News for hackers. Stuff that matters.

A comment on Identify a Facebook user by his phone number despite privacy settings set. Parent comment

Re:Identify a Facebook user by his phone number despite priv... by moconnor on Tuesday May 18, 2021 @02:56AM (#27191924)
Probably suggesting people would start rat farms. Paying large bounties for bugs incentivises developers to introduce bugs for their “friends” to find.

To some extent this dynamic must already exist, which is a troubling thought.

[ Parent | on HN ]
Re:Identify a Facebook user by his phone number despite priv... by Closi on Tuesday May 18, 2021 @06:16AM (#27192929)
> To some extent this dynamic must already exist, which is a troubling thought.

I've not seen any evidence for this behaviour existing, even with Microsoft Bug Bounties of up to $250,000, or even heard of developers being tempted to introduce bugs for friends to find them.

I assume the bigger risk is developers intentionally introduce bugs for nefarious purposes (i.e. black market sale), rather than to win a bug bounty.

[ Parent | on HN ]
Re:Identify a Facebook user by his phone number despite priv... by grenoire on Tuesday May 18, 2021 @03:34AM (#27192102)
The analogy makes no sense considering there's no way for people to create bugs (unless they're within Facebook, hah) to farm bounties for.
[ Parent | on HN ]
Re:Identify a Facebook user by his phone number despite priv... by mannerheim on Tuesday May 18, 2021 @03:56AM (#27192213)
That seems to be the implication, but that seems pretty unlikely because of the risk. If the bounty were, say, 100k, is anyone going to risk a 200k salary over letting a friend of theirs get that bounty? And if you try pulling that off more than once, that's just begging to be caught.
[ Parent | on HN ]