5 ms·

I haven't been paying close attention to this, so forgive the ignorance if I'm wrong: didn't he try to use the correct channels, but was turned away?

by fixxer 13y ago

yebyen 13y ago
The big idea as I understand it is: He proved the bug on a live account instead of one of the prescribed test accounts He reported it as "this is a bug" not as "this is the procedure to use in order to reproduce the bug" He demonstrated critical inability to report the steps required to reproduce the bug. It must get to the point where this money faucet receives hundreds of people submitting "bugs" where their friend has really left their account logged in and it's been exploited via social engineering, or some other "not a bug", so bugs are closed when they're submitted with not enough information. I understand and subscribe to this strategy myself.
- thezilch 13y ago
  You missed the part where FB -- admit to and are fixing -- lack any process to deal with those that are either not aware or don't understand the process. At no point do they instruct the reporter that it'd be helpful to provide more steps and that he should not be using live accounts to demonstrate the PoC. Nay, they merely shrugged him off and stated his actions were "not a bug."
  - yebyen 13y ago
    You know, I went looking for help on something this morning (why does ntop crash so much?) and at first all I could find was a post asking a similar question, and a reply about how to ask the question better. The GP replied (paraphrased) "there are a lot of posts on this board asking for help and 95% of the replies are about how to ask the question better. You would do well to try and read between the lines a little bit, just try interpreting and answering some questions instead of just posting all about how poorly the questions are asked." The point is, that guy wasn't offering money. He was supporting free software. I agree it's easy to make a blanket response for posts not providing enough information, but if they can't fill out the form correctly enough for the reviewer to duplicate the result, why should they get the money? Just to close the loop, I did find another post eventually where the author explains he "is aware" that ntop crashes frequently when it's configured to monitor multiple interfaces, and you should use the SVN builds since they are more robust. The bug still exists in FreeBSD and I update my ports tree every day. Searching for "ntop quits" again to put some dates on these posts, I see the complaint was in 2003 and the post addressing my issue was in 2011. I guess it still hasn't been fixed, but the software is still well-known. Anecdotes are like...
- fixxer 13y ago
  From that description, he sounds smart, but not well versed in proper protocols. Seems like there should be a way to filter such bug reports (a web form?).
- aioprisan 13y ago
  That's completely inaccurate. He responsibly disclosed the bug but Facebook security didn't have the right privacy settings turned on and was completely unresponsive to a huge security hole. So he did something non-malicious to get their attention and it was fixed in 5 minutes. See how that works?
  - yebyen 13y ago
    Your reply seems like the best, but it makes me angrier than the rest. You're lucky I only have one button! (upvote)
deleted 13y ago
[deleted]

I haven't been paying close attention to this, so forgive the ignorance if I'm wrong: didn't he try to use the correct channels, but was turned away?

by fixxer 13y ago

I haven't been paying close attention to this, so forgive the ignorance if I'm wrong: didn't he try to use the correct channels, but was turned away?

yebyen 13y ago

The big idea as I understand it is: He proved the bug on a live account instead of one of the prescribed test accounts He reported it as "this is a bug" not as "this is the procedure to use in order to reproduce the bug" He demonstrated critical inability to report the steps required to reproduce the bug. It must get to the point where this money faucet receives hundreds of people submitting "bugs" where their friend has really left their account logged in and it's been exploited via social engineering, or some other "not a bug", so bugs are closed when they're submitted with not enough information. I understand and subscribe to this strategy myself.

thezilch 13y ago
You missed the part where FB -- admit to and are fixing -- lack any process to deal with those that are either not aware or don't understand the process. At no point do they instruct the reporter that it'd be helpful to provide more steps and that he should not be using live accounts to demonstrate the PoC. Nay, they merely shrugged him off and stated his actions were "not a bug."
- yebyen 13y ago
  You know, I went looking for help on something this morning (why does ntop crash so much?) and at first all I could find was a post asking a similar question, and a reply about how to ask the question better. The GP replied (paraphrased) "there are a lot of posts on this board asking for help and 95% of the replies are about how to ask the question better. You would do well to try and read between the lines a little bit, just try interpreting and answering some questions instead of just posting all about how poorly the questions are asked." The point is, that guy wasn't offering money. He was supporting free software. I agree it's easy to make a blanket response for posts not providing enough information, but if they can't fill out the form correctly enough for the reviewer to duplicate the result, why should they get the money? Just to close the loop, I did find another post eventually where the author explains he "is aware" that ntop crashes frequently when it's configured to monitor multiple interfaces, and you should use the SVN builds since they are more robust. The bug still exists in FreeBSD and I update my ports tree every day. Searching for "ntop quits" again to put some dates on these posts, I see the complaint was in 2003 and the post addressing my issue was in 2011. I guess it still hasn't been fixed, but the software is still well-known. Anecdotes are like...
fixxer 13y ago
From that description, he sounds smart, but not well versed in proper protocols. Seems like there should be a way to filter such bug reports (a web form?).
aioprisan 13y ago
That's completely inaccurate. He responsibly disclosed the bug but Facebook security didn't have the right privacy settings turned on and was completely unresponsive to a huge security hole. So he did something non-malicious to get their attention and it was fixed in 5 minutes. See how that works?
- yebyen 13y ago
  Your reply seems like the best, but it makes me angrier than the rest. You're lucky I only have one button! (upvote)

deleted 13y ago

[deleted]