<i>I am not saying that the sec researcher is right here. I don&#x27;t care about him, he is just some random guy who wants publicity. Talking about FB is more interesting</i><p>You&#x27;re right. An important thing has gotten lost in the shuffle.  We should be pointing and laughing at Facebook.  Then when the giggling dies down, asking: Something this bad and with such a &quot;trivial&quot; vuln manged to get published, what else have their now-proven-to-be-shitty practices left open?<p><i>He found stuff. He didn&#x27;t use it (AFAIK) for anything bad.</i><p>Reminds me of the way business dudes and non-security devs used to react before security got all popular and legit.  And they could have even avoided the whole public brewhaha if communication had been better between the tester and the product staff. Classic blunder.<p><i>Complaining to his boss and acting all pissed suggests that they do not understand they they did mess up big time.</i><p>They jumped to contacting someone over his head before engaging in real talk with him.  And then their public response is covering their ass by arguing over the fine print of how he shouldn&#x27;t have been poking around where he was.<p>Obviously there are differences, but similarities are fun too!