Neal Poole

Interested in web application security. Security Engineer at Facebook. My tweets do not reflect the opinions or views of my employer.

[Neal Poole @NealPoole]

@BronsonGhost @Jester0x01 @tabaahi_ But it’s certainly possible that something has changed here in the past 7+ years: lots of things have changed in that time! I’m not sure I understand why it’s being brought up now though.

[Neal Poole @NealPoole]

@BronsonGhost @Jester0x01 @tabaahi_ Ah, found it. Looks like 7+ years ago. :-)

You asked about a case where the FB app has location permissions but the camera app does not, and photos taken inside of the FB app were geo-tagged. What I said was that, to my knowledge, the app just uses any EXIF tagging in the photo.

[Neal Poole @NealPoole]

@MattressFirm Telling me that you’ll get back to me in 24-48 hours on a delivery happening sooner than that isn’t a great response, but I appreciate the engagement.

[Neal Poole @NealPoole]

@dbph @infosec_au @fin1te @BonJarber

[Neal Poole @NealPoole]

@juliocesarfort @nnwakelam Yup, reports can be submitted via https://t.co/Q66SzKa0BD

[Brown CS @BrownCSDept]

Congratulations, Brown CS Class Of 2020!

It gives us a lot of happiness to share the following celebrations of our 2020 graduates, including a special video from our faculty. We've never been prouder to be part of the @BrownCSDept community.

https://t.co/Fwrt7wMF4s

[Neal Poole @NealPoole]

@Kirtikumar_A_R @ErayMitrani @nchlgpt @the_st0rm @reginaldojsf @OrenHafif @linshunghuang @ngleicher In general, reporting a default behavior of Wordpress as a security issue in a site hosted by the maintainers of Wordpress is unlikely to be a valid report.

[Neal Poole @NealPoole]

@Kirtikumar_A_R @ErayMitrani @nchlgpt @the_st0rm @reginaldojsf @OrenHafif @linshunghuang @ngleicher 1: Wordpress VIP is owned/maintained by Automattic. So concerns that aren’t specific to a site (ie: the XML-RPC endpoint) should be directed to them.
2. If we told you a report doesn’t qualify, behavior still may change for many reasons. That doesn’t mean your report qualifies.

[Neal Poole @NealPoole]

@Kirtikumar_A_R @ErayMitrani @nchlgpt @the_st0rm @reginaldojsf @OrenHafif @linshunghuang @ngleicher If you have questions about a report you should direct them to the report itself. Thanks!

[Neal Poole @NealPoole]

@sophiebits Too nuanced for twitter. Shoot me an email and we can chat. :-)

[Neal Poole @NealPoole]

@2600 There was an error with our automated systems related to spam and abuse: it has now been corrected.

[Neal Poole @NealPoole]

@2600 Should now be fixed: apologies for the confusion!

[Nick Sullivan @grittygrease]

At #realworldcrypto, @JonMillican just announced definitively that @Facebook will ship end-to-end encryption in Messenger. Bold. No timeline was provided, however.

[Abdulrahman Alqabandi @Qab]

Writeup on how I made $40,000 breaking the new Chromium Edge using essentially two XSS flaws.

https://t.co/VZ3QGbxDF5

[Neal Poole @NealPoole]

@wongmjane Sorry for the inconvenience. The issue has been resolved and you can now submit your flags in the CTF.

[Neal Poole @NealPoole]

@phwd Looking forward to more awesome submissions in 2020. Thanks for everything you do :-)

[Neal Poole @NealPoole]

@ThorstenRinne @FacebookDE Try it now! :-)