Hacker News Reader

Comment by ryandrake | Hacker News Reader

If the Facebook security team responded more thoughtfully, we wouldn't even be reading about this as news. Instead of:

    "This is not a bug" (essentially, "go away")

...they could have said:

    "Thanks for the report. It seems that English may not be your first language, so to be very clear, in order to check this issue, we will need these pieces of information (A, B, C). Please feel free to reply in your language, and we will have a native speaker help translate."

If I was the researcher, the callous "go away" response would have convinced me that it would be more fruitful to sell the exploit to a spammer (who would pay HANDSOMELY to be able to post to anyone's wall).

View on HN

I agree with your point but I disagree with your method. I agree that they should also offer a means to communicate in other languages, if they have that capacity.

But, your choice of sentence structure - with clauses and formal social graces - would be hugely more difficult for a non-native speaker to parse correctly.

If the goal is to communicate with a non-native speaker, Facebook's message is appropriate for its clarity.

Bear in mind also that they probably do want incorrect bug reports to "go away" - unless Facebook apply infinite resources to this, some false negative errors are inevitable.

Yes I agree that the Facebook employee could have responded better.

But you are mixing two different issues.

Facebook employee saying "go away" does not automatically result in a warrant for you to go ahead and exploit the bug you found.

If you do that, you no longer meet the definition of a whitehat researcher.

That kind of person is not the type that Facebook wants to reward because Facebook is not competing against the black market prices.

It is simply rewarding those honest reporters who would report the bug even if they were 100% sure that Facebook is not going to pay anything and would not exploit it or sell it even if the Facebook employee said "screw you" or if the black market bids were 6 digit figures.

1. I agree, Facebook probably could have been more tactful in their reply. Your example reply looks good.

2. That said...if you were the security researcher, and you received a "This is not a bug." - you would still be fully wrong in selling the exploit to the highest bidder. It's not ethical to do that just because you failed to get a bounty after reporting it, especially if you only tried once.

I think both sides should have done things differently. Hacker News is skewed towards BigCo hatred as a whole, and I think it's showing a bit. The majority is siding with Khalil despite the fact that there are valid reasons for him to not receive a bug bounty.

Oh, and just to clarify, I'm not coming at this from the perspective of "BigCo hatred". It is in Facebook's best interests to treat white hat reported security issues seriously, even if they don't initially understand them.

What are the chances that this security researcher ever reports another bug to Facebook, given how he was treated? Selling future exploits to spammers wouldn't be the ethical thing to do, but if I know "Emrakul" in Facebook Security is just going to tell me to F-off, I start to justify it.....

I wasn't talking about you when I spoke about the anti-BigCo sentiment.

you would still be fully wrong in selling the exploit to the highest bidder. It's not ethical to do that just because you failed to get a bounty after reporting it, especially if you only tried once.

Well he tried twice, and they told him it wasn't a bug both times. After that, what's wrong with selling "not an exploit" to the highest bidder?

I think there are valid legally justifiable reasons for refusing the bounty, however they are outweighed by the reason for the bounty system to exist in the first place.

Not paying someone over minor violations that they only did to get your attention to the fact that something was definitely important to you is not good practice when running a bounty for bugs.

Reply on news.ycombinator.com