News for hackers. Stuff that matters.

A comment on Getting any Facebook user's friend list and partial payment card details. Parent comment

Re:Getting any Facebook user's friend list and partial payme... by cheeze on Friday March 09, 2018 @03:51PM (#16554918)
Wow. That is extremely impressive that such a large company is able to get a fix out that quickly.
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by wolco on Friday March 09, 2018 @04:28PM (#16555208)
The fix is probably 10 minutes but the deployment process, intake process and notification process took 3 1/2 hours
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by neotek on Friday March 09, 2018 @10:35PM (#16556949)
Is there an article or blog post somewhere about what Facebook's deployment process is like? It must be a massive operation.
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by chromelyke on Saturday March 10, 2018 @12:41AM (#16557282)
https://code.facebook.com/posts/270314900139291/rapid-releas...
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by orastor on Saturday March 10, 2018 @12:54AM (#16557312)
They also use bittorrent:

https://arstechnica.com/information-technology/2012/04/exclu...

[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by styfle on Sunday March 11, 2018 @10:22AM (#16563104)
What about code review process? Surely someone else verified the fix before deployment.
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by ampersandy on Monday March 12, 2018 @02:39AM (#16566553)
FB uses Phabricator, which was spun out into an open-source project:

https://www.phacility.com/phabricator/

[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by aje403 on Friday March 09, 2018 @03:55PM (#16554951)
If it took much longer than that for bugs like this, all of the HN doomsday posts about the Facebook mass exodus might actually come true
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by stochastic_monk on Friday March 09, 2018 @04:35PM (#16555265)
I think people leaving facebook en masse would be a good thing (TM) for society, not a doomsday. Fewer echo chambers, less disinformation, and people forced to make effort to contact each other.
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by clarkenheim on Friday March 09, 2018 @04:38PM (#16555280)
It will only be replaced with another echo chamber.
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by lttlrck on Friday March 09, 2018 @05:01PM (#16555412)
Hopefully multiple smaller ones.
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by murukesh_s on Friday March 09, 2018 @05:16PM (#16555495)
Already there - whatsapp, instagram oops...
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by praneshp on Friday March 09, 2018 @06:32PM (#16556037)
Hacker news....
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by FractalLP on Friday March 09, 2018 @10:50PM (#16557000)
Hacker News is at least somewhat informative in the tech sphere. It tends to favor more esoteric technology like Lisp in lieu of things like Java & JavaScript which is far more favored on Reddit/Programming. Politics are mostly left leaning mixed with some Libertarian views. There is a good splattering of non tech stuff as well (music, art, literature, linguistics...etc). I'd say it's a far cry from fake news and cat videos.
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by IIAOPSW on Friday March 09, 2018 @11:59PM (#16557162)
Its cause of the people. The more popular something is the worse it gets until eventually its all cats and outrage-culture "fake news". The medium is irrelevant.

Media sucks because you* suck.

*The collective societal you, not the particular individual you.

[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by waterhouse on Saturday March 10, 2018 @12:55AM (#16557318)
I think some studies have shown that the same set of people (or, let's say, people randomly assigned to one group or the other) can have very different behavior depending on the situation they're in. It seems at least possible that a forum could maintain its rules and norms while people join... though received wisdom says that if too many join at once, then the norms can be broken.
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by FractalLP on Saturday March 10, 2018 @10:00AM (#16558700)
Yea, but HackerNews is really only going to appeal to a select group of people. Computer illiterate folk aren't going to be talking about compilers, lisp, APL, Smalltalk, blockchain, or the other 1000 compsci things that come up on here daily.
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by stochastic_monk on Friday March 09, 2018 @06:59PM (#16556154)
This effect is partially muted by the fact that one can only see the vote status of one’s own post. There is still a tendency toward conformity, but at least the suggestion to vote with other readers isn’t apparent like it is on many content aggregators/discussion media.
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by UncleEntity on Sunday March 11, 2018 @11:37AM (#16563347)
Yeah but I can predict pretty accurately which of my posts will get downvoted and they all have the same thing in common; they challenge the left-leaning groupthink common here.

Some might claim they get downvoted because they are "low quality" to which I'd retort why spend a lot of time crafting a "quality" reply when you know it's going to be suppressed?

[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by mercer on Monday March 12, 2018 @03:04AM (#16566607)
While it might just be me, I find myself downvoting your comments purely because I find them low-quality noise (or worse) that I'd rather not see more of.

I even tagged you as 'shitty commenter', which I don't do this too often. But with some commenters I'm just amazed at how they can consistently keep this up without tiring of it.

