Getting any Facebook user's friend list and partial payment card details

Re:Getting any Facebook user's friend list and partial payme... by user5994461 on Friday March 09, 2018 @04:56PM (#16555380)

It's a trivial bug. If the parameter is invalid, return nothing, rather than return all the credit cards.

I'd be worried if any company is not able to understand the problem and publish a patch in a few hours.

[ Parent | on HN ]

Re:Getting any Facebook user's friend list and partial payme... by compiler-guy on Friday March 09, 2018 @05:35PM (#16555636)

The fix isn't the hard part. It's the deployment and validation that can take time.

Pretty impressive.

[ Parent | on HN ]

Re:Getting any Facebook user's friend list and partial payme... by sundvor on Friday March 09, 2018 @05:40PM (#16555667)

Yep, clearly shows the value of a properly configured CI/CD pipeline.

[ Parent | on HN ]

Re:Getting any Facebook user's friend list and partial payme... by ransom1538 on Friday March 09, 2018 @07:56PM (#16556450)

Yeah here it is:

git pull; sh tests; rsync /prod/ all@prod:/var/www/

^ That is copyrighted by the way. Ill take a consultant fee. I know - I know it should be thousands of lines of puppet, jenkins, hooks, Kubernetes, Salt, and 2 million lines of python and ELM all piped through Docker containers -- I am NOT an animal.

[ Parent | on HN ]

Re:Getting any Facebook user's friend list and partial payme... by xevb3k on Friday March 09, 2018 @08:25PM (#16556556)

Enterprise edition with test validiation and continuous deployment:

while true; do git pull; sh tests && rsync /prod/ all@prod:/var/www/;done

[ Parent | on HN ]

Re:Getting any Facebook user's friend list and partial payme... by hedora on Sunday March 11, 2018 @03:41PM (#16564411)

You forgot to rewrite the logic in xml, and then fetch it over the internet from unknown third parties by tunneling it through json, then http. Bonus points if the the whole thing is deployed via docker hub.

[ Parent | on HN ]

Re:Getting any Facebook user's friend list and partial payme... by pronoiac on Friday March 09, 2018 @08:25PM (#16556558)

!!!

those ... those semicolons should be &&

[ Parent | on HN ]

Re:Getting any Facebook user's friend list and partial payme... by hedora on Sunday March 11, 2018 @03:43PM (#16564422)

You need to invoke the script via ‘sh -ex’ for proper exception handling + debuggability.

Also, mktemp and shell exit traps are your friends.

[ Parent | on HN ]

Re:Getting any Facebook user's friend list and partial payme... by paulddraper on Sunday March 11, 2018 @02:07PM (#16564045)

Except that this is Facebook, so `sh tests` is going to take 900 cpu-hours

[ Parent | on HN ]

Re:Getting any Facebook user's friend list and partial payme... by davedx on Saturday March 10, 2018 @07:19AM (#16558195)

Git pull - you have a staging server!?

[ Parent | on HN ]

Re:Getting any Facebook user's friend list and partial payme... by bobbyi_settv on Friday March 09, 2018 @09:14PM (#16556715)

I'd more impressed in some other context since a willingness to skimp on validation and "red tape" is how a bug like this ends up in production in the first place.

[ Parent | on HN ]

Re:Getting any Facebook user's friend list and partial payme... by Pxtl on Friday March 09, 2018 @09:19PM (#16556731)

What validation? I'd assume for this one they'd take the "move fast and break things" approach.

[ Parent | on HN ]

Re:Getting any Facebook user's friend list and partial payme... by user5994461 on Friday March 09, 2018 @05:46PM (#16555712)

The deployment and the validation should be trivial if the fix is trivial.

The difficult part is having someone who reads the report and escalates it, preferably in a timely manner.

[ Parent | on HN ]

Re:Getting any Facebook user's friend list and partial payme... by compiler-guy on Friday March 09, 2018 @05:51PM (#16555743)

The world is littered with the smoking, segfaulted, hulks of programs that were quickly deployed after an obvious fix.

[ Parent | on HN ]

Re:Getting any Facebook user's friend list and partial payme... by IncRnd on Friday March 09, 2018 @08:54PM (#16556662)

> The deployment and the validation should be trivial if the fix is trivial.

Trivial. That's what Oculus said.

[ Parent | on HN ]

Re:Getting any Facebook user's friend list and partial payme... by mkagenius on Friday March 09, 2018 @06:32PM (#16556035)

> If the parameter is invalid, return nothing, rather than return all the credit cards

I don’t think that’s the bug here, bug here is the authorization check not being there.

That parameter is trivial to obtain using other ways even now.

[ Parent | on HN ]