News for hackers. Stuff that matters.
Re:XCheck at Meta: Why it exists and how it works by zug_zug on Sunday October 16, 2022 @12:36PM (#33224941)
Whoever posted this should probably take it down right away unless it's an approved communication through HR. I'll send an email.
Re:XCheck at Meta: Why it exists and how it works by MonkeyMalarky on Sunday October 16, 2022 @12:44PM (#33225028)
Well now my interest is piqued 1000%!
Re:XCheck at Meta: Why it exists and how it works by navigate8310 on Sunday October 16, 2022 @01:24PM (#33225377)
10th Oct: If BJP's Amit Malviya Reports Your Post, Instagram Will Take it Down – No Questions Asked https://thewire.in/tech/amit-malviya-instagram-meta-xcheck

11th Oct: 'How the Hell Did Document Leak?' – Meta Internal Mail Belies 'Fabricated' Charge Against The Wire https://thewire.in/tech/meta-xcheck-internal-email-watchlist

15th Oct: Meta Said Damaging Internal Email is ‘Fake’, URL 'Not in Use', Here's Evidence They're Wrong https://thewire.in/tech/meta-andy-stone-email-xcheck

Basically, ruling party in India is exploiting XCheck program to curb any dissent.

Re:XCheck at Meta: Why it exists and how it works by SanjayMehta on Sunday October 16, 2022 @01:32PM (#33225446)
Yeah right.

Looks like The Wire got fooled by their source OR is lying.

https://twitter.com/alexstamos/status/1581407731159748608

Re:XCheck at Meta: Why it exists and how it works by nindalf on Sunday October 16, 2022 @01:33PM (#33225451)
Like I mention, all of the evidence The Wire has used here is likely fabricated. Not by the Wire themselves, but by the source they’re relying on.
Re:XCheck at Meta: Why it exists and how it works by csande17 on Sunday October 16, 2022 @07:13PM (#33228049)
If that's the case, it seems like someone should be informing Facebook that their DKIM signing keys have been compromised. The impact of that would be much worse than just a forged .eml file sent to a journalist.
Re:XCheck at Meta: Why it exists and how it works by webmobdev on Monday October 17, 2022 @10:44PM (#33242388)
The source has been verified by The Wire to be a Meta employee / contract worker.

   We reiterate the faith we have in our sources, whose identities and positions in Meta are known to us. Our reporters have had a productive relationship with them for some time already, prior to the Instagram story. Meta’s suggestion that sources who don’t know each other have teamed up to “hoax” The Wire is ludicrous.
Source: https://thewire.in/media/statement-by-the-wire-on-metas-resp...

The emails have been verified to be authentic by The Wire and 2 independent experts, one of whom works at Microsoft. Further proof of the "instagram URL" has been shared.

Even if we assume that the "instagram" workplace portal is the "weakest" evidence and a "fake" (as you and others claim), than Meta should be easily able to identify the person who created the "fake" instance and populated it with all the "fake" tickets. This is what Alex Stamos too tweeted:

   If The Wire is wrong, then Meta has all the evidence they need. While you could create a whole fake Workplace, the easier move is to just create a free trial instance, meaning those fake notes are sitting in Meta's databases along with the metadata of whomever created them.

  I think, at this point, it's on Meta to write-up a detailed response with whatever technical evidence they have. This will not go away just by ignoring it.
The fact is that The Wire have an obligation to protect their source and so are limited in the evidence they can share publicly (unless taken to court). So this begs the question that if Meta and you and other FB employees) are so sure of the evidence being fabricated, why do you think The Wire hasn't been sued yet to take down the "fake" articles? (Note that you do not even need to identify who faked the evidence, to sue them, as long as you can prove that it is fake, which should be easy to do so according to all the claims made by Meta, you and other FB employees).
Re:XCheck at Meta: Why it exists and how it works by KrishnaShripad on Sunday October 16, 2022 @03:02PM (#33226237)
> Basically, ruling party in India is exploiting XCheck program to curb any dissent.

LMFAO. The only problem supporters of the ruling party in India (includes me) have with the ruling party in India is that it does literally nothing to curb dissent (or acts so late it is practically useless). The so called "Farmers Protests" (mostly carried out by rich farmers of Punjab, Haryana and UP backed by Khalistani Terror Organizations in Canada) ran for more than a year. They even blocked main roads and highways. For an entire year. So much so that Modi had to backtrack on the Progressive Farm Laws that had been enacted by the Parliament and set back India's Agriculture by 2 decades. So much for "curbing dissent".

Compare that to how quickly Trudeau crushed dissent, within weeks of it flaring up, by freezing bank accounts of protestors and censoring them. If Modi had done half of what Trudeau did (for both Anti-CAA protests and Farmer protests) he would have been labelled the "Progeny of Hitler" by the media cabal.

The Western Media propaganda has been in full swing for past 2 decades against not just the ruling party in India but also Modi. And it won't die down as long as there are people who will continue to keep spreading this propaganda.

As for the voters in India? The ruling party will come back with even bigger majority in 2024.

The West, their media cabal (both in and outside India) and their favorite Opposition Party (The Indian National Congress) are so disconnected from reality and totally missing the real pulse of the people on ground. Only to their own folly.

