3 ms·

I am the only person out there that agrees he shouldn't receive a bounty?! Facebook's stance is akin to "we don't negotiate with terrorists". Although obviousl

by mafro 13y ago

I am the only person out there that agrees he shouldn't receive a bounty?! Facebook's stance is akin to "we don't negotiate with terrorists". Although obviously this wasn't malicious (or "terrorism"); just a case of a foolish newbie who failed to follow the rules.

rogerbinns 13y ago
> just a case of a foolish newbie who failed to follow the rules How was he foolish? Also the rules weren't written in his first language. Intent matters[1]. Facebook needs to be the first place people like him go, and be welcoming. Facebook could do many things that don't involve paying a bounty directly. For example they could make a donation of the same amount to a suitable school or charity in his area. [1] For example we do that when people are killed http://en.wikipedia.org/wiki/Murder_(United_States_law)#Degrees_of_murder_in_the_United_States http://en.wikipedia.org/wiki/Murder_(United_States_law)#Degr...
arthulia 13y ago
You have to remember why these bounty programs exist in the first place. The whole point is to discourage people from selling the exploits to more unscrupulous parties. This guy had good intentions and he made a mistake because he wasn't as familiar with the ToS as he should have been. They should warn him about following the ToS in the future, and then they should give him his bounty. Foolish newbies with noble intentions deserve second chances.
abhididdigi 13y ago
> just a case of a foolish newbie who failed to follow the rules He did follow the rules. Just that he didn't know to express them. And what made you think he is foolish?
cheald 13y ago
I guess next time he should just sell the exploit on the black market then.
- borplk 13y ago
  If he's the kind who would sell the exploit next time, Facebook isn't interested in rewarding him anyways. Bounty programs are not there to create a more appealing market and out-bid the black hat hackers.
  - Blahah 13y ago
    That's exactly what they're there for. They encourage and reward a white-hat culture.
    - borplk 13y ago
      Bounty programs do not attempt to compete with black hat markets or outbid black market rates. The purpose of bounty is to encourage white hat hackers to challenge one specific application instead of millions of other applications out there that the white hat hacker could spend his/her time on. So it's saying "Hey...instead of working on that random application why don't you try to hack us because hey you could earn some money too". It's assumed that the person is a white hat hacker who would not sell the bug in black market anyways, even if there was no bounty.
jasonlotito 13y ago
Technically, he did follow the rules. Exactly. And was expressly told by a Facebook Security person that what he was doing was not a bug.
- jack-r-abbit 13y ago
  His initial bug report included a link to a post he made, using the exploit, on a user's account that was not a friend. The timeline of all that makes it very clear that he violated the TOS, thus the whitehat program rules, prior to reporting the bug.
  - jasonlotito 13y ago
    I know the timeline. As explained by the security person at Facebook, it was not a bug. They were mistaken. However, the fact is, he wasn't penalized for that incident. Rather, the incident with MZ's account. So, by statement still stands. Unless you want to contend that we should assume we know better than Facebook Security and ignore what they says is and isn't a violation/bug?
    - jack-r-abbit 13y ago
      You said: Technically, he did follow the rules. Exactly. But the rules exactly say not to mess with real users. So there is not really any "technically following the rules" when he so clearly did NOT follow the rules. Despite the many headlines talking about the guy who hacked Zuckerburg's Facebook account, I am unaware of any report that specifically calls out the violation of Zuck's account as the reason he is not getting paid. What I've seen are simply citing the fact that Facebook will not pay the bounty if you mess with real users, per the whitehat program's rules. He messed with a real user prior to Zuck... so one can rightfully assume that even if he had not messed with Zuck, he still would not have been paid the bounty. But he also would not have received the press he did.

by mafro 13y ago

rogerbinns 13y ago

> just a case of a foolish newbie who failed to follow the rules How was he foolish? Also the rules weren't written in his first language. Intent matters[1]. Facebook needs to be the first place people like him go, and be welcoming. Facebook could do many things that don't involve paying a bounty directly. For example they could make a donation of the same amount to a suitable school or charity in his area. [1] For example we do that when people are killed http://en.wikipedia.org/wiki/Murder_(United_States_law)#Degrees_of_murder_in_the_United_States http://en.wikipedia.org/wiki/Murder_(United_States_law)#Degr...

arthulia 13y ago

You have to remember why these bounty programs exist in the first place. The whole point is to discourage people from selling the exploits to more unscrupulous parties. This guy had good intentions and he made a mistake because he wasn't as familiar with the ToS as he should have been. They should warn him about following the ToS in the future, and then they should give him his bounty. Foolish newbies with noble intentions deserve second chances.

abhididdigi 13y ago

> just a case of a foolish newbie who failed to follow the rules He did follow the rules. Just that he didn't know to express them. And what made you think he is foolish?

cheald 13y ago

I guess next time he should just sell the exploit on the black market then.

borplk 13y ago
If he's the kind who would sell the exploit next time, Facebook isn't interested in rewarding him anyways. Bounty programs are not there to create a more appealing market and out-bid the black hat hackers.
- Blahah 13y ago
  That's exactly what they're there for. They encourage and reward a white-hat culture.
  - borplk 13y ago
    Bounty programs do not attempt to compete with black hat markets or outbid black market rates. The purpose of bounty is to encourage white hat hackers to challenge one specific application instead of millions of other applications out there that the white hat hacker could spend his/her time on. So it's saying "Hey...instead of working on that random application why don't you try to hack us because hey you could earn some money too". It's assumed that the person is a white hat hacker who would not sell the bug in black market anyways, even if there was no bounty.

jasonlotito 13y ago

Technically, he did follow the rules. Exactly. And was expressly told by a Facebook Security person that what he was doing was not a bug.

jack-r-abbit 13y ago
His initial bug report included a link to a post he made, using the exploit, on a user's account that was not a friend. The timeline of all that makes it very clear that he violated the TOS, thus the whitehat program rules, prior to reporting the bug.
- jasonlotito 13y ago
  I know the timeline. As explained by the security person at Facebook, it was not a bug. They were mistaken. However, the fact is, he wasn't penalized for that incident. Rather, the incident with MZ's account. So, by statement still stands. Unless you want to contend that we should assume we know better than Facebook Security and ignore what they says is and isn't a violation/bug?
  - jack-r-abbit 13y ago
    You said: Technically, he did follow the rules. Exactly. But the rules exactly say not to mess with real users. So there is not really any "technically following the rules" when he so clearly did NOT follow the rules. Despite the many headlines talking about the guy who hacked Zuckerburg's Facebook account, I am unaware of any report that specifically calls out the violation of Zuck's account as the reason he is not getting paid. What I've seen are simply citing the fact that Facebook will not pay the bounty if you mess with real users, per the whitehat program's rules. He messed with a real user prior to Zuck... so one can rightfully assume that even if he had not messed with Zuck, he still would not have been paid the bounty. But he also would not have received the press he did.