https://www.facebook.com/notes/alex-stamos/bug-bounty-ethics...
Critically:
At this point, it was reasonable to believe that Wes was operating on behalf of Synack. His account on our portal mentions Synack as his affiliation, he has interacted with us using a synack.com email address, and he has written blog posts that are used by Synack for marketing purposes.
Alex's timeline seems like it matches what I wrote earlier:
From Wes's blog post.
I don't know anything about security or about the people involved. But I read your quote, and I read the one above.
Unless Stamos explicitly disagrees with Wes's timeline of events, my interpretation of 'he has interacted with us using a synack.com email address' does not explicitly state that Wes used it in relation to the attack before the phone call to the CEO.
Happy for more evidence to be presented to show the contrary.
Also worth noting that this is frequently done in the security industry - folks will often credit not only themselves but also the companies they work with and are associated with in a security report.
He wasn't guessing. He didn't look the guy up on LinkedIn.
I don't really see how else you can interpret the defense "he has written blog posts that are used by Synack for marketing purposes".
And it's pointed out all over the thread, but no part of "the researcher signed up for the Facebook bounty program as an employee of Synack and used his Synack email to communicate with Facebook" is uncontested, nor is it supported by the text of Alex Stamos' response. You've just read in what you want to see.
> He "assumed" because the researcher signed up for the Facebook bounty program as an employee of Synack and used his Synack email to communicate with Facebook. He wasn't guessing. He didn't look the guy up on LinkedIn
This is a load of bolony / ass-covering by Alex - Facebook's bounty program explicitly deals with individuals only, not companies and Alex knows this. From https://www.facebook.com/whitehat/
> We only pay individuals
edit: down-voters, please point out the faults in my logic.
> I never contacted Facebook or Alex using my work email account. It was only after Alex contacted my employer via email that I sent a reply from my work account. Alex indirectly contacted me at work, not the other way around.
Can someone clarify exactly what portal is referred to here? Is it something besides https://www.facebook.com/whitehat/report/ ?
If not, this is a totally bogus excuse.
Alex's response uses extremely misleading language to justify the employer contact:
- "account on our portal mentions Synack as his affiliation" amounts to nothing more than "he lists his job on his facebook profile"
- "he has interacted with us using a synack.com email address" -- OP claims otherwise. Taking OP's word, the use of "has" perhaps prevents this from being an outright lie: yes, as of *right now* he "has" used a synack.com email. But did he before you reached out?
- "he has written blog posts that are used by Synack for marketing purposes" -- ... and? What does that have to do with anything?