Facebooks bug bounty program has discovered a number of serious, wacky, interesting and hilarious bugs. This talk will mostly be about those bugs and the lessons we can learn from them. Will also speak to the process of setting up and running a bug bounty program and how it compares to the alternatives (hiring, static/dynamic analysis tools, consultants, etc).