3 ms·
In order of desirability, the methods of dealing with a discovered exploit are: 1. Report to vendor and do not publicly discuss until they've fixed it 2. Demo
by peterkelly 13y ago
In order of desirability, the methods of dealing with a discovered exploit are:
1. Report to vendor and do not publicly discuss until they've fixed it
2. Demonstrate the exploit in public to prove that it works
3. Sell on the black market to Mafia/NSA/etc
The guy attempted approach (1), and didn't do a very good job of it, but it seems this was at least in part due to inexperience. Should he have worked more carefully to pursue option (1) first? Sure. But Facebook should have asked him for more information, perhaps pointing him to the guidelines.
So next he went to option (2). Facebook found the bug, and fixed it. Option (2) is infinitely better than option (3). I think Facebook should be extremely grateful to this guy - he even apologised for having to take this option in his post on MZ's wall, after (1) failed. Regardless of his & facebook's mistakes, they still should be thankful for him reporting it.
- diminoten 13y agoOption 2 is not "Post on real user's account", option 2 is "create account, use" or "use on established test account". He was wrong, period, to post to a user's page. 100% wrong, and has no right to ask for the money, because of that. Facebook's response is exactly the correct response - fix the miscommunication, but remain firm in the denial of money to someone who broke clear rules.
- lvs 13y agoYou're being a bit silly about this. The actual harm was nil.
- werid 13y agoit might be technically correct, but people don't behave like machines, so the expected outcome in the future is not clear.
- dalek_cannes 13y ago> "create account, use" You mean create a fake account? Isn't that against TOS? > "use on established test account" Where the instructions are in English, even after changing language? > He was wrong, period, to post to a user's page Mark Z. is not just any user. FB is publicly traded, yes, but he is basically Facebook. It's not like he 'hacked into' someone's account.
- dalorin 13y agoThe initial proof of concept post went to another user, not Mark Z. That was Facebook's basis for denying the claim.
- dalek_cannes 13y agoYou're right. Point withdrawn.
- dalorin 13y agoThe initial proof of concept post went to another user, not Mark Z. That was Facebook's basis for denying the claim.
- dustcoin 13y ago>You mean create a fake account? Isn't that against TOS? FB allows the creation of test accounts for security research https://www.facebook.com/whitehat/accounts/ https://www.facebook.com/whitehat/accounts/