Zuckerberg Takes Steps to Calm Facebook Employees • Hacker News Board

Re: Zuckerberg Takes Steps to Calm Facebook Employees

#201

Post by uxcolumbo » Mon, Mar 26, 2018, 5:32 AM UTC

bamboozled wrote: post #153

sp527 wrote: post #41

Earlier quoted context omitted.

No they’re not. They’re in denial. I used to work there as an intern, so I get a front row seat to how a lot of employees are reacting. The word I would use is: indignation. I’ve seen this us-against-them mentality play out elsewhere in various toxic cult-like organizational cultures. The NSA was a great public example of just how manifestly horrifying things can get with tens to hundreds of decent people willfully p…

I've seen the same behaviour, excellent comment and thanks for sharing. It would be great to see a documentary on these companies and their relationships with the companies they work for.

Not a documentary, but the movie The Circle with Tom Hanks explores some of these issues.

Re: Zuckerberg Takes Steps to Calm Facebook Employees

#202

Post by robrenaud » Mon, Mar 26, 2018, 5:39 AM UTC

underwater wrote: post #114

specialist wrote: post #99

Earlier quoted context omitted.

Who watches the watchers? #1 - There's always a back door. I did some medical records stuff for a while. I looked myself up, just to confirm for myself how trivial it was to do. Yup, there I was. Which is why I insist that all data at rest is encrypted. (I have yet to win this argument.) #2 - Our "portal" product had access logs for auditing. Plus permissions, consent trees, delegation. The usual features. Alas. We a…

As an ex-employee, I feel much more confident in Facebook's processes than the company you're describing. Facebook would have no problem terminating people who do what you're describing.

Imagine you are the Egyptian government. You want to squash a social media fueled rebellion, lead by some anonymous person. How hard is it to get one of your bright and loyal minds hired by Facebook? How much data could such a person exfiltrate before getting fired?

The 'We will log your access and fire you' line of defense prevents nothing from someone who only has a job for the purpose of moving data out.

Re: Zuckerberg Takes Steps to Calm Facebook Employees

#203

Post by DoreenMichele » Mon, Mar 26, 2018, 5:43 AM UTC

sp527 wrote: post #41

madez wrote: post #10

Facebook is an enabler for individuals to successfully undermine our democratic mechanisms. It shouldn't feel nice to work for a company that has to explain itself in front of the government. The employees of Facebook should be aware of what monster they are building.

No they’re not. They’re in denial. I used to work there as an intern, so I get a front row seat to how a lot of employees are reacting. The word I would use is: indignation. I’ve seen this us-against-them mentality play out elsewhere in various toxic cult-like organizational cultures. The NSA was a great public example of just how manifestly horrifying things can get with tens to hundreds of decent people willfully p…

internal spin.

When I worked at a Fortune 500 company during an economic downturn, we were simultaneously seeing endless austerity measures while being plastered with endless positive spin. The free pens and stuff disappeared. The new job listings shrank overnight from pages and pages to a handful. They cut back on janitorial service. There was a pay freeze. Etc.

But all the press releases and news articles being forwarded to our email was about how we flew up the Fortune 500 ranking (iow we were sucking less than other companies during the recession, even though the company shrank, because it's a relative ranking) and our CEO was named one of the biggest wealth builders in the nation and so on.

I was painfully aware of the disconnect. But I sometimes wondered if other employees really noticed or not. I never asked any of my coworkers. I felt like that would be a good way to end up eventually fired. But I wondered how many drank the kool-aid without noticing that it didn't jibe with the austerity measures we were seeing.

Re: Zuckerberg Takes Steps to Calm Facebook Employees

#204

Post by renaudg » Mon, Mar 26, 2018, 5:48 AM UTC

mehrdadn wrote: post #186

renaudg wrote: post #184

Earlier quoted context omitted.

Another ex-FB employee here. I can't believe this is even a thing people are wondering about. Of course not the average employee can't access user data, it's an immediate firing offense.

