Two Facebook fans generated a load of free publicity for their new blog when, in their maiden post, disclosed a vulnerability in the social-networking website that could enable outsiders to view parts of profiles that are set to private.