Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

washingtonpost.com

Post reply on HN
Print view View original

31–40 of 172 posts

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#31

Post by lightcatcher »

rgbrenner wrote: post #13
macspoofing wrote: post #11

Earlier quoted context omitted.

I can understand FB. They are trying to enforce some (reasonable) guidelines around white hat disclosure, namely, don't mess user data! I think they should be a little lenient in this case since it seems like he messed with only Zuckerberg's account, and because of the PR around it.

"they should be a little lenient in this case since it seems like he messed with only Zuckerberg's account" No, he posted to another persons account first (that was his initial bug report). Then he posted again to Zuckerberg's account when they ignored him. Also, it's too late to prevent the bad PR.. paying him now will only tell every other hacker that they can do whatever they want to facebook accounts/users, as lo…

I believe part of the whitehat payment program is to avoid the exact sort of PR Facebook is receiving from this episode. I agree that the guy should not be paid; he didn't follow the agreement.

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#32

Post by bwang8 »

arnarbi wrote: post #26

> Shreateh reports he will not, however, receive a bounty for his work — per an e-mail from Facebook, he violated the terms of the program when he hacked Zuckerberg’s account. I think this is wrong. He posted on Sarah Godin's wall first before making any report, very clearly breaking the rules FB sets up for its whitehat program. They offer a way to create test accounts for exactly this. Posting on Mark Zuckerberg's…

From my understanding, Sarah Godin is a fake FB account that he made to test his bug out.

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#33

Post by toomuchtodo »

rgbrenner wrote: post #13
macspoofing wrote: post #11

Earlier quoted context omitted.

I can understand FB. They are trying to enforce some (reasonable) guidelines around white hat disclosure, namely, don't mess user data! I think they should be a little lenient in this case since it seems like he messed with only Zuckerberg's account, and because of the PR around it.

"they should be a little lenient in this case since it seems like he messed with only Zuckerberg's account" No, he posted to another persons account first (that was his initial bug report). Then he posted again to Zuckerberg's account when they ignored him. Also, it's too late to prevent the bad PR.. paying him now will only tell every other hacker that they can do whatever they want to facebook accounts/users, as lo…

You're right. Not paying him now tells hackers, "Sell your exploit; it'll be easier and less hassle."

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#35

Post by Oculus »

mcphilip wrote: post #17
short_circut wrote: post #7

Earlier quoted context omitted.

Dismissive and ignored? Did you read what he submitted to them? It made no sense. He vaguely stated that there was a bug and his education. His bug report was nonsensical. I am not even slightly surprised they ignored it. And he violated the TOS before he even ever tried to post to Zuckerberg's wall.

I don't think it is as cut and dry as that. The reply that 'this is not a bug' showed a lack of concern that the reporter may have been having difficulties correctly submitting information about what would be a very significant defect, if true. A community member taking the time and interest to try and go through proper channels to submit a vulnerability should, IMO, be given more respect than was shown by FB.

The problem here is that if FB took every single bug report that they got 100% seriously, they'd never get to the real bug reports, but would just constantly be sifting through the spam. You have to make educated guesses on whether or not a report is just useless spam. This report, the way it read, shoots off a lot of spam flags. I understand why he got dismissed so easily and frankly it is his fault. Nobody has enough staff to hold hands with every single bug submitter regardless of what they send.

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#36

Post by joshaidan »

I find it interesting the amount of attention Hacker News is getting from this in mainstream media.

It makes me wonder, when people unfamiliar to Hacker News read about it in stories like this, do they get the wrong impression and think Hacker News is about the criminal kind of "hacking"?

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#37

Post by [deleted] »

cliveowen wrote: post #18
jzelinskie wrote: post #6

Why don't people just send things in their native language? If the platform for communication is serious (like a place to report security vulnerabilities), I would imagine they would spend the time/money to get a real translation if one was needed. Even Google Translate probably could've done a better job than this guy's original report.

There's no excuse for not knowing the English language, first as a 21 century citizen and secondly as a web developer.

[deleted]

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#38

Post by efuquen »

short_circut wrote: post #7
chrisacky wrote: post #2

Although this is blogspam, it's a blogspam that I can actually support... This is being covered a lot more widely because FB didn't just pay the guy. I know it wasn't about money for FB, but this is easily done a lot more damage then they would have expected and because of their inadequate handling of a single bug report, I can only feel satisfied as I think this will go down as a good case study of how not to be so…

Dismissive and ignored? Did you read what he submitted to them? It made no sense. He vaguely stated that there was a bug and his education. His bug report was nonsensical. I am not even slightly surprised they ignored it. And he violated the TOS before he even ever tried to post to Zuckerberg's wall.

Having dealt with fellow developers that don't have perfect english or thick accents I think it's quite unprofessional to dismiss someone's complaint without even trying to understand them. It's great for us native English speakers that it's such a dominant language but I think we should all give a little more respect for others where it's clearly not their first language and they're the ones having to go out of their way to communicate with us. I for one am glad I don't have to deal with the bilingualism, with a bit more empathy and less dismissiveness the whole thing could have been avoided.

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#39

Post by thezilch »

short_circut wrote: post #7
chrisacky wrote: post #2

Although this is blogspam, it's a blogspam that I can actually support... This is being covered a lot more widely because FB didn't just pay the guy. I know it wasn't about money for FB, but this is easily done a lot more damage then they would have expected and because of their inadequate handling of a single bug report, I can only feel satisfied as I think this will go down as a good case study of how not to be so…

Dismissive and ignored? Did you read what he submitted to them? It made no sense. He vaguely stated that there was a bug and his education. His bug report was nonsensical. I am not even slightly surprised they ignored it. And he violated the TOS before he even ever tried to post to Zuckerberg's wall.

I read it, but I don't assume to know the reporter knows how we do things, especially in light of security. The FB responses were absolutely dismissive, and I hope they have learned to, at least, setup some boilerplate responses. Perhaps they already have those, and the responder was simply doing a bad job. I suppose you've never received a bug report (much less a security report) from a client that hasn't the foggiest on even the difference between that blue "e" symbol that has the internets and that "orange swirly thing."

Hindsight may be 20/20, but I'd absolutely expect my support or security team to respond with instruction on how and what steps should be taken to diligently report issues. FB did not even try to correct the wrong and dissuade the reporter from abusing users' pages.

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#40

Post by Casseres »

cliveowen wrote: post #24
[deleted] wrote: post #22

Earlier quoted context omitted.

[deleted]

Nope, I'm Italian.

Ethnicity ≠ Knowing a language

(I don't doubt you, but you are asserting something that is not always true. I know Hispanics that don't know Spanish for example, because their parents never raised them bilingual.)

Post reply on HN