12 ms·

Yes, he messed with real data, but he appears to have no idea that is a problem, given the blog post that spawned these numerous threads about the events that t

Yes, he messed with real data, but he appears to have no idea that is a problem, given the blog post that spawned these numerous threads about the events that transpired. FB did not follow up with him; did not explain the rules; he had no idea he had wronged anyone and thus expected a bounty (Re: his blog post to the public). FB could have avoided all of this and probably without the bounty; they could have explained the rules better and made sure he understood why no bounty was plausible.

aroch 13y ago
From his blog post: i report that exploit through whitehat --> www.facebook.com/whitehat So he clearly found the whitehat page. While English may not be his first language he clearly has some higher level understanding. The phrasing of "don't mess with data" is pretty clear: make a good faith effort to avoid privacy violations And if you look at testing accounts, it's also quite clear (emphasis mine): Please use a test account instead of a real account when investigating bugs. When you are unable to reproduce a bug with a test account, it is acceptable to use a real account, except for automated testing. Do not interact with other accounts without the consent of their owners.
- thezilch 13y ago
  I don't purport to know the reporter's acumen. It's not clear, at all, that he read (and all of) nor understood the "Info" page; he could have simply skimmed or went directly to the "Report" page. He could have located the page only after having produced the PoC. What is crystal clear though, FB could have responded better; they admit to that. The reporter has no obligation to them, especially when they won't give him a minute of their time. I'm not here to suggest one way or another on the bounty; there are obviously legal aspects that are not very interesting; he got his from the community, instead. Again, the fiasco -- bounty or not -- might have been avoided by FB having better responses -- boilerplate even -- to coach the reporter; in fact, they told him no bug was reported, so we could technically reach the conclusion that no "rules" were broken. Rules had to be broken -- again -- to escalate the issue; it's not even clear that using test accounts to demo the PoC would have produced a different response from "not a bug."
  - aroch 13y ago
    >in fact, they told him no bug was reported, so we could technically reach the conclusion that no "rules" were broken. Err, how do you come to that conclusion? It is against FB's ToS to knowingly muck with userdata that isn't yours or that you don't have permission to access. It doesn't matter what you're doing, knowingly messing with user data is against the ToS. And while yes, the FB staff member could have responded better I'm not terribly surprised or upset with how they did respond. Most of the text of the email was describing the author's lack of job. The "report" was simply a link with no real information. When sifting through bug reports, this one exudes "this isn't an actual bug"

aroch 13y ago

From his blog post: i report that exploit through whitehat --> www.facebook.com/whitehat So he clearly found the whitehat page. While English may not be his first language he clearly has some higher level understanding. The phrasing of "don't mess with data" is pretty clear: make a good faith effort to avoid privacy violations And if you look at testing accounts, it's also quite clear (emphasis mine): Please use a test account instead of a real account when investigating bugs. When you are unable to reproduce a bug with a test account, it is acceptable to use a real account, except for automated testing. Do not interact with other accounts without the consent of their owners.

thezilch 13y ago
I don't purport to know the reporter's acumen. It's not clear, at all, that he read (and all of) nor understood the "Info" page; he could have simply skimmed or went directly to the "Report" page. He could have located the page only after having produced the PoC. What is crystal clear though, FB could have responded better; they admit to that. The reporter has no obligation to them, especially when they won't give him a minute of their time. I'm not here to suggest one way or another on the bounty; there are obviously legal aspects that are not very interesting; he got his from the community, instead. Again, the fiasco -- bounty or not -- might have been avoided by FB having better responses -- boilerplate even -- to coach the reporter; in fact, they told him no bug was reported, so we could technically reach the conclusion that no "rules" were broken. Rules had to be broken -- again -- to escalate the issue; it's not even clear that using test accounts to demo the PoC would have produced a different response from "not a bug."
- aroch 13y ago
  >in fact, they told him no bug was reported, so we could technically reach the conclusion that no "rules" were broken. Err, how do you come to that conclusion? It is against FB's ToS to knowingly muck with userdata that isn't yours or that you don't have permission to access. It doesn't matter what you're doing, knowingly messing with user data is against the ToS. And while yes, the FB staff member could have responded better I'm not terribly surprised or upset with how they did respond. Most of the text of the email was describing the author's lack of job. The "report" was simply a link with no real information. When sifting through bug reports, this one exudes "this isn't an actual bug"