Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook engineers: we have no idea where we keep all your personal data

theintercept.com

Post reply on HN
Print view View original

111–120 of 137 posts

Re: Facebook engineers: we have no idea where we keep all your personal data

#111

Post by krinchan »

nicolas_t wrote: post #61
kixiQu wrote: post #33

Earlier quoted context omitted.

I work for a large long-living tech company. Where legal compliance and security are concerned, "it is just layering and organic growth" is not something you get to say. If we were speculating about such a thing on a coffee break, maybe we'd get the kind of answer given here, but if a single reference doesn't exist for something that is necessary for compliance , people get paged until it does. (There may be other th…

Counterpoint, in my career, I've seen a lot of Security Audits that seem on paper to be very thorough and detailed but when you dig deeper, you can see that it only touched the surface and the auditor missed a lot of things.

Someone has been the subject of a SOC audit.

Re: Facebook engineers: we have no idea where we keep all your personal data

#112

Post by seti0Cha »

closewith wrote: post #92
seti0Cha wrote: post #89

Earlier quoted context omitted.

Hah, I might have agreed before I worked on a credit card processing system. There were plenty of rules alright, but it's possible to abide by all the rules without actually making a secure system. Some of the rules made it harder to create a secure system because they did not reflect the state of the art, or they made adding additional security too burdensome to implement. In the end, you can't force competence thro…

> In the end, you can't force competence through rules. I mean, we have in all other forms of engineering. Why is software different?

The software world evolves much faster than any of the engineering disciplines and has fewer physical constraints. The requirements for software are rarely fully specified when construction starts. Software is faster to build, deploy and fix so getting it right the first time is not as important. The environment in which it is deployed changes rapidly and in entirely unexpected ways, which is not the case for things built by engineers. There are plenty of differences. In practice, software is more like a craft than an engineering discipline.

Re: Facebook engineers: we have no idea where we keep all your personal data

#113

Post by vineyardmike »

kixiQu wrote: post #33
ctur wrote: post #11

In many ways you can think of large, long-living tech companies not unlike old cities like, say, London or Paris. The buildings and roads you see are built on top of older buildings and ruins. The streets are weirdly shaped and intersect at odd angles because they were made hundreds of years before and adapted over time as needs evolved. There are catacombs underneath sidewalks and no one genuinely understands it all…

I work for a large long-living tech company. Where legal compliance and security are concerned, "it is just layering and organic growth" is not something you get to say. If we were speculating about such a thing on a coffee break, maybe we'd get the kind of answer given here, but if a single reference doesn't exist for something that is necessary for compliance , people get paged until it does. (There may be other th…

I’ve also worked for big tech companies. On one of my teams, all those docs are written by college hires as a “learning opportunity” and they’re surface level only. Outside of medical or financial systems, I’m guessing most of those docs aren’t worth their weight in bytes.

Here is one conversation I’ve heard: “We stream our logs [full of PII] to a central repo. Do we need to include that in our docs?”

“No. It’s just logging. It’s a standardized tool we use. It’s probably assumed. Just include the database and known clients.”.

Re: Facebook engineers: we have no idea where we keep all your personal data

#114

Post by kixiQu »

ACow_Adonis wrote: post #95
kixiQu wrote: post #86

Earlier quoted context omitted.

I mean, sure, security is complicated, lots of judgment calls, but within this mindset, if a team/org/company said "we have no idea where we're using log4j" it was then their job to have someone working around the clock until they figured that out and fixed it . Figuring out how to meet new requirements that weren't around when systems were begun is, IMO, fully just part of the job. For FB engineers to be throwing up…

as per my other comment, in most of the sufficiently big or historical cases you have to distinguish between two things: - reality - the socially acceptable fiction in the report the exercise would be to create an output that allows people to pretend we know where all instances of "log4j" were used, or that sufficient depth and resources have been expended on such. but in a sufficiently large and complex organisation…

On a spectrum of ridiculousness vs. necessity running from "enumerate where cutlery was used for the past one hundred years" to "keep tabs on the radioactive material we have in storage", it is a choice to vacuum up user data and treat it as the former rather than the latter. It is not unavoidable; it is that Facebook does not want to avoid it. If they did want to avoid it, they could do so in the same way that my employer woke me up to verify that there was no log4j running on some machines that did not have Java installed: unpleasant campaigns, building automated checks, checking the checks, pouring manual effort into the gaps, paying the costs. Slowing down development, maybe. Shifting resources. Rendering some designs infeasible (okay, well, not for log4j, but for a compliance thing I'm thinking of).

It is very important that we are precise here: they are trying to come up with a story to make this about technicalities, and it is actually about their priorities. People who've done large-scale engineering need to be clear that even within a large organization, things do get hunted down if and only if the organization prioritizes them. Measurements and control mechanisms are built. Systems, social and technical, are designed.

And if they're not, Facebook can't honestly say oh but it was so hard it's impossible, we're just too big. We're not talking about detecting I-know-it-when-I-see-it obscenity or whatever social thing people hope AI will fix for them, we're talking about knowing how data is being plumbed from one place to another, and where it lives when it's at rest. It's an embarrassment that this is being presented as a Hard Problem.

