131–140 of 331 posts
Earlier quoted context omitted.
[flagged]
Similar punishment for similar transgressions is how the law is supposed to work.
Facebook and Equifax did not commit similar transgressions, and to say to is misleading.
Take everything Facebook is, and burn it until it's unrecognizable. Flush the wreckage down the toilet.
Take all the data centers. All the bare metal. All the semiconductors, printed circuit board, cooling fans, wiring and fiber optics, toss it into the slag lagoon of some disused strip mine.
Take all the former employees and assign them to boondoggle re-education camps that they cannot leave until they acknowledge that the entire upper eschelon of the company was a zoo of useless quacks.
Zuckerberg himself should land in the cell previously reserved for Bradley/Chelsea Manning. His crimes are fundamentally equivalent, if you want to split hairs. The two only differ in scale and audience. Mutually exclusive counterparts of each other if you stop to think about it for a moment.
And then? What comes next?
I'm not sure. This is whole thing is a bad hangover we need to sleep off. What were things like before this nightmare. We need to gain some distance to acquire the proper context, and find our bearings before charting another course.
I remember what things were like before. What they were supposed to become, before this horrendously rude interruption.
But then millions of people dumped their lives out in the open, and it got used against us, and look where we are now.
Clearly, discretion is the better part of valor.
Earlier quoted context omitted.
I've worked for multiple Fortune 25 companies, and that excuse does not fly. Not in banking or healthcare, where breaches of privacy/confidentiality are actually illegal, rather than merely distasteful. Small teams and careless devs doing that sort of bad logging will be caught and corrected by strict security oversight. This is the sort of thing that leads the HN crowd to sneer at the old, slow ways of the enterpris…
The passwords in plaintext wasn't a breach or a leak. If you punish Facebook for it, they would be less inclined to share such information in the future.
Isn't that just like 1 month's worth of revenue? That amounts to absolutely nothing in today's world, not even an incentive to reduce the bad behavior. Jail time for lawbreaking executives needs to happen . The financial penalties do not dissuade bad behavior or act as a deterrent, so the same crimes will continue to be committed. Are there any peer-reviewed studies looking at deterrence of financial/tech/privacy cri…
I don’t know man, 20% of your annual income would be seen as a sizeable fine. That’s 20% of their yearly profits, and it wipes out most of their earnings for Q1.
Earlier quoted context omitted.
Seems like a pretty trivial automated test for so many PHD's to miss: create_user('Bob', 'BobPassword123') assert "BobPassword123" not in logfile
Ah yes, the single, non-distributed, file-backed log Facebook uses.
Before this thread becomes a Facebook bashing session, please keep in mind that Equifax leaked all your SSN data along with names and addresses and got away with no fines.
I am not a lawyer but intent appears to play a big role. A company that is negligent or incompetent will always face a lesser repercussion than one who acts deliberately. Now of course this is not to exonerate Equifax whose entire premise rests on safeguarding sensitive information. From the consumer side, the 2 incidents are equally bad.
Is this a joke? You are not Equifax's customer and they do not need your trust. Their entire premise is selling information about you, to people who do not trust you. Securing your data is something they have to do for compliance, not a core part of their business.
Earlier quoted context omitted.
Words like malice and evil require intent. If we don't want the conversation to be about intent, we should use words like amoral. Facebook isn't actively trying to harm their customers, they simply don't care about them. That is amoral not evil.
> Facebook isn't actively trying to harm their customers, they simply don't care about them. That is amoral not evil. Don't bend yourself out of shape. Actively, happily ignoring the evil you have caused and continue to cause is evil.
You can call Facebook a number of things from amoral to negligent or even criminal, but once you start talking about evilness you have to start judging their intentions and motives.
Earlier quoted context omitted.
> I don't think it's trivial to guarantee non-existence. I disagree in this case. Log messages don't spontaneously appear in arbitrary places. If the developers understand what their software is doing and how their systems are configured then they should know where to check for the logging messages.
Until someone turned on logging of the full request body on the load balancer/proxy or otherwise unknown-to-you middlebox that was the TLS termination point in production that you did not know about