Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

washingtonpost.com

Post reply on HN
Print view View original

81–90 of 172 posts

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#81

Post by rmc »

dsl wrote: post #68
wereHamster wrote: post #53

Earlier quoted context omitted.

To all hackers: If you speak perfect english, please proceed to submit exploits to the FB security team and collect $5k on your way out. If not, post to blackhat forums and receive $10k. Or use the exploit to manipulate FB stock price (I'm sure posting as Mark would move the stock price significantly, if only for a few minutes. But that's enough to earn a lot more than $5k).

He posted on Mark's wall, not as him. Also, relative to other places you could be spending your time, FB security issues yield relatively little in the blackhat market because of their highly responsive abuse and security teams.

He posted on Mark's wall, not as him.

Sure this bug was like that. But what if someone discovers a bug that allows you to post as the person?

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#82

Post by rmc »

zobzu wrote: post #28
short_circut wrote: post #7

Earlier quoted context omitted.

Dismissive and ignored? Did you read what he submitted to them? It made no sense. He vaguely stated that there was a bug and his education. His bug report was nonsensical. I am not even slightly surprised they ignored it. And he violated the TOS before he even ever tried to post to Zuckerberg's wall.

The fact that hes not english native and that communication seems hard for him does not mean that: - he did not do all this in good faith. it seems like he genuinely did. Sure there are TOS. But given his english, do you really think he understood them? Of course not. Good faith is a higher morale value (even thus Americans are pretty much used to "if it passed as law/text, morale values are irrelevant, cuz lawyers+m…

Of course "good faith" goes both ways. Facebook has to act in good faith. If they don't, they can't demand others do to them.

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#83

Post by cliveowen »

dwaltrip wrote: post #78
cliveowen wrote: post #43

Earlier quoted context omitted.

Do you ever stop and think that maybe if people were less lazy and started learning English things would actually improve? Information (including "important contributions to furthering computer science") would spread more rapidly, people would have access to an endless stream of news outlets and have a more detailed view of the world. Also, there won't be any need to waste money on translators (do you know how much m…

Holy shit man, I feel bad for you. Having such a distorted view of life must suck. I would try to explain my reasoning but judging by your other replies, it would be a fruitless endeavor.

The lack of a response only suggests that you don't have a counterargument, and I don't blame you, it's hard to counter the obvious.

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#84

Post by dwaltrip »

cliveowen wrote: post #76
Aldo_MX wrote: post #67

Earlier quoted context omitted.

I have to assume that you can communicate fluently in a non-Germanic language, and that you already know that you can't change the way you think about concepts in a way that doesn't resemble your native language. Otherwise: Con esa forma tan cerrada de pensar, por favor absténgase de opinar.

Yes, read my other responses, I'm tired of repeating myself. Also, the only narrow minded here is the one who advocates for a fragmented world and the resulting slow flowing of information.

The only thing these nice commentators are advocating for is not blasting the character of others not conforming to your worldview. You are allowed to have an opinion, but the way you judge the choices of other people is rather unproductive.

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#85

Post by rmc »

jzelinskie wrote: post #6

Why don't people just send things in their native language? If the platform for communication is serious (like a place to report security vulnerabilities), I would imagine they would spend the time/money to get a real translation if one was needed. Even Google Translate probably could've done a better job than this guy's original report.

Why don't people just send things in their native language?

Because there are dozens to hundreds of languages that could be! How are they supposed to be good at them!

Even Google Translate probably could've done a better job than this guy's original report.

Erk no. Google translation is decent for many languages, but sort shite for lots, and non-existant for others.

Especailly big reports with lots of fine details of "this is supposed to do this" type language can be harder.

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#86

Post by toomuchtodo »

webvictim wrote: post #73
toomuchtodo wrote: post #33

Earlier quoted context omitted.

You're right. Not paying him now tells hackers, "Sell your exploit; it'll be easier and less hassle."

I hope that any credible hacker would be able to realise that to get paid for a white hat vulnerability, you have to use it in a white hat way - i.e. show your working in accordance with the security team's guidelines. Deliberately posting to other people's timelines "for exposure" isn't white hat in the slightest.

Unless you're getting ignored by the security team. Yes, I get it. There was a language barrier. There are what, 7 billion people on earth? Any one of them could be reporting a security vulnerability, and chances are english isn't their first/primary language. Prepare/act accordingly.

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#87

Post by cliveowen »

dwaltrip wrote: post #84
cliveowen wrote: post #76

Earlier quoted context omitted.

Yes, read my other responses, I'm tired of repeating myself. Also, the only narrow minded here is the one who advocates for a fragmented world and the resulting slow flowing of information.

The only thing these nice commentators are advocating for is not blasting the character of others not conforming to your worldview. You are allowed to have an opinion, but the way you judge the choices of other people is rather unproductive.

All I see here are people going against me without offering a real reason as to why a fragmented world, the status quo, should be promoted.

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#88

Post by webvictim »

Oculus wrote: post #65
iyulaev wrote: post #49

Earlier quoted context omitted.

Replying "this is not a bug" is equivalent to saying "I have read and understood your report, and this is not a bug, it is a feature." First off, it's not a dismissal, it's an acknowledgement. Second, since it's not a bug but rather a feature, then how does using the feature violate the ToS? The correct reply might be something like "cannot understand or reproduce, can you explain more clearly?" along with some bug r…

I definitely agree with you on this. The response from the engineer could've been better. Some sort of canned response would have worked. IMHO, the whole ToS business was a way to give him a slap on the wrist for embarrassing them.

Embarrassment is a very relative thing - it looks to me like the majority of comments on this HN post are saying the guy was in the wrong for breaking the TOS and I have to say I agree. Facebook haven't been embarrassed, they've just upheld a policy which says that they won't pay anyone who doesn't play by the rules. Quite fair, in my opinion.

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#89

Post by rmc »

bloaf wrote: post #63

Its simple, Facebook can't set the precedent that people who exploit bugs in this way get paid. If they did, every Joe who felt that their particular bug wasn't being addressed quite right would think that public exploitation is the faster route to their reward.

Conversely, they might be setting the opposite precendent, that they might ignore your intial email if you don't speak perfectly, and if they ignore your initial email, even hacking Zuck's account won't get you any offical recognition.

The bad precendent is that if you're not a great english speaker, you might as well sell your bug on the black market. This is not good for facebook.

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#90

Post by shiven »

Oculus wrote: post #69
santosha wrote: post #56

Earlier quoted context omitted.

At USENIX this year, Chris Evans gave a talk about how Google does their VRP. Specifically, he mentioned that there weren't many false positive reports at all, way fewer than he expected there would be. In general, most bugs have something to them. Google has a long history of following up on bug reports with little or nothing to go on, because they take their jobs seriously, and aren't antagonistic to community bug…

As I mentioned in the reply above, the engineer's response could've been many times better, but you have to agree the bug submitter gave them practically nothing to work with.

Clearly, any website the size of FB and its huge resources, needs to have an option for bug submitters to submit bugs in their NATIVE language.

I bet if the submitter had written the bug report in Arabic, and FB had a professional translator on their security team (with some technical background), things might have been very different and we may not even be having this discussion.

Post reply on HN