I disagree.<p>A security researcher went public with a story of <i>&quot;I found this massive security hole and Facebook tried to avoid paying what I thought it was worth, and then threatened me with legal action&quot;</i><p>The response that Alex thinks he needs to make is &quot;my actions were reasonable because ...&quot;<p>From external appearances it seems as though he is more concerned about looking like a heavy-handed, lawyer-invoking, CSO than the publicity around FB having an unpatched RCE that allowed access to highly-privileged AWS keys.<p>What he chooses to write about is reflection of what he saw as the most important news in the original blog post.<p>I suspect he&#x27;s actually right. The blog post will probably raise more bad publicity around the way FB handled the research &amp; disclosure than the existence of the bug, and it&#x27;s the piece that needs to be resolved well.