Disclosing the Primary Email address for each Facebook user

This is absolutely correct, there is a huge market for email lists, and even more so for highly targeted ones.

You could send emails to FB users directly to their facebook email (don't know whether this exists anymore). In 99% these emails were relayed directly to the users mailbox (probably with the added benefit of coming from the facebook.com domain).

Many reported this, but it was not eligible for bug bounty, it was a feature according to FB, even though it circumvented their pay 1$ to deliver your message to someone you are not friend with.

I've already seen that in Facebook ads, with people selling niche and probably auto generated products to me (my favorite was a shirt that says "I still miss Darius Milhaud"

Ahh my mistake. I didn't realise that you could just retrieve a full list of users for a group (I just tried it and you can) I suspect this API may be fairly closely watched however.

It shouldn't be surprising. The whole point of Facebook is sharing information. Not much point to a social network if your friends can't see a thing you post. Permeable membrane is permeable.

You started with two mistaken premises, which makes your analogy a poor comparison:

1. Facebook doesn't have "sloppy" security. The company and its software are massive and have many, many participants involved in the product and software development loop. You have unrealistic expectations for a company of that size with a consumer-facing product. Facebook continually recruits the best available talent in the security industry and empowers them to do their jobs without shooting themselves in the feet or getting kneecapped by cavalier product design. They also produce some of the best security research and implement best practices wherever they can.

I want you to look through any of Facebook's main or subsidiary applications and tell me how quickly you can identify CSRF, XSS, SQL injection, or a logical ACL failure like the one presented in this report. What you are not seeing is the utter deluge of bug bounty reports Facebook receives as a company and the nearly impeccable track record it has. The company receives over 80,000 reports each year, and fewer than 10% are valid security vulnerabilities. A tiny portion of those could be classified as "high" or "critical" severity.

You are also not seeing the meticulous, continually running machine that is the overall Facebook security organization. Not only are bug bounty participants aggressively recruited at Facebook, they are frequently put in charge of maintaining one of the most successful and recognizable bug bounty programs in the industry. Have a read through Ryan McGeehan's writings and presentations for a bit of insight into how much investment Facebook has put into incident response and security tooling in the past decade.

2. On a more technical level: rate-limiting is vastly simpler than overall security vulnerability resolution. It is comparatively straightforward to implement a rate limiting system with enough sophistication to combat a sizeable botnet attempting to crawl through a web application or automate user actions. Facebook does this using a variety of heuristics and even machine learning, with collaboration between the security (incident response), risk and data analysis teams doing the heavy lifting. While the work itself might not be easy, the deliberables and outcomes for such a system are very clear. In contrast, application security is a hard problem which primarily results from a software implementation that doesn't match the design spec (logical errors) or a design spec which fails to correctly incorporate a risk assessment. It is not straightforward to eliminate every vulnerability, because you can't just write a script that proves immunity from the OWASP Top Ten and be done with it.

No, I fully understand that, which is why I said "probably." However, it would be a sophisticated botnet to challenge Facebook's rate limiter, and moreover, it would still have the problem of producing an excessive amount of noise when Facebook saw an influx of users and IP addresses continually inviting and uninviting other users.

It's about more than just email addresses. This is the policy applied to all exploits for their entire platform.

You can, so long as the privacy setting "Who can look you up using the email address you provided?" is set to a value that exposes it.

Oh yeah of course, sorry.

This happens to me with arcane password requirements that only tell you the requirements after you reset it.

try various passwords -> "Invalid password" -> send reset password email -> click email -> "passwords require a special character AND a number AND an unprintable character" -> me: ooooh, its that one -> enter it -> "password already used" -> enter another password I'll definitely forget next time.

There are websites I need so occasionally that I'm sure that I have never logged in without resetting my password.

I always set them up so the first 20 email get forwarded. I'll notice if I stop getting notifications for friends and families birthdays.

Did you know that this behavior is widespread enough that pickpockets sometimes put up their own warning signs, so as to observe where people unconsciously touch their wallet through their outer clothes when they encounter the sign?

Also karma compared to selling the exploit to dodgy people on the darknet.

Hah. That's why I pointed out that you weren't one of those who complained about the payout. I just found it odd that someone would say they didn't want that to be discussed. I think it's an important part of the discussion. I definitely agree -- easy legal money is always preferable to sketchy darknet money.

I meant the comments here. They always follow the same route with Facebook / Google exploits.