> Yes, but it is exactly these kind of policies that let enterprises, corporations or organizations look bad.

And what do you propose the alternative? A legalised document that outlines every "if this"-"then that", in every language, continent, dialect, etc.? You know how that story goes...

> And denying some kid a few hundred bucks even so he found a legit hack just because he didn't follow some proper corporate policy guideline does definitely reflect negatively on Facebook.

You know what makes Facebook look even more negative? The future precedence set when good-will hackers think it's OK to use a non-test account and drop the exploit on the CEO's page.

I know it's hard for the HN community to do so, but let's try practicing some empathy with both sides before we pick up the pitchfork.

What is worse, a harmless facebook message on the CEOs wall or this exploit getting in the hands of malicious spammers.

I suppose I didn't articulate that point correctly. Facebook has a policy that basically says "if you find an exploit don't do it to real people, use a test account to reproduce it". So regardless of whether it's the CEO or Jane Doe, it sets a bad precedence that reproducing the exploit in a (real) environment is a very dangerous thing.