Comment by vezzy-fnord | Hacker News Reader

Comment by vezzy-fnord | Hacker News Reader

Parent Full thread

https://www.facebook.com/whitehat

      Exclusions
      The following bugs are not eligible for a bounty (and we do not recommend testing for these):
      ...
      Denial of Service Vulnerabilities
      ...

That said, they do appear to be quite hypocritical when it comes to enforcing this, as at least one user on the /r/netsec thread claimed that Facebook paid them for a mail bombing vulnerability.

I guess you have to use this to attack high-profile targets (or Facebook themselves) until they notice.

It's not clearly stated. I think what they mean to say is DoS on Facebook using brute force mechanism as testing this would bring down the Facebook system itself. Now manipulating Facebook's server to cause the attack, that'd be different I guess.

I agree with you, forcing Facebook to be your zombie of doom is very different to attempting to DoS facebook.

If you can easily cause any website to become an on demand low orbit ion cannon, they're going to cause problems.

> If you can easily cause any website to become an on demand low orbit ion cannon

You can do this with any website that lets users post links which may or may not be automatically loaded (by other users too). There are tons of these around; forums, blogs, etc. See also: Slashdot effect. That's also a true DDoS, coming from many IPs, as compared with a few of Facebook's servers.

Reply on news.ycombinator.com