> Another ex-FB employee here. I can't believe this is even a thing people are wondering about. Of course not the average employee can't access user data, it's an immediate firing offense. Ironically, you're undermining your own point. The fact that they would be fired afterwards in no way contradicts the notion that they could access such data, and in fact suggests they can (hence the firing policy).

Are you genuinely asking a question you would like to know the truthful answer to, or are you just interested in confirming the strong preexisting bias on display in each of your comments on this story ?

You asked about the "average employee" having access to user data, and the answer is unequivocally "no", with both technical and disciplinary safeguards.

There are only a few roles (moderation) who can access the relevant tools, and while engineers may technically have programmatic access (how would you expect things to work if nobody did ?), this is thoroughly logged and you'd better have an ironclad justification not to get fired on the spot.

Re: Zuckerberg Takes Steps to Calm Facebook Employees

#205

Post by KMag » Mon, Mar 26, 2018, 5:51 AM UTC

legostormtroopr wrote: post #144

KMag wrote: post #66

Earlier quoted context omitted.

Former Googler here. I'm pretty sure the vast majority of Googlers understand they work for an advertising company with a gigantic and generally well-run software "engineering" department. I don't mean that in any derogatory sense. Well-regulated advertising is important in helping consumers make informed purchasing decisions.

If advertising were about "helping consumers make informed purchasing decisions" there would never be an attractive model, a wild animal, singing, dancing or any other trope in an ad ever again. They would be a list of superior features of, and only of, the product read in clear, plain terms.

I never said that was their intent, just that it's an important function (often despite the intent of the advertiser).

I did a few searches for embedded development boards, and now I got lots of ads for alternative boards. I don't pretend that this information is in my face altruistically or entirely truthfully, but it does give me some useful information, probably paid out of the pockets of some people who take the advertisements at face value.

It's not the most efficient mechanism I could imagine for disseminating truthful information, but if you're not naive, it's a useful channel.

Re: Zuckerberg Takes Steps to Calm Facebook Employees

#206

Post by newscracker » Mon, Mar 26, 2018, 5:55 AM UTC

Seriously, I don’t have much respect, if any, for those working for Facebook...unless they’re working on and can implement drastic changes in how privacy, tracking and profiling are handled for the betterment of humankind. But Facebook being an advertising company that thrives on such details, I doubt if employees would have much say on these aspects or can do anything.

There ought to be a #quitfacebook topic to get many employees to quit. But I don’t believe that would get much traction due to the attractiveness of compensation/benefits and probably some challenging work. If someone working at Facebook believes that things will get better, I’d say they’re just deluding themselves. It cannot happen with the current management.

P.S.: Since this post is about Facebook, I’m not going to talk about other companies.

Re: Zuckerberg Takes Steps to Calm Facebook Employees

#207

Post by mehrdadn » Mon, Mar 26, 2018, 5:55 AM UTC

renaudg wrote: post #204

mehrdadn wrote: post #186

Earlier quoted context omitted.

> Another ex-FB employee here. I can't believe this is even a thing people are wondering about. Of course not the average employee can't access user data, it's an immediate firing offense. Ironically, you're undermining your own point. The fact that they would be fired afterwards in no way contradicts the notion that they could access such data, and in fact suggests they can (hence the firing policy).

Are you genuinely asking a question you would like to know the truthful answer to, or are you just interested in confirming the strong preexisting bias on display in each of your comments on this story ? You asked about the "average employee" having access to user data, and the answer is unequivocally "no", with both technical and disciplinary safeguards. There are only a few roles (moderation) who can access the rel…

No, I'm interested in knowing the truthful answer. It's just that I've received plenty of seemingly truthful responses (both here and elsewhere, e.g. [1]) that seem quite consistent with the notion that an average-employee(-turned-malicious) would be capable of accessing user data, punishments and all notwithstanding.

> You asked about the "average employee" having access to user data, and the answer is unequivocally "no", with both technical and disciplinary safeguards.

(a) How do you know, and (b) so what is your explanation of stories like [1]? They're just hoaxes?

> and while engineers may technically have programmatic access (how would you expect things to work if nobody did ?)

