Re:Hacker Posts Facebook Bug Report on Mark Zuckerberg’s Wall
by ryandrake on Sunday August 18, 2013 @01:09PM
(#6233297)
Oh, and just to clarify, I'm not coming at this from the perspective of "BigCo hatred". It is in Facebook's best interests to treat white hat reported security issues seriously, even if they don't initially understand them.
What are the chances that this security researcher ever reports another bug to Facebook, given how he was treated? Selling future exploits to spammers wouldn't be the ethical thing to do, but if I know "Emrakul" in Facebook Security is just going to tell me to F-off, I start to justify it.....
Re:Hacker Posts Facebook Bug Report on Mark Zuckerberg’s Wall
by dylangs1030 on Sunday August 18, 2013 @03:40PM
(#6233858)
I wasn't talking about you when I spoke about the anti-BigCo sentiment.
Re:Hacker Posts Facebook Bug Report on Mark Zuckerberg’s Wall
by iyulaev on Sunday August 18, 2013 @01:12PM
(#6233316)
you would still be fully wrong in selling the exploit to the highest bidder. It's not ethical to do that just because you failed to get a bounty after reporting it, especially if you only tried once.
Well he tried twice, and they told him it wasn't a bug both times. After that, what's wrong with selling "not an exploit" to the highest bidder?
Re:Hacker Posts Facebook Bug Report on Mark Zuckerberg’s Wall
by moocowduckquack on Sunday August 18, 2013 @01:16PM
(#6233337)
I think there are valid legally justifiable reasons for refusing the bounty, however they are outweighed by the reason for the bounty system to exist in the first place.
Not paying someone over minor violations that they only did to get your attention to the fact that something was definitely important to you is not good practice when running a bounty for bugs.
2. That said...if you were the security researcher, and you received a "This is not a bug." - you would still be fully wrong in selling the exploit to the highest bidder. It's not ethical to do that just because you failed to get a bounty after reporting it, especially if you only tried once.
I think both sides should have done things differently. Hacker News is skewed towards BigCo hatred as a whole, and I think it's showing a bit. The majority is siding with Khalil despite the fact that there are valid reasons for him to not receive a bug bounty.