[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by coolso on Saturday March 10, 2018 @01:36AM (#16557415)
Except downvoted posts here turn gray.
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by hedora on Sunday March 11, 2018 @03:37PM (#16564404)
Which is why I make a point of logging in and upvoting the non-egregious ones.
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by bittermang on Saturday March 10, 2018 @12:55AM (#16557320)
Oh, look at them rush to White Knight their own bubble. "Not OUR echo chamber, no! We're different, you see, because reasons."
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by tomcooks on Saturday March 10, 2018 @03:34AM (#16557707)
Scuttlebutt, mastodon, Riot, gab, stack overflow, d.tube, the list goes on
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by rimliu on Saturday March 10, 2018 @06:13AM (#16558051)
Some crtical thinking would be good for a society. Tools are just tools.
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by r3bl on Friday March 09, 2018 @06:17PM (#16555928)
I've been following Josip's work on and off for years now (he's probably on every big white hat hall of fame there is), and I'm pretty sure he wouldn't go public even if it took them a month to fix this.

If he said in a public blog post that it took them a month to fix something so simple, I could see the shit storm aimed at Facebook on social networks (including here), but I highly doubt any user would be compromised.

[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by user5994461 on Friday March 09, 2018 @04:56PM (#16555380)
It's a trivial bug. If the parameter is invalid, return nothing, rather than return all the credit cards.

I'd be worried if any company is not able to understand the problem and publish a patch in a few hours.

[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by compiler-guy on Friday March 09, 2018 @05:35PM (#16555636)
The fix isn't the hard part. It's the deployment and validation that can take time.

Pretty impressive.

[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by sundvor on Friday March 09, 2018 @05:40PM (#16555667)
Yep, clearly shows the value of a properly configured CI/CD pipeline.
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by ransom1538 on Friday March 09, 2018 @07:56PM (#16556450)
Yeah here it is:

git pull; sh tests; rsync /prod/ all@prod:/var/www/

^ That is copyrighted by the way. Ill take a consultant fee. I know - I know it should be thousands of lines of puppet, jenkins, hooks, Kubernetes, Salt, and 2 million lines of python and ELM all piped through Docker containers -- I am NOT an animal.

[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by xevb3k on Friday March 09, 2018 @08:25PM (#16556556)
Enterprise edition with test validiation and continuous deployment:

while true; do git pull; sh tests && rsync /prod/ all@prod:/var/www/;done

[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by hedora on Sunday March 11, 2018 @03:41PM (#16564411)
You forgot to rewrite the logic in xml, and then fetch it over the internet from unknown third parties by tunneling it through json, then http. Bonus points if the the whole thing is deployed via docker hub.
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by pronoiac on Friday March 09, 2018 @08:25PM (#16556558)
!!!

those ... those semicolons should be &&

[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by hedora on Sunday March 11, 2018 @03:43PM (#16564422)
You need to invoke the script via ‘sh -ex’ for proper exception handling + debuggability.

Also, mktemp and shell exit traps are your friends.

[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by paulddraper on Sunday March 11, 2018 @02:07PM (#16564045)
Except that this is Facebook, so `sh tests` is going to take 900 cpu-hours
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by davedx on Saturday March 10, 2018 @07:19AM (#16558195)
Git pull - you have a staging server!?
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by bobbyi_settv on Friday March 09, 2018 @09:14PM (#16556715)
I'd more impressed in some other context since a willingness to skimp on validation and "red tape" is how a bug like this ends up in production in the first place.
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by Pxtl on Friday March 09, 2018 @09:19PM (#16556731)
What validation? I'd assume for this one they'd take the "move fast and break things" approach.
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by user5994461 on Friday March 09, 2018 @05:46PM (#16555712)
The deployment and the validation should be trivial if the fix is trivial.

The difficult part is having someone who reads the report and escalates it, preferably in a timely manner.

[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by compiler-guy on Friday March 09, 2018 @05:51PM (#16555743)
The world is littered with the smoking, segfaulted, hulks of programs that were quickly deployed after an obvious fix.
[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by IncRnd on Friday March 09, 2018 @08:54PM (#16556662)
> The deployment and the validation should be trivial if the fix is trivial.

Trivial. That's what Oculus said.

[ Parent | on HN ]
Re:Getting any Facebook user's friend list and partial payme... by mkagenius on Friday March 09, 2018 @06:32PM (#16556035)
> If the parameter is invalid, return nothing, rather than return all the credit cards

I don’t think that’s the bug here, bug here is the authorization check not being there.

That parameter is trivial to obtain using other ways even now.

[ Parent | on HN ]