Delete any Photo from Facebook by Exploiting Support Dashboard (opens in new tab)

That was a dig at Facebook, not pg or YC.

That just gives out the same info as https://www.facebook.com/whitehat/, unless (I speculate) you already have a Facebook account and are logged in.

Putting the user id in the request is obviously wrong, since the owner can looked up from the photo id.

Automated testing/fuzzing could find this, but probably better training/practices would be easier to get right and save time/money in the long run.

With the resources they have access to, I'd say there's no real excuse - unless it's not a priority - which could very well be. Privacy only became a priority (which coincides with security) when Facebook started to regularly change people's privacy settings on them.

I'm not there yet.

nope, only thing this would've shown is that pictures aren't really deleted. Think about it. Facebook would do a rollback and all the pictures would be back. However with a little bad luck on their part they'd mess up which would lead to them restoring rightfully deleted pictures (many of them embarrassing). Would this have happened for sure? Probably not, but I strongly believe that this could have ended hilariously and frankly I am a little disappointed that the researcher was a white hat ;)