Facebook Invites Hackers To Attack Its Network 157
An anonymous reader writes "Nearly a year ago, Facebook introduced its bug bounty program, inviting security researchers to poke around the site, discover vulnerabilities that could compromise the integrity or privacy of Facebook user data, and then responsibly disclose them to the company. Still, when the social network's security team received a tip from a researcher about a vulnerability in the company's own network which would allow attackers to eavesdrop on internal communications, they made an unprecedented choice by broadened the scope of the bug bounty program and inviting researchers to search for other holes in the corporate network. Nobody expects malicious attackers to have a change of heart and hand over information about a vulnerability for a few thousand dollars when they could sell the stole information for much more. It should, therefore, come as no surprise that Ryan McGeehan, the manager of Facebook's security-incident response unit, stated that if there's a million-dollar bug, they will pay it out."
Grammar! (Score:1, Insightful)
Holy hellbore, editors! At least read through the summary before letting it out onto the page teeming with grammatical errors. It reads like it was written by a grade schooler.
Re: (Score:2)
Well that escalated quickly...
"Troll" moderation? Oh please, if anything, this is "Offtopic", but certainly not trolling. The summary is badly written, a grammatical wreck, there's no denying that. There's no denying that there are editors, either. And there's also no denying that as editors, verifying the accuracy, correctness, sources, and presentation of the summaries posted is their responsibility in the end. In this case, they failed their job, and I'm right to call attention to that.
As for your ad hom
Re: (Score:1)
Seems like you're being trolled by someone with mod points copy-pasting the same ad hominem stuff anonymously and downvoting reasonable replies. Don't worry, it'll correct itself.
Personally my French writing sucks and I'm thankful for people pointing out possible corrections - they help me improve. Reading a correct and nicely formulated writeup is simply more efficient than having to figure out what the author is trying to convey. It's the editors' job to pay attention to that, so yes, your kind is welco
Re: (Score:2)
Check the UIDs: bryonak registered long before I did, and for the record, I don't play dirty like trolls do: everything I do on this site is connected to this single account, be it a good or bad thing, and I responsibly take all replies and karma-deltas for what I do and say.
However, it's not hard to notice that the replies are all the same, word-for-word, and all are attacks directed against my person, not against my points. As such, they carry no weight, only noise.
Re: (Score:2)
Says the Anonymous Coward, who's even afraid to show his handle. You don't know anything about people's usage habits and accounts, or if you're a site admin who does, prove it. You can do that by, say, publishing my IP address. You should be able to access the logs if you're an admin and know exactly who are my "sock puppet" accounts. So go on, prove it to everyone that I'm a dirty, cheating, sock puppet-using troll. I'm waiting.
Of course I'll be waiting a long time: if you do have access to those logs, and
AC off his meds (Score:2)
Your meds. Take them. Now.
--
BMO
Re: (Score:2)
I was joking before. I'm not now.
Take your meds.
AC off his meds (Score:1)
I would taunt you, but taunting the mentally disabled is considered bad form.
--
BMO
Re: (Score:2)
If you're going to quote my words, please give full context (since you seem to be so much into context), and include the rest of that paragraph, in which I explain just why I commented what I commented.
Re: (Score:1)
Note: never directly reply to someone you have positively identified as troll (aka feeding), especially if it's APK... there will be no reasonable discussion and he's wasting a shitload of time twisting words (everyone may spend their time as they see fit though).
I even will not be going to read all that text in reply to your posting, because I'm sure there isn't anything worthwhile in there.
The UID thing is trivial enough for everyone to see, assuming the average /.er still has a working intellect as they
Re: (Score:1, Informative)
A PhD in English is certainly not required to ensure good communication. You've fallen victim to the Fallacy of Grey [lesswrong.com] - "not a professional in English teaching" is not the same thing as "unable to communicate well". Strive for perfection in everything you do, as Sir Henry Royce tells us.
Re: (Score:3, Informative)
I don't have a PhD in English, but I don't need one to tell you "broadened" is the wrong tense. The second sentence should read, in part,
instead of the way it is currently written.
This has nothing to do with language "evolving" or gramm
Re: (Score:2, Insightful)
The average Slashdot summary makes this very, very evident.
Re: (Score:2)
a big problem with "its not a formal document so FOAD" is that not making the effort can transfer to YOUR CODE the folks that try to use more formal grammar are just not wanting to let that kind of language laziness pass.
Okay so we shouldn't be arguing between NYT and Yale commas but dumping a complete trainwreck of language in and then claiming Not Formal so I CAN HAZ EROARS is Bollocks.
(and yes i know that i was not perfect myself but i at least used the Builtin spellcheck and tried)
Re: (Score:2)
Would you rather be corrected by well-meaning grammar lawyers, or continue making and compounding mistakes until you're writing in a language that may be difficult to receive by the intended audience?
Consider what a failure to communicate may mean. In the case of the summary, a failure to receive the communication would be more detrimental to the reader than to the writer, but those roles can also be reversed when the author needs to be understood more than the recipient needs to understand. Also consider
Re: (Score:2)
Once more so it "sinks in" (drink this in and digest it): If you can't gather the meaning of words within the framework of the context they're used in, you're the problem. Incidentally, the topic here is not english grammar you know! Writing style is pure opinion, like who's resume is better or worse. As long as the audience gets the message that is what is most important.