Re:XCheck at Meta: Why it exists and how it works by _micheee on Sunday October 16, 2022 @12:45PM (#33225039)
Why?
Re:XCheck at Meta: Why it exists and how it works by bagels on Sunday October 16, 2022 @01:09PM (#33225266)
If they worked at Facebook/Meta they violated their nda and put themself in legal peril.
Re:XCheck at Meta: Why it exists and how it works by nindalf on Sunday October 16, 2022 @01:38PM (#33225492)
I think I’ll be fine.

My reasoning is two fold - I haven’t shared anything that could be exploited by anyone. And second, Meta and others in the industry try to share information about how their integrity efforts work so we can learn from each other.

Re:XCheck at Meta: Why it exists and how it works by nomel on Sunday October 16, 2022 @02:12PM (#33225811)
“Legal peril” and “I think” are not compatible, for a rational person. “I know” is where you want to be, before putting yourself in front of one of the largest collections of lawyers on the planet.
Re:XCheck at Meta: Why it exists and how it works by dapids on Sunday October 16, 2022 @02:31PM (#33225971)
This is not some general blanket approach you can take to talking about internal implementations. You are either right, or wrong. There is no middle ground or "I think". If you've signed an NDA around these internal implementations I would wager that NDA came with a clause to not discuss it without consulting Meta, even after your departure.
Re:XCheck at Meta: Why it exists and how it works by nindalf on Sunday October 16, 2022 @03:01PM (#33226227)
I feel like your concern is genuine. But maybe overblown. I haven’t shared any trade secrets so I’m confident I’ll be fine.
Re:XCheck at Meta: Why it exists and how it works by throwaway98797 on Sunday October 16, 2022 @04:01PM (#33226731)
technical people want technical confirmation

that does not exist, they can’t understand that

you are fine, thank you for the post

Re:XCheck at Meta: Why it exists and how it works by shadowgovt on Sunday October 16, 2022 @04:04PM (#33226754)
And it's obviously BS that companies can abridge a citizen's freedom of speech after the employment agreement ends. If this individual wants to be the case on the lawsuit that's a long time coming, more power to them.

This Supreme Court is not big-tech-friendly; good time to shift up the precedent.

Re:XCheck at Meta: Why it exists and how it works by lopkeny12ko on Sunday October 16, 2022 @01:17PM (#33225331)
Have you never seen https://engineering.fb.com/? Engineers there blog about their tech tools all the time. "Legal peril" sounds like a bit of a stretch.
Re:XCheck at Meta: Why it exists and how it works by wrigby on Sunday October 16, 2022 @01:29PM (#33225420)
These posts are all thoroughly reviewed by comms and legal teams. In onboarding, it’s thoroughly communicated that you need to go through the proper channels to publicly publish anything with technical details.
Re:XCheck at Meta: Why it exists and how it works by bagels on Sunday October 16, 2022 @01:21PM (#33225351)
Those blog posts likely go through legal, privacy and marketing review.

If you think that Facebook wouldn't enforce an NDA, especially on something sensitive like this, I think you are incorrect.

Re:XCheck at Meta: Why it exists and how it works by charcircuit on Sunday October 16, 2022 @02:28PM (#33225944)
Keep in mind there has to be damages to be in legal peril. Otherwise there can only be social consequences.
Re:XCheck at Meta: Why it exists and how it works by bagels on Sunday October 16, 2022 @02:44PM (#33226076)
Many NDAs include liquidated damages.
Re:XCheck at Meta: Why it exists and how it works by charcircuit on Sunday October 16, 2022 @02:57PM (#33226188)
Anecdotally none of the NDAs I've signed included one.
Re:XCheck at Meta: Why it exists and how it works by nvarsj on Sunday October 16, 2022 @01:02PM (#33225195)
This kind of internal tooling and workflow is almost always under NDA.
Re:XCheck at Meta: Why it exists and how it works by tjpnz on Sunday October 16, 2022 @12:51PM (#33225094)
Re:XCheck at Meta: Why it exists and how it works by crmd on Sunday October 16, 2022 @01:26PM (#33225395)
He doesn’t work there anymore[0]

Also, nobody likes a tattle tale.

[0] https://uk.linkedin.com/in/krishna-sundarram-17a76954

Re:XCheck at Meta: Why it exists and how it works by nindalf on Sunday October 16, 2022 @01:36PM (#33225473)
Thanks for the email. But I think it should be fine.

I haven’t said anything that could be exploited by bad actors. As for competitors, there are no competitors in integrity. The entire industry goes to great lengths to share knowledge on what works and what doesn’t. We all win when we combat abuse well.

Re:XCheck at Meta: Why it exists and how it works by hitekker on Sunday October 16, 2022 @06:43PM (#33227841)
You should be fine. The GP seemed to have forgotten they're not posting on FB"s internal workplace.
Re:XCheck at Meta: Why it exists and how it works by MertsA on Sunday October 16, 2022 @07:52PM (#33228301)
Internal comms are notoriously open, this kind of post would be a welcome contribution for explaining XCheck to a general audience outside of the integrity org. I don't know what kind of confidentiality agreement they signed but mine would have technically prohibited discussing this. Not only that, it's not time limited in nature, it applies "at all times during the term of my Relationship with the Company and thereafter".

I wouldn't expect Meta to actually do anything about this blog post but I wouldn't have felt comfortable posting it.

Re:XCheck at Meta: Why it exists and how it works by doliveira on Sunday October 16, 2022 @01:50PM (#33225588)
Do you at least get extra money for snitching on a fellow worker like that?