Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Getting any Facebook user's friend list and partial payment card details

josipfranjkovic.com

Post reply on HN
Print view View original

51–60 of 95 posts

Re: Getting any Facebook user's friend list and partial payment card details

#51

Post by ransom1538 »

sundvor wrote: post #37
compiler-guy wrote: post #36

Earlier quoted context omitted.

The fix isn't the hard part. It's the deployment and validation that can take time. Pretty impressive.

Yep, clearly shows the value of a properly configured CI/CD pipeline.

Yeah here it is:

git pull; sh tests; rsync /prod/ all@prod:/var/www/

^ That is copyrighted by the way. Ill take a consultant fee. I know - I know it should be thousands of lines of puppet, jenkins, hooks, Kubernetes, Salt, and 2 million lines of python and ELM all piped through Docker containers -- I am NOT an animal.

Re: Getting any Facebook user's friend list and partial payment card details

#52

Post by jlarocco »

kfrzcode wrote: post #18
stormbrew wrote: post #9

Wait, why would facebook have CC info? I have never paid facebook for anything (except in terms of ad views), and I'm not even sure what I could pay them for? Posting ads I guess? But that's gonna be not a lot of people. So if somehow their graph api has pulled up my credit card number into their database, that's the disturbing thing...

> Posting ads Advertisement is Facebook's #1 revenue model, its literally why they exist. I wish everyone who's used FB would sign up for a business page and place an ad; it's illuminating to see just how detailed their tools are. Same with Google PPC and Bing etc etc. I shudder to think at just how detailed the profiles are that FB, AMZN et al keep on each of its users.

> Advertisement is Facebook's #1 revenue model, its literally why they exist.

It's how they exist, not why.

I do agree that their data collection is very creepy.

Re: Getting any Facebook user's friend list and partial payment card details

#53

Post by xevb3k »

ransom1538 wrote: post #51
sundvor wrote: post #37

Earlier quoted context omitted.

Yep, clearly shows the value of a properly configured CI/CD pipeline.

Yeah here it is: git pull; sh tests; rsync /prod/ all@prod:/var/www/ ^ That is copyrighted by the way. Ill take a consultant fee. I know - I know it should be thousands of lines of puppet, jenkins, hooks, Kubernetes, Salt, and 2 million lines of python and ELM all piped through Docker containers -- I am NOT an animal.

Enterprise edition with test validiation and continuous deployment:

while true; do git pull; sh tests && rsync /prod/ all@prod:/var/www/;done

Re: Getting any Facebook user's friend list and partial payment card details

#54

Post by pronoiac »

ransom1538 wrote: post #51
sundvor wrote: post #37

Earlier quoted context omitted.

Yep, clearly shows the value of a properly configured CI/CD pipeline.

Yeah here it is: git pull; sh tests; rsync /prod/ all@prod:/var/www/ ^ That is copyrighted by the way. Ill take a consultant fee. I know - I know it should be thousands of lines of puppet, jenkins, hooks, Kubernetes, Salt, and 2 million lines of python and ELM all piped through Docker containers -- I am NOT an animal.

!!!

those ... those semicolons should be &&

Re: Getting any Facebook user's friend list and partial payment card details

#55

Post by IncRnd »

user5994461 wrote: post #38
compiler-guy wrote: post #36

Earlier quoted context omitted.

The fix isn't the hard part. It's the deployment and validation that can take time. Pretty impressive.

The deployment and the validation should be trivial if the fix is trivial. The difficult part is having someone who reads the report and escalates it, preferably in a timely manner.

> The deployment and the validation should be trivial if the fix is trivial.

Trivial. That's what Oculus said.

Re: Getting any Facebook user's friend list and partial payment card details

#56

Post by bobbyi_settv »

compiler-guy wrote: post #36
user5994461 wrote: post #28

Earlier quoted context omitted.

It's a trivial bug. If the parameter is invalid, return nothing, rather than return all the credit cards. I'd be worried if any company is not able to understand the problem and publish a patch in a few hours.

The fix isn't the hard part. It's the deployment and validation that can take time. Pretty impressive.

I'd more impressed in some other context since a willingness to skimp on validation and "red tape" is how a bug like this ends up in production in the first place.

Re: Getting any Facebook user's friend list and partial payment card details

#57

Post by pbhjpbhj »

dave5104 wrote: post #10
stormbrew wrote: post #9

Wait, why would facebook have CC info? I have never paid facebook for anything (except in terms of ad views), and I'm not even sure what I could pay them for? Posting ads I guess? But that's gonna be not a lot of people. So if somehow their graph api has pulled up my credit card number into their database, that's the disturbing thing...

They offer a cash transfer service via Messenger (similar to Apple Pay Cash or Snap Cash where you hand over a debit card and then you can send money to friends). I believe they also used to have a system (maybe they still do?) where you could buy "Facebook Credits" to use on Facebook platform games, essentially microtransactions.

They also used to have a thing where you could buy, with real money IIRC, little icons for your "friends"; quite some time back I think.

Re: Getting any Facebook user's friend list and partial payment card details

#58

Post by Pxtl »

compiler-guy wrote: post #36
user5994461 wrote: post #28

Earlier quoted context omitted.

It's a trivial bug. If the parameter is invalid, return nothing, rather than return all the credit cards. I'd be worried if any company is not able to understand the problem and publish a patch in a few hours.

The fix isn't the hard part. It's the deployment and validation that can take time. Pretty impressive.

What validation? I'd assume for this one they'd take the "move fast and break things" approach.

Re: Getting any Facebook user's friend list and partial payment card details

#60

Post by joering2 »

kevindqc wrote: post #35
packetized wrote: post #4

Earlier quoted context omitted.

First six and last four are the limits for display set out by the PCI Security Standards Council. The things you should never store with the PAN are the PIN/PIN block or CVC/CVV. https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storag...

How does that work? If you can't store the CVC/CVV, how come I don't have to re-enter it when I re-order form say Amazon or Foodora? Or maybe I do have to enter it? Don't remember :|

Most MSP (merchant service provider) gives you control over the details you personally want to capture to verify someone. The minimum and most insecure is simply approving card based on valid number! (Not even expiration date). Then you can enable EXP, CVV and AV (address verification). Fun tip about AV: your adres doesnt matter. There is so many spellings of "oak harbour drive apartment 2" that industry pretty much gave up on some smart AI knowing them all, it and only verifies the zip code (typical gas station card usage for credit cards: verification is your zip code)
Post reply on HN