[lawnchair_larry]

"If you give us a reasonable time to respond to your report before making any information public and make a good faith effort to avoid privacy violations, destruction of data and interruption or degradation of our service during your research, we will not bring any lawsuit against you or ask law enforcement to investigate you."

You think you can sue someone for sharing vulnerability information?

[arice]

Unfortunately, much of the internet industry has an established history of doing just that. This heavy-handed approach to vulnerability disclosure has led to an atmosphere of distrust and is bad for everyone. Facebook's policy is intended to alleviate much of the tension involved with vulnerability disclosure.

If you're curious, the EFF has published a number of great articles on the topic:

https://www.eff.org/issues/coders/vulnerability-reporting-fa...

https://www.eff.org/deeplinks/2010/12/knowledge-power-facebo...

[lawnchair_larry]

I think you are confused. I've been in the security industry for about 10 years. Disclosing a vulnerability is not illegal. Over the years, some companies have tried to sue over this, but these censorship attempts do not turn out well.

Not only is it legal to disclose unfixed vulnerabilities, but it is legal to sell them. Presently, the biggest buyer of them is none other than the US government.

[tptacek]

Whoah. Whoah. Whoah. You're handwaving around the real issue. It's not legal to find vulnerabilities by testing other people's running web applications without permission, and it never has been.

People obviously do it, all the time, against sites that haven't officially given permission (as Google and Facebook have), and most of the time they get away with it, but they are rolling the legal dice every time they do. People have been getting in trouble for doing this for years.

The people selling vulnerabilities are generally running the software themselves. Huge difference.

[lawnchair_larry]

My post, and his reply, were only discussing the disclosure of vulnerability information. I didn't say it was legal to attack a live system that you don't own. I see how you are making that logical leap in the case of facebook, but it isn't necessarily a given. There are ways one can legally become aware of vulnerabilities in facebook, and share that information.