Oct 21, 2026, 12:04 PMthe standing rule now is that for every bug i report to the bug bounty program i am withholding a bug of equal magnitude until meta decides to pay me a dime, so that in case they do not pay me then i have something to sell still.
Oct 21, 2026, 12:09 PMmy exit criteria for this is now "meta either pays me and i go and get my pilot's license and forget about computers or else they stop making new bugs that boggle the mind" and we all know that one of these outcomes is possible in this universe while the other is not.
Oct 21, 2026, 12:24 PMone finding that i don't have the patience to chase down is that
a) i am 95% sure that the network egress threat classifier has an LLM in the loop that evaluates the requested URL and other contextual metadata as part of the decision, and
b) i am 25% sure that you can cause the classifier to itself receive a classifier refusal by giving it urls that look like prompt injections or biosafety triggers, and rather than either refusing the connection or opening an approval card, it causes a TLS failure.
i have a ~60k/1 week sample confirming (a), (b) is flaky and trying to measure it locks up the instance
@jonny but Meta is just a poor widdle guy who simply could not afford to pay out bug bounties especially after paying for a product that appears to be a combo VPS/300 security vulnerabilities in a trenchcoat
@jonny Of course there's a third possibility, where you do get your pilot's license only to find that tomorrow's cockpit has an LLM in it for some reason
@jonny tick/talk method . Ie they tick you off you talk about the other one