Yes, the audience getting the message is the most important thing. Yes, people can get the message despite spelling and grammar. And yes (although you didn't say it) pedantry about grammar is often just snobbery about education, thinly disguised.
But none of the above dissuades me from prefering to a well-written sentence.
Re: (Score:2)
Re: (Score:2)
Wasn't the IPO a good thing for facebook?
Just think about it. They managed to trick people into putting much more money into the company then what it was worth. That money is still in the company now, even if the stock price crashed.
There's a bug (Score:3, Funny)
I can log in with someone else's cookie. (Score:1)
Re: (Score:1)
Re: (Score:1)
Re: (Score:2)
One remotely feasible attack to get someone's cookie?
Easy to do on your own computer. Trickier on any larger scale.
cost vs risk = capitalism? (Score:3)
OK, so I'm the Facebook corp. and I run a cost vs. risk analysis and come up with the numbers and resulting decision we see here today. Clearly they have the money, and the relative risk plus technical infrastructure so they figure this works out for them.
OK, let's say I'm a Blackhat criminal hacker, poking around the Facebook network doing nasty stuff all the time, as best as I can, because this is what I do. And one day I get caught by Facebook or someone else along those lines. I am so busted. But wait, I can explain I was really a white hat all along, just trying to feed my family the best I can. Whatever happens next can't be too bad, and I'll live to fight another day. So then I figure capitalism rocks. Also maybe I'll see what Facebook offers when I really find a big hole worth exploiting.
Win, win, and so captilism = security?
There must be something I am not seeing here. Could such pure capitalism do something about all those evil Chinese and Russian and Ukranian hackers too? That which laws and police cannot really do very well at this time?
To look at this another way, the US/Israeli State Resources behind Flame and Stuxnet (etc.) seem to have been fairly successful doing harm.
Re: (Score:2)
There must be something I am not seeing here. Could such pure capitalism do something about all those evil Chinese and Russian and Ukranian hackers too?
If the payout for playing for white hat team was guaranteed to be better, I could see a lot of those motivated by money to be swayed over.
Comment removed (Score:3)
Fairly cynical view... (Score:5, Insightful)
"Nobody expects malicious attackers to have a change of heart and hand over information about a vulnerability for a few thousand dollars when they could sell the stole information for much more. "
I really don't think that all hackers are greedy. While there are hackers who are willing to take the risks of selling hacks to criminals, there are probably many hackers who would be interested in exploring vulnerabilities for a modest legal reward.
Re: (Score:2)
Re: (Score:2)
Makes sense (Score:2)
Just count each successful attack as another active user. I guess every bit helps when your stock value is on the line.
DNS hack (Score:2)
Re: (Score:1)
Can't you give me some information about the hosts file? You probably don't know about that, maybe a little too advanced for you.
Facebook needs a GOJF card "ap" (Score:2)
I if i was going to try for the money then i would detail my efforts and then not give the info to FaceBook before i get issued a GOJF card (i would also have a Trusted Third Party monitor things so FB can't say "you used your hack to steal X from us beyond what was needed to prove the hack")
If FB won't play ball then the info goes up on "HackBay" on a 12 million dollar reserve
Cheap (Score:2)
Although I can see the appeal of something like "bug bounties", I can't help but feel that it's basically testing on the cheap. As an IT professional, it feels a bit like devaluing a highly skilled career; or at best, making testers nothing but self-employed, pay-as-you-go workers rather than full employees or traditional contractors.
I mean, what Facebook are basically offering is "no win no fee" Penetration Testing. Rather than paying a team of certified, experienced Pen Testers to run a thorough and compr
Google deliberately crowd sources testing (Score:2)
Along with some interesting revelations, the interview of James Whittaker about his book, How Google Tests Software [conversationsnetwork.org], included some discussion about effective crowd sourcing of software. Part of his argument is that even the best test engineers are going to miss things that end users find easily, so one way to leverage this is to make it as easy as possible for end users to provide high quality bug reports. He also has a lot of interesting things to say about scaling the testing process.
PHP (Score:1)
Virtually every feature in PHP is broken somehow. The language, the framework, the ecosystem, are all just bad. And I can’t even point out any single damning thing, because the damage is so systemic.
fun read
Am I missing something? Buy bugs from black-hats? (Score:2)
If they care about paying the right price for the bugs, why not just buy the existing exploits from the black-hats? Hackers get paid what the bug is ACTUALLY worth (on the black market), you fix even more bugs, driving more folks to search for cracks, driving bug price down, everyone's happy?
I get that white hatters are beneficial, but I'd still be careful attaching my name to a "bug bounty". They can throw you in jail for white hat hacking at a whim -- It's still illegal by the retarding letter of th
"Challenge accepted" (Score:2)
Decriminalization (Score:2)
Now it's legal to hack their network. Which is a nice move for white hats, but it also gives black hats permission to fuck around with people's private data.
Why not provide a copy of the facebook software with mock up data to which you give permission to hack.
Facebook IS the attack (Score:2)
Re: (Score:2)
Re: (Score:2)
I am not a mother. Would that affect the chances of me getting paid, sir?