Hacker News Reader

Comment by chrisacky | Hacker News Reader

Although this is blogspam, it's a blogspam that I can actually support...

This is being covered a lot more widely because FB didn't just pay the guy. I know it wasn't about money for FB, but this is easily done a lot more damage then they would have expected and because of their inadequate handling of a single bug report, I can only feel satisfied as I think this will go down as a good case study of how not to be so dismissive with critical bugs.

(I still think they should pay the guy, and it should be double the $5k he would have expected to receive).

View on HN

Dismissive and ignored? Did you read what he submitted to them? It made no sense. He vaguely stated that there was a bug and his education. His bug report was nonsensical. I am not even slightly surprised they ignored it. And he violated the TOS before he even ever tried to post to Zuckerberg's wall.

I don't think it is as cut and dry as that. The reply that 'this is not a bug' showed a lack of concern that the reporter may have been having difficulties correctly submitting information about what would be a very significant defect, if true.

A community member taking the time and interest to try and go through proper channels to submit a vulnerability should, IMO, be given more respect than was shown by FB.

The problem here is that if FB took every single bug report that they got 100% seriously, they'd never get to the real bug reports, but would just constantly be sifting through the spam. You have to make educated guesses on whether or not a report is just useless spam. This report, the way it read, shoots off a lot of spam flags. I understand why he got dismissed so easily and frankly it is his fault. Nobody has enough staff to hold hands with every single bug submitter regardless of what they send.

Replying "this is not a bug" is equivalent to saying "I have read and understood your report, and this is not a bug, it is a feature." First off, it's not a dismissal, it's an acknowledgement. Second, since it's not a bug but rather a feature, then how does using the feature violate the ToS?

The correct reply might be something like "cannot understand or reproduce, can you explain more clearly?" along with some bug report guidelines.

I definitely agree with you on this. The response from the engineer could've been better. Some sort of canned response would have worked.

IMHO, the whole ToS business was a way to give him a slap on the wrist for embarrassing them.

Embarrassment is a very relative thing - it looks to me like the majority of comments on this HN post are saying the guy was in the wrong for breaking the TOS and I have to say I agree. Facebook haven't been embarrassed, they've just upheld a policy which says that they won't pay anyone who doesn't play by the rules. Quite fair, in my opinion.

It is within our right however to protest against Facebook's decision, especially with the way it conducted itself before with the 'This is not a bug' response it gave.

>they've just upheld a policy which says that they won't pay anyone who doesn't play by the rules. Quite fair, in my opinion.

My first thought is to say to facebook "Oh, I thought you were interested in fixing bugs. I'll know better what to do next time." Are you forgetting that the purpose of the bounty program is to protect facebook users by discovering and fixing bugs before spammers get the chance to use them? And that spammers pay real money for bugs like this one?

It's an awfully high standard to hold people to, considering the fb ToS is not translated to the guy's native language.

Exactly! In any kind of support role the number one pattern you observe is that there is always a lack of information. Maybe they are flooded to the point where they really cannot respond to these reports, but from what I've seen over 2/3 of support requests and bug reports require extracting more information from the submitter (even when the form specifically states to provide as much detail as possible with examples).

I just chalked this up to a guy that was so excited to have discovered such a major flaw on facebook in disbelief. And yes they have rules and guidelines in place to protect users but clearly this was a case where a little creativity in handling situations would have helped educate the developer that this isn't how things are done at FB and get him on the right path while acknowledging his contribution without celebrating it... amateurs. This was almost guaranteed to be a publicity incident but then again maybe any publicity is good publicity :).

At USENIX this year, Chris Evans gave a talk about how Google does their VRP. Specifically, he mentioned that there weren't many false positive reports at all, way fewer than he expected there would be. In general, most bugs have something to them. Google has a long history of following up on bug reports with little or nothing to go on, because they take their jobs seriously, and aren't antagonistic to community bug hunters. FB would do well to take a leaf out of their book.

As I mentioned in the reply above, the engineer's response could've been many times better, but you have to agree the bug submitter gave them practically nothing to work with.

