4 ms·
He didn't make a bug report. He didn't specify how he could post to other peoples' walls. All he said was that he could, and that he already broke the ToS by us
by ceol 13y ago
He didn't make a bug report. He didn't specify how he could post to other peoples' walls. All he said was that he could, and that he already broke the ToS by using it on another person's account. This was his original report:
-----Original Message to Facebook-----
From: kha****@hotmail.com
To:
Subject: post to facebook users wall .
Name: Ḱhalil
E-Mail: khal****@hotmail.com
Type: privacy
Scope: www
Description: dear facebook team .
my name is khalil shreateh.
i finished school with B.A degree in Infromation Systems .
i would like to report a bug in your main site
(www.facebook.com) which i discovered it .
repro:
the bug allow facebook users to share links to other
facebook users , i tested it on sarah.goodin wall and i
got success post
link - > https://www.facebook.com/10151857333098885
-----End Original Message to Facebook-----
From that, you surmised that he exploited the "make a new wall post" form by replacing the user ID with another of his choosing?
- mtrimpe 13y agoWhen you're working across cultural boundaries you realise that most problems stem from an incorrect assumption. In this case Khalil probably held the incorrect assumption that an actual demonstration of the bug would be how Facebook would want this to be reported, hence the lack of details. It's not unreasonable for him to think Facebook would take a look at their HTTP logs to find out what happened.
- anigbrowl 13y agoEnough to get a sense of his thinking there was a problem, and look up his and Goodin's accounts to see what he meant. Certainly it warranted clarification, and I sppreciate that the FB support team must get a lot of nonsense/stupid requests, but that's why they get paid the big bucks.