Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Major Facebook security hole lets you view your friends’ live chats

eu.techcrunch.com

Post reply on HN
Print view View original

41–50 of 67 posts

Re: Major Facebook security hole lets you view your friends’ live chats

#41

Post by MartinCron »

bruceboughton wrote: post #29

This is the kind of feature I would be very nervous of implementing as a developer (showing some data in the context of another user)... to the point of pushing back on it. I imagine it cuts across whole swathes of code, requiring additional checks about the current user. It would be so easy to leave some of these checks out or mess them up. You would have to be very careful about validating your assumptions with thi…

This is the kind of cross-cutting feature I've had to implement for clients, and yes, it's painful.

I built an internal web application for a large and somewhat paranoid company that required three distinct layers of security. While I'm pretty sure I implemented them correctly, and could explain pretty well how they worked when pressed, I think it was just too much for most users to wrap their heads around the mental model.

In retrospect, I should have pushed back. If I couldn't convince them to with a simpler model, I should have at least advocated for adding the layers of security incrementally, both to let the users understand what the model is and to help the development team understand what the model should be.

Re: Major Facebook security hole lets you view your friends’ live chats

#42

Post by MartinCron »

nostrademons wrote: post #34
theycallmemorty wrote: post #28

Earlier quoted context omitted.

Not really. Everyone on this site has worked in software development at one point, right? So everyone here has written a bug before. Its reasonable to expect every piece of software (short of the stuff on the space shuttle) to have bugs. It simply isn't feasible for most software companies to find and fix all of the problems with their products. Facebook, like all other software, is bound to have bugs. If you don't w…

Well, a lot of this is the flip side of FaceBook's "changes are pushed to the live site as soon as they're checked in" policy. That lets them innovate quickly, but also means that whenever anyone screws up, it's immediately visible in a very public way. Other companies have release processes and QA procedures to stop this.

On the whole, I think the rapid innovation model tends to make things safer overall. Tiny changes can be rolled back more easily, or patched more easily.

Release processes and rigorous QA procedures seem more appropriate for client-deployed software like operating systems than for centralized web applications.

Re: Major Facebook security hole lets you view your friends’ live chats

#43

Post by u238 »

nostrademons wrote: post #34
theycallmemorty wrote: post #28

Earlier quoted context omitted.

Not really. Everyone on this site has worked in software development at one point, right? So everyone here has written a bug before. Its reasonable to expect every piece of software (short of the stuff on the space shuttle) to have bugs. It simply isn't feasible for most software companies to find and fix all of the problems with their products. Facebook, like all other software, is bound to have bugs. If you don't w…

Well, a lot of this is the flip side of FaceBook's "changes are pushed to the live site as soon as they're checked in" policy. That lets them innovate quickly, but also means that whenever anyone screws up, it's immediately visible in a very public way. Other companies have release processes and QA procedures to stop this.

Every single line of code is peer reviewed by at least 2 people before it can be pushed.

Re: Major Facebook security hole lets you view your friends’ live chats

#44

Post by axod »

pohl wrote: post #16
seiha wrote: post #15

Earlier quoted context omitted.

Well, at least this confirms that facebook does have the ability to filter out blacklisted URLS to the public friend feed.

...and a willingness to censor within their walled garden. Maybe they had already shown that, but now I know.

Lets have some proof rather than sheepish upvotes hrm?

Re: Major Facebook security hole lets you view your friends’ live chats

#45

Post by derwiki »

jacquesm wrote: post #39

What a waste to blow this right open. Think of the fun you could have had by friending all the people that trample our privacy with both feet and to publish their stuff a year from now or so. I'm pretty sure we'd see them wise up quickly when presented with a taste of their own dogfood. Missed opportunity!

While we're at it, let's hack all the computers of the kernel maintainers every time there's an exploit. Sorry for the sarcasm, but I really don't think exploiting software insecurities is the way to get anything productive done.

Re: Major Facebook security hole lets you view your friends’ live chats

#46

Post by noodle »

theycallmemorty wrote: post #28
ohashi wrote: post #3

Earlier quoted context omitted.

Can we still be angry at incompetence?

Not really. Everyone on this site has worked in software development at one point, right? So everyone here has written a bug before. Its reasonable to expect every piece of software (short of the stuff on the space shuttle) to have bugs. It simply isn't feasible for most software companies to find and fix all of the problems with their products. Facebook, like all other software, is bound to have bugs. If you don't w…

so you're proposing that if someone doesn't like software bugs that they should stop using software?

that would be mighty difficult, as software and their potential bugs are present in most every facet of modern life.

Re: Major Facebook security hole lets you view your friends’ live chats

#47

Post by derwiki »

nostrademons wrote: post #34
theycallmemorty wrote: post #28

Earlier quoted context omitted.

Not really. Everyone on this site has worked in software development at one point, right? So everyone here has written a bug before. Its reasonable to expect every piece of software (short of the stuff on the space shuttle) to have bugs. It simply isn't feasible for most software companies to find and fix all of the problems with their products. Facebook, like all other software, is bound to have bugs. If you don't w…

Well, a lot of this is the flip side of FaceBook's "changes are pushed to the live site as soon as they're checked in" policy. That lets them innovate quickly, but also means that whenever anyone screws up, it's immediately visible in a very public way. Other companies have release processes and QA procedures to stop this.

From chatting with a few Facebook engineers, I'm pretty sure it's not quick to get checked in code -> production (unless it's super urgent)

Re: Major Facebook security hole lets you view your friends’ live chats

#48

Post by invisible »

derwiki wrote: post #45
jacquesm wrote: post #39

What a waste to blow this right open. Think of the fun you could have had by friending all the people that trample our privacy with both feet and to publish their stuff a year from now or so. I'm pretty sure we'd see them wise up quickly when presented with a taste of their own dogfood. Missed opportunity!

While we're at it, let's hack all the computers of the kernel maintainers every time there's an exploit. Sorry for the sarcasm, but I really don't think exploiting software insecurities is the way to get anything productive done.

I think you are missing the point on that one. Kernel maintainers are striving to produce a good product. Those that "trample privacy" are not out to produce anything except profits. Think about the hypocrisy that would be involved if they were offended by their chats being published if they push for similar data (others' data) to be public.

Re: Major Facebook security hole lets you view your friends’ live chats

#49

Post by jacquesm »

invisible wrote: post #48
derwiki wrote: post #45

Earlier quoted context omitted.

While we're at it, let's hack all the computers of the kernel maintainers every time there's an exploit. Sorry for the sarcasm, but I really don't think exploiting software insecurities is the way to get anything productive done.

I think you are missing the point on that one. Kernel maintainers are striving to produce a good product. Those that "trample privacy" are not out to produce anything except profits. Think about the hypocrisy that would be involved if they were offended by their chats being published if they push for similar data (others' data) to be public.

Especially if those chats documented their attitude towards their users.

Re: Major Facebook security hole lets you view your friends’ live chats

#50

Post by TallGuyShort »

derwiki wrote: post #45
jacquesm wrote: post #39

What a waste to blow this right open. Think of the fun you could have had by friending all the people that trample our privacy with both feet and to publish their stuff a year from now or so. I'm pretty sure we'd see them wise up quickly when presented with a taste of their own dogfood. Missed opportunity!

While we're at it, let's hack all the computers of the kernel maintainers every time there's an exploit. Sorry for the sarcasm, but I really don't think exploiting software insecurities is the way to get anything productive done.

That would be a valid comparison if distro maintainers were in the habit of forcing updates of opt-out data-compromising features to your OS.
Post reply on HN