A look inside Facebook's source code • Hacker News Board

Re: A look inside Facebook's source code

#51

Post by eveningcoffee » Wed, Dec 17, 2014, 6:38 PM UTC

pilif wrote: post #32

Tangentially related, I'd like an opinion on this: >Okay, so it's not the most secure password. But Facebook's database servers are heavily firewalled. Though if you do manage to break in to Facebook's servers, there's the password. What is the point on even having a database password? The application itself needs access to the database, so the application needs to know the password. That means that an attacker who g…

Oracle enterprise edition had (and probably has today too) a feature to link a pl/sql procedure to a table such that this procedure is called every time a query is ran on that table.

This procedure then can apply additional predicates to the query.

When this procedure belongs to the schema that is not directly accessible to the user, then it would be possible to create a filter such that only logged in user can see the records and only her records.

Re: A look inside Facebook's source code

#52

Post by jsprogrammer » Thu, Dec 18, 2014, 9:43 AM UTC

underwater wrote: post #30

anw wrote: post #3

Interesting. It's also interesting that Facebook developers are using Pastebin for things such as this. I would assume that they'd have an internal wiki, or gist-like app. It's also noteworthy to see how they set up their accounts: first initial, full lastname—same standard as many other companies. But seeing it laid out can help in the guessing of other names (or common name occurances, as you don't even need a full…

We have an internal pastebin, it's built into Phabricator. There is no preset format for unixnames. Most people use their names but I've seen many pseudonyms. One intern famously broke some internal tools by requesting her initials, which were "www".

Unwittingly using Magic Character Sequences counts as breaking internal tools?

More like exposed implementation and/or design flaws in internal tools.

Re: A look inside Facebook's source code

#53

Post by dredmorbius » Tue, Dec 23, 2014, 1:22 PM UTC

pilif wrote: post #32

Tangentially related, I'd like an opinion on this: >Okay, so it's not the most secure password. But Facebook's database servers are heavily firewalled. Though if you do manage to break in to Facebook's servers, there's the password. What is the point on even having a database password? The application itself needs access to the database, so the application needs to know the password. That means that an attacker who g…

Among other reasons: setting different passwords for different staging levels or databases reduces the chances of accidentally shooting yourself in the foot.

"Oh, our staging code references the prod DB password. Wups!"

Passwords can also be changed and rotated with some frequency, though that's more often observed in the breech.

Preferably not the data breech.