Hacker News Reader

Comment by efuquen | Hacker News Reader

Having dealt with fellow developers that don't have perfect english or thick accents I think it's quite unprofessional to dismiss someone's complaint without even trying to understand them. It's great for us native English speakers that it's such a dominant language but I think we should all give a little more respect for others where it's clearly not their first language and they're the ones having to go out of their way to communicate with us. I for one am glad I don't have to deal with the bilingualism, with a bit more empathy and less dismissiveness the whole thing could have been avoided.

View on HN

I am not a native English speaker. Although I study in England (University of Manchester), I believe half of my course mates are not native speakers either. At least the ones who turn up to lectures. People try to explain their algorithms, ideas in broken English with damn thick accents but they DO explain. They put effort.

From what he managed to write in the blog post, he CAN write English which is not THAT bad.

But this dude doesn't really bother. Hey Facebook, there's a bug. Wanna know it? How about you... beg me to tell you?

I am quoting him: whatever , i dont care for miss spelling , just the idea , i never correct an underline red word ;)

Did FB treat it properly? No. Did he act properly? Not either. But since it's FB... THEY ARE EVIL!!!!111!

You do make a good point, but at the same time I was easily able to understand his original bug report. I agree that both sides should be making a little more effort, and engaging in a bit less drama.

He didn't make a bug report. He didn't specify how he could post to other peoples' walls. All he said was that he could, and that he already broke the ToS by using it on another person's account. This was his original report:

    -----Original Message to Facebook-----
    From: kha****@hotmail.com
    To:
    Subject: post to facebook users wall .

    Name: Ḱhalil
    E-Mail: khal****@hotmail.com
    Type: privacy
    Scope: www
    Description: dear facebook team .

    my name is khalil shreateh.
    i finished school with B.A degree in Infromation Systems .

    i would like to report a bug in your main site
    (www.facebook.com) which i discovered it .

    repro:
    the bug allow facebook users to share links to other 
    facebook users , i tested it on sarah.goodin wall and i 
    got success post
    link - > https://www.facebook.com/10151857333098885
    -----End Original Message to Facebook-----

From that, you surmised that he exploited the "make a new wall post" form by replacing the user ID with another of his choosing?

When you're working across cultural boundaries you realise that most problems stem from an incorrect assumption.

In this case Khalil probably held the incorrect assumption that an actual demonstration of the bug would be how Facebook would want this to be reported, hence the lack of details.

It's not unreasonable for him to think Facebook would take a look at their HTTP logs to find out what happened.

Enough to get a sense of his thinking there was a problem, and look up his and Goodin's accounts to see what he meant. Certainly it warranted clarification, and I sppreciate that the FB support team must get a lot of nonsense/stupid requests, but that's why they get paid the big bucks.

I agree with that completely, however, common-sense should have told him that demonstrating an exploit on third-party was a really dumb idea. It has nothing to do with TOS or language barriers.

That is why he isn't getting paid (yet?)

I think it's more telling that the lack of professionalism displayed by an unemployed developer is the focus, and not the fact that an unemployed developer with a lack or professionalism discovered this hack. This could have been exploited so much worse than it was. Just because he didn't follow unwritten rules of disclosure, doesn't mean that Facebook didn't majorly mess up here. The details of the dev and his behavior are quite trivial, in this case.

> Just because he didn't follow unwritten rules of disclosure

Are you refering to those unwritten rule that are written here: https://www.facebook.com/whitehat

Someone in another thread pointed out that that page doesn't get translated when you set the language to Arabic, seems likely that the guy just couldn't understand the whitehat TOS for that reason.

I don't view that as a valid excuse not to follow the rules. Admittedly, I don't know any other language than English. But if I was setting out to participate in a bounty program run by a company that didn't have their website in my language... I would most certainly make sure I had someone to tell me what the rules are. Other people have condemned him for not knowing English. I don't fault him for that. But there is no excuse for not knowing the rules.

You still haven't explained why this matters. Facebook has a lot more responsibility than this developer. Get off your high horse. Even if Facebook wrote down these supposed "rules" they have no authority to enforce them (other then in relation of their supposed bounty program), so it's a moot point.

It matters because Facebook created their bounty program and created the rules around it. They absolutely have 100% authority to enforce them. There is nothing supposed about either the rules or the bounty program. They are not hypothetical. They both quite obviously exist and links to them prove their existence. I don't really follow what you are arguing. The developer has the responsibility to follow the rules of the program if he wants to participate in the program. He did not. Facebook has the responsibility to enforce the rules of the program. They did. So... yes... this is all moot.

but this thread isnt about the bounty program.

You brought up the rules of disclosure... not me. And you said they were unwritten... so I was trying to let you know that they are, in fact, written. If you were not talking about the bounty program then I have no idea what rules of disclosure you are talking about and I'll move on.

It's not about a lack of English language skills.

His English is actually good enough. In the post he posted on Mark's wall you can see the language is good enough and I saw the video interview too where he even spoke well enough.

A technical and step-by-step report was well within his capability.

He could attach screenshots or create a video demonstration.

He used the bug on real users (2 of them!) one of them being Mark Zuckerberg which has obviously created huge negative PR for Facebook.

If someone tests a bug on your Facebook account how happy would you be?

Facebook can't reward someone who used a bug against its users.

On top of that he has damaged their reputation too. Almost all major news sites have written headlines similar to "Palestinian developer hacked Mark Zuckerberg", "Security vulnerability found in Facebook" etc etc which I'm sure they are not super thrilled about.

Reply on news.ycombinator.com