Getting any Facebook user's friend list and partial payment card details • Hacker News Board

Re: Getting any Facebook user's friend list and partial payment card details

#91

Post by hedora » Sun, Mar 11, 2018, 7:41 PM UTC

xevb3k wrote: post #53

ransom1538 wrote: post #51

Earlier quoted context omitted.

Yeah here it is: git pull; sh tests; rsync /prod/ all@prod:/var/www/ ^ That is copyrighted by the way. Ill take a consultant fee. I know - I know it should be thousands of lines of puppet, jenkins, hooks, Kubernetes, Salt, and 2 million lines of python and ELM all piped through Docker containers -- I am NOT an animal.

Enterprise edition with test validiation and continuous deployment: while true; do git pull; sh tests && rsync /prod/ all@prod:/var/www/;done

You forgot to rewrite the logic in xml, and then fetch it over the internet from unknown third parties by tunneling it through json, then http. Bonus points if the the whole thing is deployed via docker hub.

Re: Getting any Facebook user's friend list and partial payment card details

#92

Post by hedora » Sun, Mar 11, 2018, 7:43 PM UTC

pronoiac wrote: post #54

ransom1538 wrote: post #51

Earlier quoted context omitted.

Yeah here it is: git pull; sh tests; rsync /prod/ all@prod:/var/www/ ^ That is copyrighted by the way. Ill take a consultant fee. I know - I know it should be thousands of lines of puppet, jenkins, hooks, Kubernetes, Salt, and 2 million lines of python and ELM all piped through Docker containers -- I am NOT an animal.

!!! those ... those semicolons should be &&

You need to invoke the script via ‘sh -ex’ for proper exception handling + debuggability.

Also, mktemp and shell exit traps are your friends.

Re: Getting any Facebook user's friend list and partial payment card details

#93

Post by ampersandy » Mon, Mar 12, 2018, 6:39 AM UTC

styfle wrote: post #86

wolco wrote: post #20

Earlier quoted context omitted.

The fix is probably 10 minutes but the deployment process, intake process and notification process took 3 1/2 hours

What about code review process? Surely someone else verified the fix before deployment.

FB uses Phabricator, which was spun out into an open-source project:

https://www.phacility.com/phabricator/

Re: Getting any Facebook user's friend list and partial payment card details

#94

Post by mercer » Mon, Mar 12, 2018, 7:04 AM UTC

UncleEntity wrote: post #87

stochastic_monk wrote: post #47

Earlier quoted context omitted.

This effect is partially muted by the fact that one can only see the vote status of one’s own post. There is still a tendency toward conformity, but at least the suggestion to vote with other readers isn’t apparent like it is on many content aggregators/discussion media.

Yeah but I can predict pretty accurately which of my posts will get downvoted and they all have the same thing in common; they challenge the left-leaning groupthink common here. Some might claim they get downvoted because they are "low quality" to which I'd retort why spend a lot of time crafting a "quality" reply when you know it's going to be suppressed?

While it might just be me, I find myself downvoting your comments purely because I find them low-quality noise (or worse) that I'd rather not see more of.

I even tagged you as 'shitty commenter', which I don't do this too often. But with some commenters I'm just amazed at how they can consistently keep this up without tiring of it.

Re: Getting any Facebook user's friend list and partial payment card details

#95

Post by pbalau » Mon, Mar 12, 2018, 3:58 PM UTC

jomkr wrote: post #89

bostik wrote: post #77

Earlier quoted context omitted.

There's an important unstated property too, btw. OP reported an information disclosure bug in payment handling code. A bug in the core logic of what literally brings money in. That kind of bug report is bound to get a very quick triage, followed by a very quick escalation. But yes, even with that in mind: a 4-hour turnaround is damn impressive.

I work at one of the other Big4 and to be honest it's not that impressive. This kind of report would be a high severity ticket, the person on-call for the given team would get paged, and wouldn't stop working/escalating until it got fixed. Obviously not all companies behave this way, but they should!

Then you need to push the new software to prod. 4h is impressive.