. People try to explain their algorithms, ideas in broken English with damn thick accents but they DO explain. They put effort. From what he managed to write in the blog post, he CAN write English which is not THAT bad. But this dude doesn't really bother. Hey Facebook, there's a bug. Wanna know it? How about you... beg me to tell you? I am quoting him: whatever , i dont care for miss spelling , just the idea , i never correct an underline red word ;) Did FB treat it properly? No. Did he act properly? Not either. But since it's FB... THEY ARE EVIL!!!!111!
- anigbrowl 13y ago
  You do make a good point, but at the same time I was easily able to understand his original bug report. I agree that both sides should be making a little more effort, and engaging in a bit less drama.
  - ceol 13y ago
    He didn't make a bug report. He didn't specify how he could post to other peoples' walls. All he said was that he could, and that he already broke the ToS by using it on another person's account. This was his original report: -----Original Message to Facebook----- From: kha****@hotmail.com To: Subject: post to facebook users wall . Name: Ḱhalil E-Mail: khal****@hotmail.com Type: privacy Scope: www Description: dear facebook team . my name is khalil shreateh. i finished school with B.A degree in Infromation Systems . i would like to report a bug in your main site (www.facebook.com) which i discovered it . repro: the bug allow facebook users to share links to other facebook users , i tested it on sarah.goodin wall and i got success post link - > https://www.facebook.com/10151857333098885 -----End Original Message to Facebook----- From that, you surmised that he exploited the "make a new wall post" form by replacing the user ID with another of his choosing?
    - mtrimpe 13y ago
borplk 13y ago
It's not about a lack of English language skills. His English is actually good enough. In the post he posted on Mark's wall you can see the language is good enough and I saw the video interview too where he even spoke well enough. A technical and step-by-step report was well within his capability. He could attach screenshots or create a video demonstration. He used the bug on real users (2 of them!) one of them being Mark Zuckerberg which has obviously created huge negative PR for Facebook. If someone tests a bug on your Facebook account how happy would you be? Facebook can't reward someone who used a bug against its users. On top of that he has damaged their reputation too. Almost all major news sites have written headlines similar to "Palestinian developer hacked Mark Zuckerberg", "Security vulnerability found in Facebook" etc etc which I'm sure they are not super thrilled about.

by efuquen 13y ago

lttlrck 13y ago

I agree with that completely, however, common-sense should have told him that demonstrating an exploit on third-party was a really dumb idea. It has nothing to do with TOS or language barriers. That is why he isn't getting paid (yet?)

AsymetricCom 13y ago
I think it's more telling that the lack of professionalism displayed by an unemployed developer is the focus, and not the fact that an unemployed developer with a lack or professionalism discovered this hack. This could have been exploited so much worse than it was. Just because he didn't follow unwritten rules of disclosure, doesn't mean that Facebook didn't majorly mess up here. The details of the dev and his behavior are quite trivial, in this case.
- jack-r-abbit 13y ago
  > Just because he didn't follow unwritten rules of disclosure Are you refering to those unwritten rule that are written here: https://www.facebook.com/whitehat https://www.facebook.com/whitehat
  - lewispollard 13y ago
    Someone in another thread pointed out that that page doesn't get translated when you set the language to Arabic, seems likely that the guy just couldn't understand the whitehat TOS for that reason.
    - jack-r-abbit 13y ago
      I don't view that as a valid excuse not to follow the rules. Admittedly, I don't know any other language than English. But if I was setting out to participate in a bounty program run by a company that didn't have their website in my language... I would most certainly make sure I had someone to tell me what the rules are. Other people have condemned him for not knowing English. I don't fault him for that. But there is no excuse for not knowing the rules.
      - AsymetricCom 13y ago
        You still haven't explained why this matters. Facebook has a lot more responsibility than this developer. Get off your high horse. Even if Facebook wrote down these supposed "rules" they have no authority to enforce them (other then in relation of their supposed bounty program), so it's a moot point.
        jack-r-abbit 13y ago
        It matters because Facebook created their bounty program and created the rules around it. They absolutely have 100% authority to enforce them. There is nothing supposed about either the rules or the bounty program. They are not hypothetical. They both quite obviously exist and links to them prove their existence. I don't really follow what you are arguing. The developer has the responsibility to follow the rules of the program if he wants to participate in the program. He did not. Facebook has the responsibility to enforce the rules of the program. They did. So... yes... this is all moot.
        AsymetricCom 13y ago
        but this thread isnt about the bounty program.

gedrap 13y ago

I am not a native English speaker. Although I study in England (University of Manchester), I believe half of my course mates are not native speakers either. At least the ones who turn up to lectures. People try to explain their algorithms, ideas in broken English with damn thick accents but they DO explain. They put effort. From what he managed to write in the blog post, he CAN write English which is not THAT bad. But this dude doesn't really bother. Hey Facebook, there's a bug. Wanna know it? How about you... beg me to tell you? I am quoting him: whatever , i dont care for miss spelling , just the idea , i never correct an underline red word ;) Did FB treat it properly? No. Did he act properly? Not either. But since it's FB... THEY ARE EVIL!!!!111!

anigbrowl 13y ago
You do make a good point, but at the same time I was easily able to understand his original bug report. I agree that both sides should be making a little more effort, and engaging in a bit less drama.
- ceol 13y ago
  He didn't make a bug report. He didn't specify how he could post to other peoples' walls. All he said was that he could, and that he already broke the ToS by using it on another person's account. This was his original report: -----Original Message to Facebook----- From: kha****@hotmail.com To: Subject: post to facebook users wall . Name: Ḱhalil E-Mail: khal****@hotmail.com Type: privacy Scope: www Description: dear facebook team . my name is khalil shreateh. i finished school with B.A degree in Infromation Systems . i would like to report a bug in your main site (www.facebook.com) which i discovered it . repro: the bug allow facebook users to share links to other facebook users , i tested it on sarah.goodin wall and i got success post link - > https://www.facebook.com/10151857333098885 -----End Original Message to Facebook----- From that, you surmised that he exploited the "make a new wall post" form by replacing the user ID with another of his choosing?
  - mtrimpe 13y ago

borplk 13y ago

It's not about a lack of English language skills. His English is actually good enough. In the post he posted on Mark's wall you can see the language is good enough and I saw the video interview too where he even spoke well enough. A technical and step-by-step report was well within his capability. He could attach screenshots or create a video demonstration. He used the bug on real users (2 of them!) one of them being Mark Zuckerberg which has obviously created huge negative PR for Facebook. If someone tests a bug on your Facebook account how happy would you be? Facebook can't reward someone who used a bug against its users. On top of that he has damaged their reputation too. Almost all major news sites have written headlines similar to "Palestinian developer hacked Mark Zuckerberg", "Security vulnerability found in Facebook" etc etc which I'm sure they are not super thrilled about.