Live data from Hacker News

More than 1MM Facebook accounts exposed

google.com

61–70 of 181 posts

Re: More than 1MM Facebook accounts exposed

#61
post #26

Earlier quoted context omitted.

to be fair, cache invalidation is hard.

All they need to do is add a new "message" to say "y'know that message number 4029375 in the cache, yeah that ones deleted, ignore it". This is not hard.

This arrogance is baffling. What makes you think you know enough about Facebook's infrastructure to make such a claim?

Re: More than 1MM Facebook accounts exposed

#62
post #49

What exactly was exposed here. It looks like it's been blocked now... Just stealing from other bit in this thread: somehow these urls got on the Internet even though they shouldn't have. They are pre-authed urls that auto-login and then expire.

Seconding this... I see just ordinary account numbers from here.

Still exposed here - when you click a link, it pre-fills the login box with a users email. And I guess some of the links include auto-login tokens.

Re: More than 1MM Facebook accounts exposed

#63
post #55

Common misinterpretation on how Google handle `Disallow` in robots.txt Q. If I block Google from crawling a page using a robots.txt disallow directive, will it disappear from search results? [1] robots.txt Disallow does not guarantee that a page will not appear in results: Google may still decide, based on external information such as incoming links, that it is relevant. If you wish to explicitly block a page from be…

"In this case, you should not disallow the page in robots.txt"

But don't worry, we'll ignore the information in robots.txt anyway, so maybe it's better to have both information there.

And maybe if it's relevant they'll ignore the X-Robots-Tag as well.

Re: More than 1MM Facebook accounts exposed

#64
post #49

Earlier quoted context omitted.

Seconding this... I see just ordinary account numbers from here.

Still exposed here - when you click a link, it pre-fills the login box with a users email. And I guess some of the links include auto-login tokens.

Oh, OK. I can see the mails too, I just didn't think it's such a security risk.

Re: More than 1MM Facebook accounts exposed

#65

Facebook's privacy settings have a ton of bugs. Here's another one: 1. Make a stupid status update post. 2. It appears in all your friends newsfeed. 3. You realize you said something stupid and private. 4. Panic. Delete post 5. Breathe sigh of relief that it is no longer showing up in your profile. 6. But wait a minute! It still keeps showing up in all your friends newsfeed. 7. Now that you deleted the post, you can'…

Mumble mumble mumble eventual consistency mumble mumble sharded MySQL mumble mumble

This isn't a case of eventual consistency. They don't bother to update the cache(if that is the reason) or update the database used in newsfeed. The deleted posts persist in the newsfeed database many hours(maybe forever) after the delete event.

Re: More than 1MM Facebook accounts exposed

#66
post #55

Common misinterpretation on how Google handle `Disallow` in robots.txt Q. If I block Google from crawling a page using a robots.txt disallow directive, will it disappear from search results? [1] robots.txt Disallow does not guarantee that a page will not appear in results: Google may still decide, based on external information such as incoming links, that it is relevant. If you wish to explicitly block a page from be…

We develop and host a bunch of extranets, which without login consist of your typical authentication page. We put a robots.txt file there, and the only sites that link there are our customers companies home sites.

Google still indexes them. The definition of "relevant" here defies my wildest imagination.

Re: More than 1MM Facebook accounts exposed

#67

Earlier quoted context omitted.

Mumble mumble mumble eventual consistency mumble mumble sharded MySQL mumble mumble

This isn't a case of eventual consistency. They don't bother to update the cache(if that is the reason) or update the database used in newsfeed. The deleted posts persist in the newsfeed database many hours(maybe forever) after the delete event.

Caching is a conscious decision to take advantage of eventual consistency.

Re: More than 1MM Facebook accounts exposed

#68
You are able to post on blogger via email. If you register with this blogger-email-address on facebook, all facebook notifications are published as blogger posts and indexed by Google. Actually this might be a used to circumvent a firewall preventing you from using facebook. You can search for the leaked email addresses on Google and propably find blogger blogs with facebook notifications posted.

Re: More than 1MM Facebook accounts exposed

#69
post #43
post #24

Here's one theory and analysis of what might have happened. Some people's emails got out into the public internet, and were indexed. Some of these emails were from Facebook, and included links to resources that require login. These links pre-populated the username field for convenience, or in some cases auto-login the user. Facebook's engineers probably did not anticipate email notifications to users being crawled by…

"Some people's emails got out into the public internet, and were indexed. Some of these emails were from Facebook, and included links..." Doesn't Google's toolbar phone home with the URLs you click on? That could be a way to get supposedly-private URLs into Google's list of URLs to be visited.

Matt Cutts has publicly stated here and in other forums that the Google Toolbar does collect click data but does not use the data to insert URLs into Google's index. Here's a recent(ish) post on the matter:

http://www.seroundtable.com/google-toolbar-indexing-12894.ht...

Re: More than 1MM Facebook accounts exposed

#70
post #59

Earlier quoted context omitted.

Together with off by one errors, they're the two hardest things in computer science...

Yes, the three hardest things in Comp Sci are cache invalidation and off by one errors.

Don't you mean the 10 hardest things?
Post reply on HN