Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook engineers: we have no idea where we keep all your personal data

theintercept.com

Post reply on HN
Print view View original

71–80 of 137 posts

Re: Facebook engineers: we have no idea where we keep all your personal data

#71

Post by UncleMeat »

RHSeeger wrote: post #58
UncleMeat wrote: post #41

Earlier quoted context omitted.

I think you are underestimating the complexity of this task by about three orders of magnitude. This is the way to do it, but you can't do it for a company of this scale with a handful of people.

But pretending they can only afford "a handful of people" to work on the problem is a little silly, too. They don't have the answers because they choose not to devote the resources to get the answers; not because they are unable to devote the resources.

I agree with that. Companies like Facebook should have a large org responsible for this problem. My point is that the problem is way more complex than some might think.

Re: Facebook engineers: we have no idea where we keep all your personal data

#72

Post by 0xbadcafebee »

"The special master at times seemed in disbelief, as when he questioned the engineers over whether any documentation existed for a particular Facebook subsystem. “Someone must have a diagram that says this is where this data is stored,” he said, according to the transcript."

Oh you sweet summer child.

Re: Facebook engineers: we have no idea where we keep all your personal data

#73

Post by tremon »

nicolas_t wrote: post #61
kixiQu wrote: post #33

Earlier quoted context omitted.

I work for a large long-living tech company. Where legal compliance and security are concerned, "it is just layering and organic growth" is not something you get to say. If we were speculating about such a thing on a coffee break, maybe we'd get the kind of answer given here, but if a single reference doesn't exist for something that is necessary for compliance , people get paged until it does. (There may be other th…

Counterpoint, in my career, I've seen a lot of Security Audits that seem on paper to be very thorough and detailed but when you dig deeper, you can see that it only touched the surface and the auditor missed a lot of things.

I'd guess there's a difference between an external audit performed for regulatory of financial reasons, and an audit by the internal legal team because of a pending legal case or regulatory scrutiny.

Re: Facebook engineers: we have no idea where we keep all your personal data

#74

Post by vidanay »

delusional wrote: post #69
nicolas_t wrote: post #61

Earlier quoted context omitted.

Counterpoint, in my career, I've seen a lot of Security Audits that seem on paper to be very thorough and detailed but when you dig deeper, you can see that it only touched the surface and the auditor missed a lot of things.

I have in fact only seen these kinds.

Same with certifications. (e.g. ISO 900x certification - you can still build a shit product, but it will be a very well documented shit product.)

Re: Facebook engineers: we have no idea where we keep all your personal data

#75

Post by tremon »

UncleMeat wrote: post #41
markstos wrote: post #36

Earlier quoted context omitted.

You can hire one or more data privacy people whose whole job it is to track this. They get an inventory of all the systems and talk to the managers of every system, find the answers and document them. Meta is choosing not to know or pretending not to know. They have the resources to know where your data goes.

I think you are underestimating the complexity of this task by about three orders of magnitude. This is the way to do it, but you can't do it for a company of this scale with a handful of people.

Then, first and foremost, it is the task of these people to bring down the complexity of the task. You can't reason your way out of legal obligations by throwing your hands up and saying it's too hard.

Re: Facebook engineers: we have no idea where we keep all your personal data

#76

Post by klooney »

markstos wrote: post #36
ctur wrote: post #11

In many ways you can think of large, long-living tech companies not unlike old cities like, say, London or Paris. The buildings and roads you see are built on top of older buildings and ruins. The streets are weirdly shaped and intersect at odd angles because they were made hundreds of years before and adapted over time as needs evolved. There are catacombs underneath sidewalks and no one genuinely understands it all…

You can hire one or more data privacy people whose whole job it is to track this. They get an inventory of all the systems and talk to the managers of every system, find the answers and document them. Meta is choosing not to know or pretending not to know. They have the resources to know where your data goes.

I mean, I've worked with those teams for GDPR stuff. They have no context, and no access or ability to trace data flow, so they often write up very partial and incomplete reports because no one else cares particularly deeply about the problem.

Re: Facebook engineers: we have no idea where we keep all your personal data

#77

Post by IanCal »

BiteCode_dev wrote: post #43
ctur wrote: post #11

In many ways you can think of large, long-living tech companies not unlike old cities like, say, London or Paris. The buildings and roads you see are built on top of older buildings and ruins. The streets are weirdly shaped and intersect at odd angles because they were made hundreds of years before and adapted over time as needs evolved. There are catacombs underneath sidewalks and no one genuinely understands it all…

Maybe, but one can find out. You can follow the chain of calls of any software, and they have access to everything, as well as the whole history. It's like when in an interview Buffets says it's very hard to know where all the money is in the financial system. Sure, it's a complex system, but it's more of a matter of incentive.

Unless it was built with this in mind, you absolutely don't have access to this.

Full data lineage is a complex task.

A very simple example would just be that a database is destructively updated by some script at some time. What's the log here? What ran? Can you actually replicate it? Do you have full backup of the data before?

It's so easy to lose this.

Re: Facebook engineers: we have no idea where we keep all your personal data

#78

Post by phpisthebest »

mschuster91 wrote: post #65
encoderer wrote: post #56

Earlier quoted context omitted.

Yes and it’s a good thing that most industries do not carry this governance burden.

If more industries did carry this governance burden, we'd see a lot less cases of companies getting hacked left and right. For way too many companies, "IT" is just another cost center that doesn't bring in any profits and so is barely kept at life support levels. And when something inevitably happens, it's rarely the C-level that gets to go to the unemployment office, it's more one poor soul who has complained for ye…

I doubt that, many of the companies that have been hacked were governed by these regulations, and they spent money governing to the regulations not governing to security which is not the same thing

If I was burdened by regulation and red tape I can assure you my org would be less secure not more so

Re: Facebook engineers: we have no idea where we keep all your personal data

#79

Post by jollyllama »

ctur wrote: post #11

In many ways you can think of large, long-living tech companies not unlike old cities like, say, London or Paris. The buildings and roads you see are built on top of older buildings and ruins. The streets are weirdly shaped and intersect at odd angles because they were made hundreds of years before and adapted over time as needs evolved. There are catacombs underneath sidewalks and no one genuinely understands it all…

To build on your metaphor though, there are cabbies with "the knowledge" in London, and probably similar folks in Paris. The way I have seen this work in tech is, you have to keep the people who know where the bodies are buried around for a long time, and others will use them as a resource to inform their efforts. The alternative, of letting them walk over the years, is that large sections of your stack will have "here be dragons" written over them and become no-go zones where your only option is to route not only engineering but business efforts around them.

Re: Facebook engineers: we have no idea where we keep all your personal data

#80

Post by guywithahat »

twanvl wrote: post #29
handity wrote: post #17

After reading some more of the transcript, I think the article does such a bad job of describing what was being asked for that it makes the court seem incompetent and Facebook actually rather reasonable. My original comment is below: Government contracted construction workers: We Have No Idea Where Your Tax Money Goes When tasked with answering the simple question "Which specific bricks did my tax money buy this year…

Money is fungible, personal data is not.

You'd think that but personal data piles up quickly and the individuals who make it up dispensary. It's a little like saying any particular dollar is unique; I suppose it is but if you get enough of them nobody cares. I think expecting Facebook to treat all of their data as if it's ITAR is unfortunately unrealistic, we're not all that unique or special and if you use the internet your data has already been leaked or is otherwise public
Post reply on HN