Hacker News Reader

Comment by s_q_b | Hacker News Reader

The author clearly has a language barrier. Not all bug reports are going to come with sterling reports to back them. In the end, Ḱhalil fell back on the lingua franca of the internet: a working demonstration.

The onus is on the organization, not the bug reporter, to vet the information. From what I see, there was more than enough in the report to conclude there was a problem, and follow up.

If Facebook security fails in coding the application, in QR, and when a user files a bug report, it is awfully hard to place the blame with the bug reporter.

View on HN

I agree, and in the end, they finally broke the language barrier and comprehended the bug which I am sure they are working on fixing. They were able to get all the benefit of his work, why screw him on a measly little bounty?

This isn't a good summary of the events. His "lingua franca" is technically illegal, and violates Facebook's explicit and easily accessible Terms of Service.

There's nothing obfuscated about this. It's very straightforward. Yes, he found a security vulnerability. That doesn't earn you points "just cause." You still need to report it with responsible disclosure and not exploit it for the lulz and attention.

He could have done things differently - especially, he could have asked to talk to a Facebook employee who understands Arabic. Or tried to put more effort into a second security report.

Frankly, posting on Mark Zuckerberg's wall about this is childish and just attention-grabbing. It's not a responsible disclosure.

In another thread it was mentioned that the terms of service aren't available in Arabic.

That's not Facebook's problem...should they also write Esperanto terms of service and Swahili terms of service just because security researchers exist who speak those languages?

And the bug wasn't this hacker's problem. It's important to remember that this guy went out of his way to help Facebook.

As such, they should be a bit more understanding when someone that speaks Esperanto submits a bug without doing so in a way that perfectly adheres to their terms of service. They should step back and take a subjective view instead of trying to make it black and white. Was he acting maliciously? Did he knowingly violate the terms or was it out of ignorance? Was he trying to hurt Facebook by violating the terms or help them?

Might help if hundreds of millions of people spoke Esperanto.

I believe that was referring to the terms of service of the whitehat program not Facebook's TOS itself.

Aren't the whitehat term's of service those that were talking about? They're the most relevant terms to this discussion.

Reply on news.ycombinator.com