How about: I learned that responsible disclosure can both improve user privacy and prevent bad publicity for my company?
This is another sad example in a long list of security/privacy issues that only gets fixed by what sometimes gets called "stunt hacking" or flashily disclosing the issue.
Take android security patching as a great example. Security pros have been lamenting the lack of a security patch process on android for years and years, Samsung et al have done very little about it. Now Stagefright comes along and gets the press and all of a sudden Samsung are committing to regular security patches..
Another good example is the car hacking stuff that Chris Valasek and Charlie Miller did. without the press furory around their release, do we think a recall would've happened for those cars... I don't think so.
It's an unfortunate truth in security which is full disclousre gets the results that private disclosure often doesn't.
The leak was publicized in 2013 by somebody else, and it wasn't fixed for two years until the events in this article. Clearly Facebook didn't think it was a bug or a security issue, or they wouldn't have taken two years to fix it.
IMO the kid dodged a bullet when the internship was rescinded. Looks like hubris and shitty company culture, and he can probably get something better.
I'm glad that he noticed the privacy flaw, but someone who is about to become an employee of Facebook is the worst person to publicly release it. Maybe the notoriety he's gained from this will be worth it in the end, but I know a lot of companies probably won't want anything to do with him given the (lack of) judgment he's demonstrated from this.
I think that is a really, really dangerous line of thinking. Sometimes, employers do bad things. Sometimes (perhaps often), there is not a satisfactory way to rectify those bad things within the company. Sometimes, what's good for the public outweighs what's good for your employer. It is absolutely reasonable to have a conscience and say "wait, this isn't something I can let slide."
Now, did that happen here? I'm not sure. This individual made a judgment call, as you said. I don't know if I would have made the same call. But I simply don't feel that loyalty to one's employer is as important a value as privacy or safety. If that makes me unhireable in Silicon Valley, I guess I don't want to work in Silicon Valley.
Two broad category of workers emerge from elite institutions.
> .. (lack of judgement) he's demonstrated ..
Well, to this reader (at least) our fellow geek here has established which of the above subset of workers he belong to. You're correct that he has demonstrated that he is unfit for say the Facebooks, GoldmanSachs, Googles, ... of the world.
But who knows? Possibly Aran Khanan will follow up with his debut [1] and become a future LEADER in this space.
Facebook offers a bug bounty program, use it! I just did and got paid $2000 this month for reporting a crypto related flaw. The thing is, if a company offers a bounty program and you choose to go around it and publicly disclose you are sort of a jerk and to more than just the company. Another researcher had already found and reported the bug. Facebook was already working on a fix. The researcher was likely waiting for the terms of the bug bounty program to be met so they could then publish and spin it into a Black Hat, DEF CON, CanSec talk, then this kid comes along and takes the thunder. That's a real dick move.
How is this a bug? It's a feature of FB Messenger! He didn't have to exploit any bugs to get at the data. He just took what FB gave him and displayed it on a map. Why would this be eligible for a bug bounty?
As others have mentioned, the security issue the student highlighted was a known issue.
I think going through official channels is the right thing to do for mission critical zero day type of vulnerabilities.
Bringing increased attention to a known, unfixed, issue, doesn't seem like a jerk move to me.