Re:Deleted Facebook photos persist in CDN cache 16 months later
by Terretta on Monday October 11, 2010 @07:35PM
(#1781721)
Fully deleting the photo at least reduces the user's attack surface.
Re:Deleted Facebook photos persist in CDN cache 16 months later
by tptacek on Monday October 11, 2010 @07:37PM
(#1781732)
Imagine a web application with an SQL Injection flaw. There's a zillion things the application can do to "reduce its attack surface" without fixing the flaw; for instance, it can log you out and lock out your account if you ever cause a SQL syntax error. Of course, virtually of these things are dumb.
Facebook could reduce its attack surface meaningfully by eliminating the static-file CDN. But this isn't a reasonable step to take; it generates minimal (infinitessimal!) privacy advantages for users while drastically complicating their service.
In the other case, users can use less well-documented features of their browsers to violate Facebook users' mental model of how much control they have over their photos.
The fact that Facebook could address the latter problem but hasn't doesn't upset me, because it's mooted by the former problem.
I acknowledge the PR problem they have blundered into by accepting this otherwise insignificant risk, though: bored tech journalists can use it to gin up sensational stories that further the narrative about Facebook's cavalier attitude towards privacy. I'm not suggesting that it was a good call on Facebook's part to do this.