Clearly, any website the size of FB and its huge resources, needs to have an option for bug submitters to submit bugs in their NATIVE language.

I bet if the submitter had written the bug report in Arabic, and FB had a professional translator on their security team (with some technical background), things might have been very different and we may not even be having this discussion.

Sure, the guy's bug report was terrible. However, the blame is squarely on FB. It's the security team's job to follow up, and to ask for more information if they don't have all the details.

Contrast this with how Google responded when someone posted a Youtube video showing a Chrome exploit - they guessed that it was a Flash-based vector, collected millions of sample files and fuzzed for days to eventually discover the bug - based on a YouTube video that they could have also discarded as 'not a bug' based on lack of evidence.

Hardly anyone files a bug for fun. I can't imagine that the masses would file bugs since they don't know what they are in the first place. So when anyone files a bug and attach their name with it, they should be taken seriously. What was more important was that he made it clear that he made a post on someone else's timeline without him being friends with them. Red flag right there.

In the original thread a Facebook security researcher mentioned that they receive a lot of reports that just aren't bugs ("I view source and my password is there in plaintext!")

It was tough enough to read his post to MZ wall.

Clearly there was a language gap and the original bug report suffered as a result. I don't its such a big deal overall.

Not figuring out a way to communicate with someone clearly having difficulty communicating is dismissive.

The fact that hes not english native and that communication seems hard for him does not mean that:

- he did not do all this in good faith. it seems like he genuinely did. Sure there are TOS. But given his english, do you really think he understood them? Of course not. Good faith is a higher morale value (even thus Americans are pretty much used to "if it passed as law/text, morale values are irrelevant, cuz lawyers+money is all that matters)

- $500 is less than peanuts for FB. Finding these bugs, even if they have to read into the guy's submission more than usual, is critical for FB. Refusing the bounty means that next time it'll be left unfixed and the bad guys will probably get it instead.

All in all, FB's not wrong per say, but it's still a bad move from FB, morally and PR-wise.

I think the important part too, is when he technically violated the TOS it was only to get their attention because he was otherwise being ignored. I don't see any reason they should not want to pay him.

FWIW, his initial bug report included a link to a post he made on a non-friend's wall. So his first TOS violation was prior to his first attempt to file a bug. The second TOS violation (posting on Zuck's wall) was what got him press time.

Of course "good faith" goes both ways. Facebook has to act in good faith. If they don't, they can't demand others do to them.

Having dealt with fellow developers that don't have perfect english or thick accents I think it's quite unprofessional to dismiss someone's complaint without even trying to understand them. It's great for us native English speakers that it's such a dominant language but I think we should all give a little more respect for others where it's clearly not their first language and they're the ones having to go out of their way to communicate with us. I for one am glad I don't have to deal with the bilingualism, with a bit more empathy and less dismissiveness the whole thing could have been avoided.

I agree with that completely, however, common-sense should have told him that demonstrating an exploit on third-party was a really dumb idea. It has nothing to do with TOS or language barriers.

That is why he isn't getting paid (yet?)

I think it's more telling that the lack of professionalism displayed by an unemployed developer is the focus, and not the fact that an unemployed developer with a lack or professionalism discovered this hack. This could have been exploited so much worse than it was. Just because he didn't follow unwritten rules of disclosure, doesn't mean that Facebook didn't majorly mess up here. The details of the dev and his behavior are quite trivial, in this case.

> Just because he didn't follow unwritten rules of disclosure

Are you refering to those unwritten rule that are written here: https://www.facebook.com/whitehat

Someone in another thread pointed out that that page doesn't get translated when you set the language to Arabic, seems likely that the guy just couldn't understand the whitehat TOS for that reason.

I don't view that as a valid excuse not to follow the rules. Admittedly, I don't know any other language than English. But if I was setting out to participate in a bounty program run by a company that didn't have their website in my language... I would most certainly make sure I had someone to tell me what the rules are. Other people have condemned him for not knowing English. I don't fault him for that. But there is no excuse for not knowing the rules.

You still haven't explained why this matters. Facebook has a lot more responsibility than this developer. Get off your high horse. Even if Facebook wrote down these supposed "rules" they have no authority to enforce them (other then in relation of their supposed bounty program), so it's a moot point.

