81–90 of 95 posts
Earlier quoted context omitted.
Yep, clearly shows the value of a properly configured CI/CD pipeline.
Yeah here it is: git pull; sh tests; rsync /prod/ all@prod:/var/www/ ^ That is copyrighted by the way. Ill take a consultant fee. I know - I know it should be thousands of lines of puppet, jenkins, hooks, Kubernetes, Salt, and 2 million lines of python and ELM all piped through Docker containers -- I am NOT an animal.
Important last-line: "It took Facebook's team 4 hours and 13 minutes to fix the issue - the fastest report-to-fix for me."
Did they notify users whose data were compromised ?
Earlier quoted context omitted.
Hacker News is at least somewhat informative in the tech sphere. It tends to favor more esoteric technology like Lisp in lieu of things like Java & JavaScript which is far more favored on Reddit/Programming. Politics are mostly left leaning mixed with some Libertarian views. There is a good splattering of non tech stuff as well (music, art, literature, linguistics...etc). I'd say it's a far cry from fake news and cat…
Its cause of the people. The more popular something is the worse it gets until eventually its all cats and outrage-culture "fake news". The medium is irrelevant. Media sucks because you* suck. *The collective societal you, not the particular individual you.
Important last-line: "It took Facebook's team 4 hours and 13 minutes to fix the issue - the fastest report-to-fix for me."
That's because you should never have first 6 and last 4 in the same place at the same time, particularly to someone who is not the owner of the card! That leaves only 6 digits to guess to obtain a valid card, and you're given the check digit to limit the search further.
Facebook was providing:
Cardholder Name
First 6
Last 4
Expiry Date
Billing Address.
Yes, first 6 and last 4 are not considered sensitive for PCI compliance. However, like most security standards, the standard is a minimum, not what your target should be.
Given the ability for attackers to quickly guess CVV and the remaining digits[1], the attack becomes a numbers game. They don't care about _a_ card, they care about _any_ card.
This is why Visa and MasterCard are pushing to tokenize all cards - so the stored information is linked to the merchant storing it and can't be reused.
That's even before we take into account the account take over possibilities since those card details are used by other companies as verification for account recovery[2]. Yes, those vulnerabilities were closed, but that doesn't stop new companies from making the same mistakes.
Yes, it's impressive that they managed to prune the fields so quickly. Shows a very efficient escalation path!
[1] https://www.theregister.co.uk/2016/12/05/undetectable_sixsec...
[2] https://www.wired.com/2012/08/apple-amazon-mat-honan-hacking...
Earlier quoted context omitted.
Random question I've never found a place to ask before. Is there a formal language or method for specifying information like this, where I could map out different pieces of data and reason about how the pieces of data flow through a system, to prove mathematically that two (or n) pieces of data are never available in the same place?
You might model software data and operations in some formal system at various levels using a language like "coq" and develop some formal verification proofs. I've not read this book that apparently explores verifications like these: "Certified Programming with Dependent Types: ...". I'm not sure what types of enterprises actually use formal verification since it's very costly. Writing software is much faster than ver…
I noticed how similar the thought process was to GDPR work I've been involved in, where, for example, we can keep track of Last name and Phone Number in our company, but they could never be at rest unencrypted and unhashed in the same system. Or First Name + Job Title + Location but only 2 of those three can co-exist. It seemed like the kind of thing that would have a formal way of expressing. Our GDPR consultants were unhelpful in that.
Earlier quoted context omitted.
Wow. That is extremely impressive that such a large company is able to get a fix out that quickly.
The fix is probably 10 minutes but the deployment process, intake process and notification process took 3 1/2 hours
Earlier quoted context omitted.
Hacker news....
This effect is partially muted by the fact that one can only see the vote status of one’s own post. There is still a tendency toward conformity, but at least the suggestion to vote with other readers isn’t apparent like it is on many content aggregators/discussion media.
Some might claim they get downvoted because they are "low quality" to which I'd retort why spend a lot of time crafting a "quality" reply when you know it's going to be suppressed?
Earlier quoted context omitted.
Yep, clearly shows the value of a properly configured CI/CD pipeline.
Yeah here it is: git pull; sh tests; rsync /prod/ all@prod:/var/www/ ^ That is copyrighted by the way. Ill take a consultant fee. I know - I know it should be thousands of lines of puppet, jenkins, hooks, Kubernetes, Salt, and 2 million lines of python and ELM all piped through Docker containers -- I am NOT an animal.
Important last-line: "It took Facebook's team 4 hours and 13 minutes to fix the issue - the fastest report-to-fix for me."
There's an important unstated property too, btw. OP reported an information disclosure bug in payment handling code. A bug in the core logic of what literally brings money in. That kind of bug report is bound to get a very quick triage, followed by a very quick escalation. But yes, even with that in mind: a 4-hour turnaround is damn impressive.
Obviously not all companies behave this way, but they should!
Earlier quoted context omitted.
This effect is partially muted by the fact that one can only see the vote status of one’s own post. There is still a tendency toward conformity, but at least the suggestion to vote with other readers isn’t apparent like it is on many content aggregators/discussion media.
Except downvoted posts here turn gray.