Is there something in here we're missing?
Someone finds exploit, gets the bounty, facebook fixes and we have a timeline.
Sounds like the system worked... are we looking for something else here?
Someone finds exploit, gets the bounty, facebook fixes and we have a timeline.
Sounds like the system worked... are we looking for something else here?
No. But some people, myself included, are interested in this sort of thing.
It's also interesting to see the timescales of the fix. Posts like this demonstrate that the system worked, albeit perhaps a bit slower than we'd like to imagine.
Whilst the reports of bug hunting apparently within the scope of the bug bounty resulting in a legal team responding with a false dichotomy between an NDA or prosecution are particularly juicy, it's also nice to hear about the cases where that isn't the outcome.
But a 6-9 month time to fix seems really long (also I would have thought a $1000 bug bounty is low for this type of exploit...but then again I'm not in this space too much to know the average rewards).
I guess you'd have to consider Facebook's track record in terms of how charitable vs. cynical you want to be in interpreting their actions.
Not to say that’s the way it is at Facebook, just what I’ve seen in the past.