Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

washingtonpost.com

Post reply on HN
Print view View original

151–160 of 172 posts

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#151

Post by mtrimpe »

ceol wrote: post #146
anigbrowl wrote: post #138

Earlier quoted context omitted.

You do make a good point, but at the same time I was easily able to understand his original bug report. I agree that both sides should be making a little more effort, and engaging in a bit less drama.

He didn't make a bug report. He didn't specify how he could post to other peoples' walls. All he said was that he could, and that he already broke the ToS by using it on another person's account. This was his original report: -----Original Message to Facebook----- From: kha****@hotmail.com To: Subject: post to facebook users wall . Name: Ḱhalil E-Mail: khal****@hotmail.com Type: privacy Scope: www Description: dear f…

When you're working across cultural boundaries you realise that most problems stem from an incorrect assumption.

In this case Khalil probably held the incorrect assumption that an actual demonstration of the bug would be how Facebook would want this to be reported, hence the lack of details.

It's not unreasonable for him to think Facebook would take a look at their HTTP logs to find out what happened.

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#152

Post by __voidcast__ »

chrisacky wrote: post #2

Although this is blogspam, it's a blogspam that I can actually support... This is being covered a lot more widely because FB didn't just pay the guy. I know it wasn't about money for FB, but this is easily done a lot more damage then they would have expected and because of their inadequate handling of a single bug report, I can only feel satisfied as I think this will go down as a good case study of how not to be so…

When I first saw the blog of this guy, just looking at the initial bug reports he mailed, I understood the nature of the bug this guy had discovered. It's strange that the people who are responsible for maintaining security at Facebook, failed to grasp that idea. It could be that they get so many bug reports a day, they have gotten in the habit of making fast initial judgments(which is natural). Maybe they made an initial judgement about this guy and then being biased, they failed at their job. If Facebook does not have a review of bug reports that they dismiss, and if this guy had not posted on MZ's profile, this bug would probably still exist.

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#153

Post by 001sky »

ck2 wrote: post #149
chrisacky wrote: post #2

Although this is blogspam, it's a blogspam that I can actually support... This is being covered a lot more widely because FB didn't just pay the guy. I know it wasn't about money for FB, but this is easily done a lot more damage then they would have expected and because of their inadequate handling of a single bug report, I can only feel satisfied as I think this will go down as a good case study of how not to be so…

Have you see the interview on CNN with this guy? http://www.cnn.com/2013/08/19/tech/social-media/zuckerberg-f... He is rather poor and had a tiny broken laptop that is missing five keys. He could have used that money and really tried to get them to see the problem. They should pay him just out of realizing what idiots they were. Someone should at least send him a better laptop.

r/random acts of laptop

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#154

Post by [deleted] »

claudius wrote: post #60
cliveowen wrote: post #18

Earlier quoted context omitted.

There's no excuse for not knowing the English language, first as a 21 century citizen and secondly as a web developer.

There’s no excuse for not knowing at least three out of English, Spanish, French, Mandarin, Urdu, Arabic, Portuguese, Russian and German. If you’ve finished university peeking at a fourth and fifth language can’t hurt either. How many do you know? Edit: Oh, and how about a bit of Latin and Greek, maybe?

[deleted]

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#155

Post by lewispollard »

jack-r-abbit wrote: post #137
AsymetricCom wrote: post #134

Earlier quoted context omitted.

I think it's more telling that the lack of professionalism displayed by an unemployed developer is the focus, and not the fact that an unemployed developer with a lack or professionalism discovered this hack. This could have been exploited so much worse than it was. Just because he didn't follow unwritten rules of disclosure, doesn't mean that Facebook didn't majorly mess up here. The details of the dev and his behav…

> Just because he didn't follow unwritten rules of disclosure Are you refering to those unwritten rule that are written here: https://www.facebook.com/whitehat

Someone in another thread pointed out that that page doesn't get translated when you set the language to Arabic, seems likely that the guy just couldn't understand the whitehat TOS for that reason.

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#156

Post by madeofpalk »

walid wrote: post #96
Oculus wrote: post #35

Earlier quoted context omitted.

