Hacker News Reader

Comment by cheald | Hacker News Reader

The guy was obviously acting in good faith. Sure, he may not have known the right way to go about doing what he was demonstrating, but that was ignorance, not malice.

View on HN

I think this discussion is going to be a regurgitation of everything said in the original one. So here goes my part:

Facebook's rules were only available in english - despite having a way to switch most of facebook to arabic, the guy is obviously not a strong english speaker.

Rules are only guidelines for people who can't (or aren't allowed to) exercise good judgment. Rules are meant to be black and white, but real life is rarely so. In this case absolutely no harm was done, or even suggested, by the guy's actions. Facebook's decision to apply judgment rather than zero-tolerance is commendable.

EDIT: Facebook is still doing the brainless zero-tolerance thing. Shame on them. I should have read the article rather than assume the best.

PS the best company I ever worked for had as the first line of their employee handbook: "Don't do anything stupid just because it is written down in this book."

> Facebook's decision to apply judgment rather than zero-tolerance is commendable.

Re-read the article. They didn't.

TFA says some hackers are raising money for him, doesn't say Facebook is paying a reward, so not clear what Facebook decision is commendable.

What do you mean "apply judgment rather than zero-tolerance"? They dismissed his initial report, then applied their zero-tolerance policy with regards to paying rewards for bugs that have been tested on other users.

Encouraging ignorance is even worse than encouraging malice :P

This isn't encouraging ignorance, it's encouraging good faith, (which is a large part of the entire purpose behind security bounties) and has undoubtedly been an learning experience for the gentleman involved.

Yes, I heard he is going to black market next. That's a good lesson I think.

Nowhere I saw good faith, just greed for money. He was even asking for money in the initial bug "reports". http://4.bp.blogspot.com/-4LbrTjyKBXc/Ug5sokeeR0I/AAAAAAAAAJ...

Don't confuse altruism with good faith. He was obviously not being altruistic - he wanted to be compensated for the vulnerability he had found - but he was not being malicious in his TOS-violating behaviors. There was no intent to cause damage, to exploit the bug for personal gain, or to otherwise be a bad actor. That is what "acting in good faith" means; the things he did were benign and intended to bring the issue to Facebook's attention. The fact that he wanted to be compensated for his discovery doesn't diminish that.

Reply on news.ycombinator.com