Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zuckerberg Takes Steps to Calm Facebook Employees

nytimes.com

Post reply on HN
Print view View original

11–20 of 274 posts

Re: Zuckerberg Takes Steps to Calm Facebook Employees

#11

Post by dannyw »

harryh wrote: post #5
mehrdadn wrote: post #2

I feel like someone should also give Zuckerberg the memo that it's only a matter of time before an insider also goes rogue and abuses data access (edit: or otherwise; see below). Facebook fundamentally seems to trust itself way too much, and it worries me that it thinks the only threats are external entities... to me, this is another silently ticking time bomb. EDIT: And don't forget that going rogue is just one scen…

You'd think so, but most companies have pretty strict internal controls for this sort of thing. Access is also carefully logged so a leaker is pretty much guaranteed to get caught at which point they'd immediately lose their job and likely face criminal prosecution. With so much to lose and so little to gain internal leaks of this sort are extremely rare.

I hope so, but keep in mind Facebook has a magical password that worked for every account for almost a decade.

Re: Zuckerberg Takes Steps to Calm Facebook Employees

#12

Post by harryh »

mehrdadn wrote: post #9
harryh wrote: post #5

Earlier quoted context omitted.

You'd think so, but most companies have pretty strict internal controls for this sort of thing. Access is also carefully logged so a leaker is pretty much guaranteed to get caught at which point they'd immediately lose their job and likely face criminal prosecution. With so much to lose and so little to gain internal leaks of this sort are extremely rare.

> You'd think so, but most companies have pretty strict internal controls for this sort of thing. Access is also carefully logged so a leaker is pretty much guaranteed to get caught at which point they'd immediately lose their job and likely face criminal prosecution. That's not enough by any means (edit: and as [1] pointed out, I don't even think it's true). There needs to be more to security than mere deterrence. I…

That sort of access limitation is what I meant by "pretty strict internal controls."

Having never worked there, I can't speak to how it works at FB but I would imagine that there are a lot of limitations on what rank and file employees can do. I guess I could be wrong. Perhaps someone with direct knowledge will chime in.

Re: Zuckerberg Takes Steps to Calm Facebook Employees

#13

Post by tptacek »

harryh wrote: post #5
mehrdadn wrote: post #2

I feel like someone should also give Zuckerberg the memo that it's only a matter of time before an insider also goes rogue and abuses data access (edit: or otherwise; see below). Facebook fundamentally seems to trust itself way too much, and it worries me that it thinks the only threats are external entities... to me, this is another silently ticking time bomb. EDIT: And don't forget that going rogue is just one scen…

You'd think so, but most companies have pretty strict internal controls for this sort of thing. Access is also carefully logged so a leaker is pretty much guaranteed to get caught at which point they'd immediately lose their job and likely face criminal prosecution. With so much to lose and so little to gain internal leaks of this sort are extremely rare.

most companies have pretty strict internal controls for this sort of thing

This does not ring true to me at all.

Re: Zuckerberg Takes Steps to Calm Facebook Employees

#15

Post by harryh »

tptacek wrote: post #13
harryh wrote: post #5

Earlier quoted context omitted.

You'd think so, but most companies have pretty strict internal controls for this sort of thing. Access is also carefully logged so a leaker is pretty much guaranteed to get caught at which point they'd immediately lose their job and likely face criminal prosecution. With so much to lose and so little to gain internal leaks of this sort are extremely rare.

most companies have pretty strict internal controls for this sort of thing This does not ring true to me at all.

It was true at Google. It's certainly true at financial institutions. I dunno about Amazon. I'm not sure what other comparisons would be relevant here.

EDIT/NOTE: https://news.ycombinator.com/item?id=16675493

Re: Zuckerberg Takes Steps to Calm Facebook Employees

#16

Post by zawerf »

gboudrias wrote: post #4
mehrdadn wrote: post #2

I feel like someone should also give Zuckerberg the memo that it's only a matter of time before an insider also goes rogue and abuses data access (edit: or otherwise; see below). Facebook fundamentally seems to trust itself way too much, and it worries me that it thinks the only threats are external entities... to me, this is another silently ticking time bomb. EDIT: And don't forget that going rogue is just one scen…

Who says it hasn't happened already? How would we ever know? For that matter, how would Zuck?

Anecdotally I've heard of interns getting fired for just looking at profiles (that they aren't actual friends with) even around 5 years ago. So at least they take it somewhat seriously.

Re: Zuckerberg Takes Steps to Calm Facebook Employees

#17

Post by cornellwright »

dannyw wrote: post #11
harryh wrote: post #5

Earlier quoted context omitted.

You'd think so, but most companies have pretty strict internal controls for this sort of thing. Access is also carefully logged so a leaker is pretty much guaranteed to get caught at which point they'd immediately lose their job and likely face criminal prosecution. With so much to lose and so little to gain internal leaks of this sort are extremely rare.

I hope so, but keep in mind Facebook has a magical password that worked for every account for almost a decade.

Source?

Re: Zuckerberg Takes Steps to Calm Facebook Employees

#18

Post by ronnier »

mehrdadn wrote: post #2

I feel like someone should also give Zuckerberg the memo that it's only a matter of time before an insider also goes rogue and abuses data access (edit: or otherwise; see below). Facebook fundamentally seems to trust itself way too much, and it worries me that it thinks the only threats are external entities... to me, this is another silently ticking time bomb. EDIT: And don't forget that going rogue is just one scen…

> to me, this is another silently ticking time bomb.

I agree. It'll eventually happen to some social app or email provider (think Slack, gmail, facebook, etc) where some huge portion of the database is dumped online -- not through a hack, but through a person willing to do it internally because they can and do not fear or care about the consequences. The Ashley Madison hack was a preview of what's to come.

Re: Zuckerberg Takes Steps to Calm Facebook Employees

#19

Post by mehrdadn »

harryh wrote: post #15
tptacek wrote: post #13

Earlier quoted context omitted.

most companies have pretty strict internal controls for this sort of thing This does not ring true to me at all.

It was true at Google. It's certainly true at financial institutions. I dunno about Amazon. I'm not sure what other comparisons would be relevant here. EDIT/NOTE: https://news.ycombinator.com/item?id=16675493

> It was true at Google.

Yes, because Google is not your average company. It takes security extremely seriously... in fact it's about as awful of an example as you can give for a blanket statement you made about "most companies".

Re: Zuckerberg Takes Steps to Calm Facebook Employees

#20

Post by tptacek »

harryh wrote: post #15
tptacek wrote: post #13

Earlier quoted context omitted.

most companies have pretty strict internal controls for this sort of thing This does not ring true to me at all.

It was true at Google. It's certainly true at financial institutions. I dunno about Amazon. I'm not sure what other comparisons would be relevant here. EDIT/NOTE: https://news.ycombinator.com/item?id=16675493

I believe it's true of Google! I do not believe it's true in general.
Post reply on HN