A bug that allows unauthorized children to delete content from other user's acco...

tptacek · on May 3, 2016

There are no Facebook vulnerabilities that have a value any higher than what Facebook is going to pay for them.

If Facebook was sending t-shirts instead of writing 4-5 figure checks, these discussions would be more interesting. But that's not what Facebook does.

Put it this way: before Facebook started these bounty programs, what do you think the price sheet for Facebook bugs on the "black market" looked like?

Buge · on May 3, 2016

Well the NSA tapped into Google's internal datacenter traffic to steal user information. So some vulnerabilities like that might be useful to them.

https://cms-images.idgesg.net/images/article/2014/06/googles...

tptacek · on May 3, 2016

I'm having trouble connecting your first sentence to your second. It sounds a little like saying "so, the US army has M109 Howitzers, so maybe they'd be interested in this 3D-printed zip gun I just made."

Buge · on May 4, 2016

I'm not talking about the vulnerability that this kid found. I'm talking about vulnerabilities that would allow access deep into the Facebook infrastructure. I think there are in fact some vulnerabilities the NSA would be willing to pay more than $10k for if it would allow them long term access to a lot of sensitive Facebook data.