Slashdot Mirror
Facebook Intern Gets Preemptive Ax For Exposing Security Flaw
Engadget reports that Harvard student Aran Khanna, who was about to begin an internship at Facebook, had that internship yanked after he created (and took down, but evidently too slowly for the company's taste) a browser plug-in that exposed a security flaw in Facebook, by allowing users to discover the location of other users when they use the Messenger app. Surely Khanna won't be jobless or internship-less for long. (Don't expect the app to work now; it's still in the Chrome store as a historical artifact, though, and at GitHub.)
So you're trying to get a job at a company and instead of reporting to them a security flaw, you create a Chrome extension to let anybody (ab)use it.
If you're expecting to NOT get fired, you're an idiot.
Your hair look like poop, Bob! - Wanker.
Can someone close that parenthesis? It's driving the LISP part of my noggin nutty.
Some (inspired) companies provide rewards for discovering flaws in their products; allowing them to improve them under controlled circumstances. Some (shorted-sighted) companies punish the discovery of product flaws, preferring the illusion of a pristine public image over the security of their clients. Yet this is clearly a third case: that of it being an intentional "flaw" which was intended to provide revenue. So, if there was such a thing as justice at this level (there isn't) then Facebook should be doubly embarrassed.
here are your choices:
1. employee or white hat or grey hat comes to you with an exploit. you reward him for the discovery, you squash the exploit. the media paints you in a good light. more white hats and employees are eager to come forward with exploits they find. your userbase is happy with the quick resolution, transparency, and eagerness to protect
2. employee or white hate or grey hat comes to you with an exploit. you fire him, sue him, ignore him, censor him. maybe you don't squash the exploit, you think you can just hide it. of course, the media gets wind anyways and paints you as a moron who thinks you can sweep it under the rug or an idiot in denial for your "no comment" when asked about the exploit. white hats and employees are discouraged and hide exploits or, turn into grey hats and black hats and sell your exploit underground or use them for nefarious purposes themselves. you don't find about it until much later as no one wants to talk to you after the reception you've demonstrated. you are hacked, your userbase grows angry and shrinks, your third quarter profit takes a hit, the guys in the corner office call you in and ask you to account for the problems
those are choices middle management morons. proceed accordingly
oh, the guy wrote an app instead of coming to you immediately?
gee, how horrible
hide your blind shortsighted anger, paint on a fake smile, and give him a reward
because that's what is in your best interests you fucking pinhead! you WANT these guys to come to you, so you NEVER show any negativity to anyone who has shown how YOU have failed by discovering the exploit. the original shame, the original failure is YOUR EXPLOIT
it's not a parent-child situation and the kid crashed the family SUV. it's about you failing to provide airtight security with your product and you showing the world that you are welcoming to all friends and foes who would only come to you and tell you what you did wrong to allow the exploit. understand? you failed first, by allowing the exploit to exist
oh, all complicated software has exploits? true. so you're really eager to plug those holes any way you can, right? you're really glad someone found one for you, right? prove it, by rewarding those who find the holes
either the exploits go underground when you storm around like a prima donna when someone finds a hole, or you show how eager you are in due modesty that anyone come forward with an exploit for you to squash, with thanks and kudos
now figure the fuck out what is best for you and your company's bottom line, and don't be such a mediocre empty suit
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
I disagree.. this "idiot" cleverly parlayed an unpaid internship 'firing' into fame and notoriety to get noticed and then hired by a security company; you can't buy this much press even on a Harvard tuition budget. He had a bigger plan all along, and will be hired by a firm in the area of his interest.
Such a firm will be smart to do so. And they will not fail to capitalize on this new hire... they will highlight that one of their employees, [begin bio and / or press release] "...recently made international news by demonstrating a critical security / privacy flaw in FaceBook's messenger application, a flaw that potentially affected hundreds of millions of unsuspecting at-risk FB users".
Pretending this is my office full of bitter coworkers..
Stop using Facebook - it's not that hard!
Too bad that is not what happened. The following is a much closer description. A recent hire who has yet to start work publishes an implementation of an exploit so that anyone can use it
This is wrong, you're buying into the Facebook propaganda. This is a feature that Facebook created on purpose, several years ago. The information leakage was publicly known.
All this guy did was write an app that made the information easier for an average person to see. He didn't need to write an exploit, the information was given to everyone who asked, as a feature.
"First they came for the slanderers and i said nothing."