Again you are wording this in quite a vague, lawyer-y manner, which again raises my eyebrows. "May" as in "might", or as in "do"? And "engineers" as in what fraction of them? There is a lot of wiggle room between "nobody" and "all engineers". It's quite strange that I can't get a straightforward, crystal-clear denial to a non-weasel-worded claim from you who seem to be confidently contesting what I'm saying. Please don't keep muddying the waters.

[1] https://news.ycombinator.com/item?id=16675664

Re: Zuckerberg Takes Steps to Calm Facebook Employees

#208

Post by tmuir » Mon, Mar 26, 2018, 5:57 AM UTC

esman1 wrote: post #183

tmuir wrote: post #118

Earlier quoted context omitted.

He is not trolling. His core point is that there is no sufficient amount of training, or expertise, or monitoring, or punishment, or trying harder the 17th time you've been caught. If you are leaving the decision up to enough/too many humans, then you are by definition providing inferior security. The real education from this story is far deeper than just Facebook. It is that Facebook employees, and Google employees,…

To be fair, at least at FB (I can't speak to Google or Apple or Amazon): 1. Accessing someone's data when it's not mission critical to your work means you're fired on the spot. This is drilled into new engineers over and over. 2. Privacy-related issues are escalated to the highest severity immediately (on par with data centers being down, etc.). I think the question in this whole debate is where you draw the line for…

You know what makes me think you're a bot? I literally laid out the case as to why arguing this point through the lens of disciplined human beings who we have no better alternative than to blindly trust actually helps build a map toward the attack surface instead of mitigating the area of the surface in the first place. And you replied to me with copied and pasted points you've made else where in this very thread. You've just eliminated all of the things bad actors could have had to blindly guess at in ignorance.

Its like you come along and tell a crowd that automobiles are complex enough to be indistinguishable from magic.

Then I take apart an internal combustion engine in front of this crowd. And as I do so, I explain to you, and everyone else, the chemical, physical, thermodynamic, magnetic, and electrical principles that allow this incredibly complex system of individual components to work in concert with each other, using each piece as the appropriate visual aid, delivering every single concept with relatable analogies and stories.

And then after I've finished, you say "To be fair, automobiles are complex machines indistinguishable from magic."

Re: Zuckerberg Takes Steps to Calm Facebook Employees

#209

Post by feelin_googley » Mon, Mar 26, 2018, 5:58 AM UTC

"KW: Mark, can you give us a sense of the timing and cost for this? Like, the audits that you're talking about. Is there any sense of how quickly you could do it and what kind of cost it would be to the company?

I think it depends on what we find. But we're going to be investigating and reviewing tens of thousands of apps from before 2014, and assuming that there's some suspicious activity we're probably going to be doing a number of formal audits, so I think this is going to be pretty expensive. You know, the conversations we have been having internally on this is, "Are there enough people who are trained auditors in the world to do the number of audits that we're going to need quickly?" But I think this is going to cost many millions of dollars and take a number of months and hopefully not longer than that in order to get this fully complete."

Source: https://www.recode.net/2018/3/22/17150814/transcript-intervi...

Re: Zuckerberg Takes Steps to Calm Facebook Employees

#210

Post by renaudg » Mon, Mar 26, 2018, 5:59 AM UTC

mehrdadn wrote: post #19

harryh wrote: post #15

Earlier quoted context omitted.

It was true at Google. It's certainly true at financial institutions. I dunno about Amazon. I'm not sure what other comparisons would be relevant here. EDIT/NOTE: https://news.ycombinator.com/item?id=16675493

> It was true at Google. Yes, because Google is not your average company. It takes security extremely seriously... in fact it's about as awful of an example as you can give for a blanket statement you made about "most companies".

> Google is not your average company. It takes security extremely seriously

While this is certainly true, you've admitted elsewhere not knowing anything specifically about either Google or Facebook's security process, so how can you compare them ? You seem to just "know" Facebook doesn't take security seriously (which is of course a ludicrous thing to say)