After reading the messages between the white hat and Facebook, I do believe it is the right decision do not pay him.
In his report he lacked the communication skills necessarily to make a useful bug report, which after my opinion caused the problem.
In his report he lacked the communication skills necessarily to make a useful bug report, which after my opinion caused the problem.
If anything, he had great communication skills. He overcame a non-native language barrier, while being conversationally blocked, and still made his point clearly.
Besides, are communication skills the important skill here? I would say, not.
Facebook do not pay white hat hackers at a level appropriate to their skill and work ($1m total? that's all?!) and now it's also clear they are looking for technicalities to avoid payment.
I've reviewed our communication with this researcher, and I understand his frustration. He tried to report the bug responsibly, and we failed in our communication with him.
Facebook says Facebook failed communication. "He tried, we failed," is pretty cut and dried.
If you are taking reports from users about security problems, treat every one as real until proven otherwise.
If you say you will pay 500Bucks per Bug reported, you will have a huge Fail rate, even if the Facebook Support is well Motivated after 3hours working, answering to 100Tickets you might not be able to understand something written in that way:
"Rhe vulnerability allow’s facebook users to share posts to non friends facebook users , i made a post to sarah.goodin timeline and i got success post … of course you may cant see the link because sarah’s timeline friends posts shares only with her friends , you need to be a friend of her to see that post or you can use your own authority ."
a) it's called triage and b) you won't want to miss that one report that blows your security wide open.
The point is moot now, facebook says they took note and will ask for more details from now on.
Facebook gives 500$ per Bug reported, which ends up in a lot of Fail reports if somebody like this gets send:
"Rhe vulnerability allow’s facebook users to share posts to non friends facebook users , i made a post to sarah.goodin timeline and i got success post … of course you may cant see the link because sarah’s timeline friends posts shares only with her friends , you need to be a friend of her to see that post or you can use your own authority ."
You might mistake it for.
"You can post something on a friends page and you can't see it if you aren't friend with that person"
That amount for Facebook is practically like a chocolate bar.
They do not want to pay him because he exploited the bug he found two different times, once on the CEO's profile which has resulted in a very significant and negative PR for Facebook.
Facebook will not say "Thanks for creating shitty PR for our brand and damaging our reputation, here have this money"
Whitehat bounty program, as the name implies, is for whitehat hackers.
And whitehat does not mean "Will not sell in black market as long as there's good enough bounty money to be collected".
Facebook is not competing with or outbidding black market rates.
If someone is the kind of hacker who would just go and sell the bug in the black market, Facebook would not want to pay them in the first place.
The purpose of bounty programs is NOT to "encourage black hat hackers to sell their bugs to us instead of black market", but rather it is "encourage white hat hackers to challenge our application instead of millions of other applications out there".