211–220 of 331 posts
Earlier quoted context omitted.
as it so turns out, you can't rely on capitalism to even have any morality, much less enforce one
Eh, a capitalist system is going to reflect the moral framework of the participants. The participant here is the stock market, and its moral framework is based on economic growth and profit for shareholders. In that regard this was a good outcome and, as a result, is rewarded.
Earlier quoted context omitted.
Not that I completely disagree with you, but lets not pretend that leaking SSN is equivalent to possibly leaking emails and passwords. One of those is far more important than the others. There was also tons of evidence of insider trading by Equifax execs. If anything the Equifax stuff proved to me that the American public doesn't care about privacy and so neither should investors.
Which one are you saying is more sensitive: my ssn or my email password?
Earlier quoted context omitted.
Until someone turned on logging of the full request body on the load balancer/proxy or otherwise unknown-to-you middlebox that was the TLS termination point in production that you did not know about
So their incompetence lies in lacking configuration management in production as opposed to a lack of testing? Why are they manually configuring production servers anyway at that scale?
Earlier quoted context omitted.
Ah yes, the single, non-distributed, file-backed log Facebook uses.
You have no problem with the create_user function? Obviously it's pseudocode my point is there are a finite number of log locations and checking for an instance of a known string among them isn't difficult.
Earlier quoted context omitted.
Yes, we remember. And?
Equifax needs to be fined until its existence can only be found in the history books, and its negligent management needs to be jailed for the long-term harm that they have caused. Same with Facebook. But OP's point is that the collective has too short an attention span to actually hold any of these actors to the law.
It absolutely should be a FB bashing session. Just because some company got away with something doesn't mean they all should.
It seems beside the "the bug bounty is far less than it would have sold for in the dark market" another meme has taken hold of HN. No matter how significant the fine is, there always be people clamoring how trivial it is compared to their revenues. It could have been $10B and you would hear the same thing. The only fine, then, worth slapping is one that bankrupts the entire company. Facebook made ~$7B net income in 2…
Facebook earned about $172 billion since 2013. Do you think facebook would have earned $167 billion while behaving legally? What about ethically? How much do you think Facebook would have earned if it acted responsibly? Once you add punitive damages, I don't understand how you could possibly think $5 billion is anything less than an order of magnitude off.
Considering the fine seems to be primarily based on something they stopped doing in 2014, yeah, I think they'd have easily earned $167 billion without doing it.
Earlier quoted context omitted.
Except the quote is generally wrong when it comes to issues of profit. It's simply backwards. People are fucking evil when it comes to money, profits, power, status, pleasure, and generally getting ahead of others. Considering those are the main motivators for almost all human actions, Hanlon's razor is clearly a bunch of bullshit that people spread around to end actual debate and discussions they don't like.
I don't think the quote is wrong, it's just that some things aren't well explained by stupidity. "Oops, we accidentally stole your data and used it" isn't explainable by stupidity but is explainable by malice. In other words, Hanlon's Razer doesn't say that there is no such thing as malice just that you shouldn't default to assuming malice.
Earlier quoted context omitted.
You have no problem with the create_user function? Obviously it's pseudocode my point is there are a finite number of log locations and checking for an instance of a known string among them isn't difficult.
There are a finite number of log locations now . How do you intend to operate an integration test across the entirety of Facebook's stack to detect new log locations?
Subject: Change Request
Body: I would like to log the body of authentication requests in production.
Subject Re: Change Request
Body: How will you ensure personal data is not stored that shouldn't be?
Subject: Re: Re: Change Request
Body: I will add configuration Y to logging system X.