Did I miss it? I don't see anywhere the author said "I think this facebook bug is worth more than XY dollars". It is obviously worth more than the $5,000 bounty given to someone willing to exploit it. Being able to harvest the email address of any arbitrary Facebook user would be worth much more than $5,000.
If bug bounty hunters are making a calculation of whether to report or sell on the black market, a bug like this would fetch a very large price. I hope people don't add shades of gray, or stripes of black, to their hats with the discrepancies that are regularly reported.
If bug bounty hunters are making a calculation of whether to report or sell on the black market, a bug like this would fetch a very large price. I hope people don't add shades of gray, or stripes of black, to their hats with the discrepancies that are regularly reported.