Instagram's Million Dollar Bug
As a security researcher and engineer, I&#x27;d like to point out the following, without taking sides:<p>1. Facebook is <i>not</i> going ballistic because this is a RCE report. They have received high and critical severity reports many times before and acted peaceably, up to and including a prior RCE reported in 2013 by Reginaldo Silva (who now works there!).<p>2. The researcher used the vulnerability to dump data. This is well known to be a huge no-no in the security industry. I see a lot of rage here from software engineers - look at the responses from <i>actual</i> security folks in this thread, and ask your infosec friends. Most, perhaps even all, will tell you that you <i>never</i> pivot or continue an exploit past proof of its existence. You absolutely do not dump data.<p>3. When you dump data, you become a flight risk. It means that you have sensitive information in your possession and they have no idea what you&#x27;ll do with it. The Facebook Whitehat TOS explicitly forbid getting sensitive data that is not your own using an exploit. There is a precedent in the security industry for employers becoming involved for egregious &quot;malpractice&quot; with regards to an individual reporting a bug. A personal friend and business partner of mine left his job after publicly reporting a huge breach back in 2012 (I agree with his decision there), and Charlie Miller was fired by Accuvant after the App Store fiasco. Consider that Facebook is not the first company to do this, and that while it is a painful decision, it is not an insane decision. You might not agree with it, but there is a precedent of this happening.<p>I&#x27;m not taking sides here. I don&#x27;t know that I would have done the same as Alex Stamos here, but it&#x27;s a tough call. I do believe the researcher here is being disingenuous about the story considering that a data dump is not an innocuous thing to do.<p>I&#x27;m balancing out the details here because I know it will be easy to see &quot;Facebook calls researcher&#x27;s employer and screws him for reporting a huge security bug&quot; and get pitchforks. Facebook might be in the wrong here, but consider that the story is much more nuanced than that <i>and</i> that Facebook has an otherwise <i>excellent</i> bug bounty history.<p>Edited for visibility: &#x27;tptacek mentioned downthread that Alex Stamos issued a response, highlighting this particular quote:<p><i>At this point, it was reasonable to believe that Wes was operating on behalf of Synack. His account on our portal mentions Synack as his affiliation, he has interacted with us using a synack.com email address, and he has written blog posts that are used by Synack for marketing purposes.</i><p>Viewed in this light (and I don&#x27;t believe Stamos would willfully fabricate a story like this), it is very reasonable to escalate to an employer if they seem to be affiliated with a security researcher&#x27;s report.