It matters because Facebook created their bounty program and created the rules around it. They absolutely have 100% authority to enforce them. There is nothing supposed about either the rules or the bounty program. They are not hypothetical. They both quite obviously exist and links to them prove their existence. I don't really follow what you are arguing. The developer has the responsibility to follow the rules of the program if he wants to participate in the program. He did not. Facebook has the responsibility to enforce the rules of the program. They did. So... yes... this is all moot.

but this thread isnt about the bounty program.

You brought up the rules of disclosure... not me. And you said they were unwritten... so I was trying to let you know that they are, in fact, written. If you were not talking about the bounty program then I have no idea what rules of disclosure you are talking about and I'll move on.

I am not a native English speaker. Although I study in England (University of Manchester), I believe half of my course mates are not native speakers either. At least the ones who turn up to lectures. People try to explain their algorithms, ideas in broken English with damn thick accents but they DO explain. They put effort.

From what he managed to write in the blog post, he CAN write English which is not THAT bad.

But this dude doesn't really bother. Hey Facebook, there's a bug. Wanna know it? How about you... beg me to tell you?

I am quoting him: whatever , i dont care for miss spelling , just the idea , i never correct an underline red word ;)

Did FB treat it properly? No. Did he act properly? Not either. But since it's FB... THEY ARE EVIL!!!!111!

You do make a good point, but at the same time I was easily able to understand his original bug report. I agree that both sides should be making a little more effort, and engaging in a bit less drama.

He didn't make a bug report. He didn't specify how he could post to other peoples' walls. All he said was that he could, and that he already broke the ToS by using it on another person's account. This was his original report:

    -----Original Message to Facebook-----
    From: kha****@hotmail.com
    To:
    Subject: post to facebook users wall .

    Name: Ḱhalil
    E-Mail: khal****@hotmail.com
    Type: privacy
    Scope: www
    Description: dear facebook team .

    my name is khalil shreateh.
    i finished school with B.A degree in Infromation Systems .

    i would like to report a bug in your main site
    (www.facebook.com) which i discovered it .

    repro:
    the bug allow facebook users to share links to other 
    facebook users , i tested it on sarah.goodin wall and i 
    got success post
    link - > https://www.facebook.com/10151857333098885
    -----End Original Message to Facebook-----

From that, you surmised that he exploited the "make a new wall post" form by replacing the user ID with another of his choosing?

When you're working across cultural boundaries you realise that most problems stem from an incorrect assumption.

In this case Khalil probably held the incorrect assumption that an actual demonstration of the bug would be how Facebook would want this to be reported, hence the lack of details.

It's not unreasonable for him to think Facebook would take a look at their HTTP logs to find out what happened.

Enough to get a sense of his thinking there was a problem, and look up his and Goodin's accounts to see what he meant. Certainly it warranted clarification, and I sppreciate that the FB support team must get a lot of nonsense/stupid requests, but that's why they get paid the big bucks.

It's not about a lack of English language skills.

His English is actually good enough. In the post he posted on Mark's wall you can see the language is good enough and I saw the video interview too where he even spoke well enough.

A technical and step-by-step report was well within his capability.

He could attach screenshots or create a video demonstration.

He used the bug on real users (2 of them!) one of them being Mark Zuckerberg which has obviously created huge negative PR for Facebook.

If someone tests a bug on your Facebook account how happy would you be?

Facebook can't reward someone who used a bug against its users.

On top of that he has damaged their reputation too. Almost all major news sites have written headlines similar to "Palestinian developer hacked Mark Zuckerberg", "Security vulnerability found in Facebook" etc etc which I'm sure they are not super thrilled about.

I read it, but I don't assume to know the reporter knows how we do things, especially in light of security. The FB responses were absolutely dismissive, and I hope they have learned to, at least, setup some boilerplate responses. Perhaps they already have those, and the responder was simply doing a bad job. I suppose you've never received a bug report (much less a security report) from a client that hasn't the foggiest on even the difference between that blue "e" symbol that has the internets and that "orange swirly thing."