The problem here is that if FB took every single bug report that they got 100% seriously, they'd never get to the real bug reports, but would just constantly be sifting through the spam. You have to make educated guesses on whether or not a report is just useless spam. This report, the way it read, shoots off a lot of spam flags. I understand why he got dismissed so easily and frankly it is his fault. Nobody has enou…

Hardly anyone files a bug for fun. I can't imagine that the masses would file bugs since they don't know what they are in the first place. So when anyone files a bug and attach their name with it, they should be taken seriously. What was more important was that he made it clear that he made a post on someone else's timeline without him being friends with them. Red flag right there.

In the original thread a Facebook security researcher mentioned that they receive a lot of reports that just aren't bugs ("I view source and my password is there in plaintext!")

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#157

Post by andyhmltn »

cliveowen wrote: post #43
mcphilip wrote: post #27

Earlier quoted context omitted.

I downvoted you and am leaving this comment in hopes that those reading this thread don't get the impression that the entire HN community supports such a despicable outlook. I, for one, am grateful for all of the many important contributions to furthering computer science and its associated industries by non english speaking individuals.

Do you ever stop and think that maybe if people were less lazy and started learning English things would actually improve? Information (including "important contributions to furthering computer science") would spread more rapidly, people would have access to an endless stream of news outlets and have a more detailed view of the world. Also, there won't be any need to waste money on translators (do you know how much m…

Do you know Chinese? Spanish? French? Unless you are fluent in all three and a lot of other languages, then you have absolutely _no_ grounds to make such a foolish comment. You are as 'lazy' as you claim others to be.

I would even argue that you are much much worse since not only are not learning other languages you are sitting on a forum complaining that other people can't speak your own and they must work just so you have less to do.

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#158

Post by madeofpalk »

tptacek wrote: post #122
shiven wrote: post #120

Earlier quoted context omitted.

Added to that comment for clarity ... In this conversation, you appear to be defending the FB appsec team for the work they do other than _this particular incident_ and I have no contention with that. When it comes to _this particular incident_, a lot of things went awry. (a) FB did not appear to have a process in place for handling bug reports from non-native english speakers (or non-speakers for that matter). (b) A…

The English thing is a total red herring. Language barriers prevented them for acknowledging and correcting the bug as quickly as they might have, but couldn't change the fact that the bugfinder compromised a non-consenting account to demonstrate it. What you call a "technicality" I continue to call probably the most important term in the whole bug bounty. Moreover, you ignored half my comment. The point isn't that t…

> The English thing is a total red herring. [...] the bugfinder compromised a non-consenting account to demonstrate it.

Could you not make an argument that the bug finder didn't understand this the proper guidelines as Facebook.com/whitehat is only available in English?

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#159

Post by cmccabe »

mcphilip wrote: post #99
cliveowen wrote: post #93

Earlier quoted context omitted.

Again, no counterargument. You're only proving me right.

Since you seem intent on furthering this conversation, here's an honest suggestion for you if you want to truly think about what you are arguing. Extensive academic thought already exists related to the argument you are trying to make -- in short, that it is worth restricting diversity in order to normalize cultures across the globe: http://en.wikipedia.org/wiki/Postcolonialism Postcolonialism, and especially postmod…

Is anyone here arguing in favor of colonialism? This is equivalent to comparing people who disagree with you to Hitler. Thanks for your "extensive academic thought," which I note you did not even bother to summarize here. I think this thread is over.

P.S. While I do think some of the statements made by cliveowen were insensitive, I also think that teaching people English (or another world language) in addition to their native tounges would help break down barriers between people, and lead to a better world overall.

Re: Mark Zuckerberg’s Facebook page was hacked by an unemployed web developer

#160

Post by andyhmltn »

webvictim wrote: post #74
guard-of-terra wrote: post #50

I think we should crowd-source $5k to that guy and make Zuck sure we don't really need him for anything. I'm ready to toss $10.

You would prove nothing other than that crime pays.

Had he sold this exploit, he could've made upwards of $20k-100k. Especially this bug. It allows marketing firms to post to peoples walls without even knowing them. That's a huge vulnerability at the moment when everybodies clamoring for 'social marketing'
Post reply on HN