Re: Facebook engineers: we have no idea where we keep all your personal data

#115

Post by ElijahLynn »

The special master at times seemed in disbelief, as when he questioned the engineers over whether any documentation existed for a particular Facebook subsystem. “Someone must have a diagram that says this is where this data is stored,” he said, according to the transcript. Zarashaw responded: “We have a somewhat strange engineering culture compared to most where we don’t generate a lot of artifacts during the engineering process. Effectively the code is its own design document often.” He quickly added, “For what it’s worth, this is terrifying to me when I first joined as well.”

“We do not have an adequate level of control and explainability over how our systems use data, and thus we can’t confidently make controlled policy changes or external commitments such as ‘we will not use X data for Y purpose,’” the 2021 document read.

Re: Facebook engineers: we have no idea where we keep all your personal data

#117

Post by notacoward »

The basic problem is one of tracking (or not tracking) copies of data. Your information at Facebook is stored primarily on several storage systems, but extra copies might exist in backups, data-analysis pipelines, logging systems, etc. At the time I left (two years ago), there was a cutely-named project well under way to ensure deletion of those primary copies and (IIRC) backups. Fragments still in data-analysis systems might still exist, but they're also less personally identifying. I don't recall the state of anonymization and provenance tracking that would allow even these remnants to be found and purged for certain. So we're basically talking about two different questions.

(1) Is it possible to be sure that the primary copies and backups are gone, so that finding anything that's left would require some very specialized knowledge and/or an infeasibly massive scan? I believe the answer to this is probably yes at this point.

(2) Is it possible to be sure that absolutely every last vestige of the person's time on Facebook is gone? I believe the answer to this is still probably no, and likely to remain so for some time. At the very last, some artifacts will remain in those opaque AI models.

I suspect the same two answers exist at many companies. What is HN's data retention policy? Oh, oops, none of my data would be deleted if I left. I suspect that Google and/or Apple, maybe Microsoft as well, are a lot closer to "yes" on that second question, but even then I suspect gaps appear from time to time.

I say this not to condemn or defend anyone, and I know companies under stricter regulatory regimes can give more definite answers. It's just the state of the art at Big Tech companies as I understand it.

Re: Facebook engineers: we have no idea where we keep all your personal data

#118

Post by closewith »

seti0Cha wrote: post #112
closewith wrote: post #92

Earlier quoted context omitted.

> In the end, you can't force competence through rules. I mean, we have in all other forms of engineering. Why is software different?

The software world evolves much faster than any of the engineering disciplines and has fewer physical constraints. The requirements for software are rarely fully specified when construction starts. Software is faster to build, deploy and fix so getting it right the first time is not as important. The environment in which it is deployed changes rapidly and in entirely unexpected ways, which is not the case for things…

> The software world evolves much faster than any of the engineering disciplines and has fewer physical constraints. The requirements for software are rarely fully specified when construction starts. Software is faster to build, deploy and fix so getting it right the first time is not as important. The environment in which it is deployed changes rapidly and in entirely unexpected ways, which is not the case for things built by engineers.

These are all artefacts of software development as we practice it, rather than truisms.

> In practice, software is more like a craft than an engineering discipline.

Maybe we should reserve the term software engineering for the applications of software development where rigour is involved?

Re: Facebook engineers: we have no idea where we keep all your personal data

#119

Post by notacoward »

citizenpaul wrote: post #83

This is misdirection plain and simple. In the best most convincing way. Get tunnel vision (sorry) nerds to make an honest display of their ignorance of the bigger picture at Meta. Aww shucks we don't know where that data comes from.... Of course senior engineers don't know where the data comes from exactly. Does your mechanic know where each tire comes from or care? Does your fav restaurant chef know each field that…

> there are most definitively some people that know at least roughly

"At least roughly" is doing a lot of work here. I think what you're getting at is that there are people who know which storage systems are likely to hold that data, but knowing exactly which objects do is far more challenging. Copies get made while data pipelines are tweaked, and then forgotten. Copies get made internally on storage systems as disks/machines fail and get repaired, as rebalancing occurs, and in other cases that typically only one or two members of the team understand at all. (I worked on one of Facebook's largest storage systems for two years BTW.) Copies get made for AI training, experiments, shadow-traffic generation, etc.

Could they do better? Should they do better? Yes and yes. But it's not a lie to say nobody knows how to find every last orphan and fragment. They can pretty reliably delete everything they could find to sell, but that's a very different thing and you're conflating the two.

Re: Facebook engineers: we have no idea where we keep all your personal data

#120

Post by riddleronroof »

Isn’t this a good thing? Every Facebook employee should not know where all PII is. Further, it doesn’t say what data they were looking for. Eg Around the time of the scandal, lots of Facebook quizzes were asking for PII. but it was not stored at facebook. I’m not a Facebook fan, but I’m not a fan of unfounded scary stories either.
Post reply on HN