6 ms·

After reading the messages between the white hat and Facebook, I do believe it is the right decision do not pay him. In his report he lacked the communication

by Radle 13y ago

After reading the messages between the white hat and Facebook, I do believe it is the right decision do not pay him. In his report he lacked the communication skills necessarily to make a useful bug report, which after my opinion caused the problem.

jaxb 13y ago
facebook's communication skills were not stellar either ('this is not a bug'). If you are taking reports from users about security problems, treat every one as real until proven otherwise.
- Radle 13y ago
  If you get over 90% fail rate? If you say you will pay 500Bucks per Bug reported, you will have a huge Fail rate, even if the Facebook Support is well Motivated after 3hours working, answering to 100Tickets you might not be able to understand something written in that way: "Rhe vulnerability allow’s facebook users to share posts to non friends facebook users , i made a post to sarah.goodin timeline and i got success post … of course you may cant see the link because sarah’s timeline friends posts shares only with her friends , you need to be a friend of her to see that post or you can use your own authority ."
  - jaxb 13y ago
    Yes. a) it's called triage and b) you won't want to miss that one report that blows your security wide open. The point is moot now, facebook says they took note and will ask for more details from now on.
rytis 13y ago
"lacked the communication skills"... seriously? how do you know? just because English is not his primary language and he had hard time expressing himself in an unfamiliar language does not mean that he "lacked the communication skills".
- Radle 13y ago
  We are not talking about being bad at English we are talking about being difficult to understand. Facebook gives 500$ per Bug reported, which ends up in a lot of Fail reports if somebody like this gets send: "Rhe vulnerability allow’s facebook users to share posts to non friends facebook users , i made a post to sarah.goodin timeline and i got success post … of course you may cant see the link because sarah’s timeline friends posts shares only with her friends , you need to be a friend of her to see that post or you can use your own authority ." You might mistake it for. "You can post something on a friends page and you can't see it if you aren't friend with that person"
  - sgift 13y ago
    I could perfectly understand it and English isn't my first language either. This is just Facebook weaseling themselves out of their promise by using bogus arguments. Besides that: If you do not understand a bug report for a security problem you ask for a clarification. That's what professionals do.
    - borplk 13y ago
      Facebook couldn't care less about the amount of bounty paid. That amount for Facebook is practically like a chocolate bar. They do not want to pay him because he exploited the bug he found two different times, once on the CEO's profile which has resulted in a very significant and negative PR for Facebook. Facebook will not say "Thanks for creating shitty PR for our brand and damaging our reputation, here have this money"
      - sgift 13y ago
        Sure, but the PR will be far more shitty if the reaction of the next hacker is "Sorry, I could have told you about this bug, but I have heard that you don't honor your bounty agreements, so I have sold it to others - Have fun!"
        borplk 13y ago
ronaldx 13y ago
> lacked the communication skills necessarily to make a useful bug report If anything, he had great communication skills. He overcame a non-native language barrier, while being conversationally blocked, and still made his point clearly. Besides, are communication skills the important skill here? I would say, not. Facebook do not pay white hat hackers at a level appropriate to their skill and work ($1m total? that's all?!) and now it's also clear they are looking for technicalities to avoid payment.
- kevcampb 13y ago
  $500 for a bug report. that'll be cheaper than a day's work for one of their developers
prawn 13y ago
Caused the problem? The real problem was that someone could post to any user's wall. That was a problem with Facebook caused by its own developers.
Terretta 13y ago
Radle, perhaps more communication skills are needed to understand Facebook's response here: I've reviewed our communication with this researcher, and I understand his frustration. He tried to report the bug responsibly, and we failed in our communication with him. Facebook says Facebook failed communication. "He tried, we failed," is pretty cut and dried.

by Radle 13y ago

jaxb 13y ago

facebook's communication skills were not stellar either ('this is not a bug'). If you are taking reports from users about security problems, treat every one as real until proven otherwise.

Radle 13y ago
If you get over 90% fail rate? If you say you will pay 500Bucks per Bug reported, you will have a huge Fail rate, even if the Facebook Support is well Motivated after 3hours working, answering to 100Tickets you might not be able to understand something written in that way: "Rhe vulnerability allow’s facebook users to share posts to non friends facebook users , i made a post to sarah.goodin timeline and i got success post … of course you may cant see the link because sarah’s timeline friends posts shares only with her friends , you need to be a friend of her to see that post or you can use your own authority ."
- jaxb 13y ago
  Yes. a) it's called triage and b) you won't want to miss that one report that blows your security wide open. The point is moot now, facebook says they took note and will ask for more details from now on.

rytis 13y ago

"lacked the communication skills"... seriously? how do you know? just because English is not his primary language and he had hard time expressing himself in an unfamiliar language does not mean that he "lacked the communication skills".

Radle 13y ago
We are not talking about being bad at English we are talking about being difficult to understand. Facebook gives 500$ per Bug reported, which ends up in a lot of Fail reports if somebody like this gets send: "Rhe vulnerability allow’s facebook users to share posts to non friends facebook users , i made a post to sarah.goodin timeline and i got success post … of course you may cant see the link because sarah’s timeline friends posts shares only with her friends , you need to be a friend of her to see that post or you can use your own authority ." You might mistake it for. "You can post something on a friends page and you can't see it if you aren't friend with that person"
- sgift 13y ago
  I could perfectly understand it and English isn't my first language either. This is just Facebook weaseling themselves out of their promise by using bogus arguments. Besides that: If you do not understand a bug report for a security problem you ask for a clarification. That's what professionals do.
  - borplk 13y ago
    Facebook couldn't care less about the amount of bounty paid. That amount for Facebook is practically like a chocolate bar. They do not want to pay him because he exploited the bug he found two different times, once on the CEO's profile which has resulted in a very significant and negative PR for Facebook. Facebook will not say "Thanks for creating shitty PR for our brand and damaging our reputation, here have this money"
    - sgift 13y ago
      Sure, but the PR will be far more shitty if the reaction of the next hacker is "Sorry, I could have told you about this bug, but I have heard that you don't honor your bounty agreements, so I have sold it to others - Have fun!"
      - borplk 13y ago

ronaldx 13y ago

> lacked the communication skills necessarily to make a useful bug report If anything, he had great communication skills. He overcame a non-native language barrier, while being conversationally blocked, and still made his point clearly. Besides, are communication skills the important skill here? I would say, not. Facebook do not pay white hat hackers at a level appropriate to their skill and work ($1m total? that's all?!) and now it's also clear they are looking for technicalities to avoid payment.

kevcampb 13y ago
$500 for a bug report. that'll be cheaper than a day's work for one of their developers

prawn 13y ago

Caused the problem? The real problem was that someone could post to any user's wall. That was a problem with Facebook caused by its own developers.

Terretta 13y ago

Radle, perhaps more communication skills are needed to understand Facebook's response here: I've reviewed our communication with this researcher, and I understand his frustration. He tried to report the bug responsibly, and we failed in our communication with him. Facebook says Facebook failed communication. "He tried, we failed," is pretty cut and dried.