Hindsight may be 20/20, but I'd absolutely expect my support or security team to respond with instruction on how and what steps should be taken to diligently report issues. FB did not even try to correct the wrong and dissuade the reporter from abusing users' pages.

To all hackers: If you speak perfect english, please proceed to submit exploits to the FB security team and collect $5k on your way out. If not, post to blackhat forums and receive $10k. Or use the exploit to manipulate FB stock price (I'm sure posting as Mark would move the stock price significantly, if only for a few minutes. But that's enough to earn a lot more than $5k).

He posted on Mark's wall, not as him.

Also, relative to other places you could be spending your time, FB security issues yield relatively little in the blackhat market because of their highly responsive abuse and security teams.

He posted on Mark's wall, not as him.

Sure this bug was like that. But what if someone discovers a bug that allows you to post as the person?

What if I was able to send a fake press release on behalf of a company?[1]

What if I hacked the Twitter account of a major press organization?[2]

Eventually the SEC will require traders to seek independent verification before executing based on social data, or put stops in place similar to the flash crash protections.

1. http://www.sec.gov/news/press/2009/2009-226.htm 2. http://www.forbes.com/sites/jakezamansky/2013/05/01/the-twit...

Hell -- you don't even have to "hack" in to anything to do damage with a Press Release. Just Publish it anyway - most of the press is too lazy to double-check

http://www.smh.com.au/business/mining-and-resources/hoax-pre...

It depends on the bug, automate account creation and spam some links could add a few million bots to a bot net.

Only problem with using an exploit to manipulate stock price is that the SEC would be at your doorstep in no time and put you behind bars for a significant amount of time.

his first language is Arabic.

Can we not get into this again? There are plenty of threads on the validity of this as a bug report.

Have you see the interview on CNN with this guy?

http://www.cnn.com/2013/08/19/tech/social-media/zuckerberg-f...

He is rather poor and had a tiny broken laptop that is missing five keys.

He could have used that money and really tried to get them to see the problem.

They should pay him just out of realizing what idiots they were.

Someone should at least send him a better laptop.

r/random acts of laptop

I can understand FB. They are trying to enforce some (reasonable) guidelines around white hat disclosure, namely, don't mess user data!

I think they should be a little lenient in this case since it seems like he messed with only Zuckerberg's account, and because of the PR around it.

"they should be a little lenient in this case since it seems like he messed with only Zuckerberg's account"

No, he posted to another persons account first (that was his initial bug report). Then he posted again to Zuckerberg's account when they ignored him.

Also, it's too late to prevent the bad PR.. paying him now will only tell every other hacker that they can do whatever they want to facebook accounts/users, as long as they embarrass facebook with it afterward.

I believe part of the whitehat payment program is to avoid the exact sort of PR Facebook is receiving from this episode. I agree that the guy should not be paid; he didn't follow the agreement.

You're right. Not paying him now tells hackers, "Sell your exploit; it'll be easier and less hassle."

I hope that any credible hacker would be able to realise that to get paid for a white hat vulnerability, you have to use it in a white hat way - i.e. show your working in accordance with the security team's guidelines. Deliberately posting to other people's timelines "for exposure" isn't white hat in the slightest.

Unless you're getting ignored by the security team. Yes, I get it. There was a language barrier. There are what, 7 billion people on earth? Any one of them could be reporting a security vulnerability, and chances are english isn't their first/primary language. Prepare/act accordingly.

He violated the TOS _before_ he was ignored by the security team. I agree that it was handled wrong but let's not fudge the details for our rhetoric.

When I first saw the blog of this guy, just looking at the initial bug reports he mailed, I understood the nature of the bug this guy had discovered. It's strange that the people who are responsible for maintaining security at Facebook, failed to grasp that idea. It could be that they get so many bug reports a day, they have gotten in the habit of making fast initial judgments(which is natural). Maybe they made an initial judgement about this guy and then being biased, they failed at their job. If Facebook does not have a review of bug reports that they dismiss, and if this guy had not posted on MZ's profile, this bug would probably still exist.

This is being covered a lot more widely because it's a distraction.

Reply on news.ycombinator.com