This guy was lucky to be proficient enough in English to recieve the bounty, unlike this guy:
<a href="http://www.theverge.com/2013/8/18/4633046/facebook-security-bug-let-anyone-post-on-walls" rel="nofollow">http://www.theverge.com/2013/8/18/4633046/facebook-security-...</a>
Is it still worth it to follow every link on Facebook and check the URLs/AJAX requests whether the parameters can be tampered with? At Facebook's scale I always assumed there would be someone full-time employed to do this. In fact, I wouldn't mind if it was good paying. Just give me all the Facebook frontend endpoints and I will go by them one-by-one. Manually. I will even document the test cases and what could be intercepted, changed or can be improved in terms of validation.
As I understand it, the exploit involves crafting a URL to send in a removal request to the Facebook support. Wouldn't this count as social engineering or were the removal requests automated?<p>Regardless, well done!