3 ms·
They don't have data access controls and monitoring? Doing something like this at Facebook would get you promptly fired.
by acchow 10y ago
They don't have data access controls and monitoring?
Doing something like this at Facebook would get you promptly fired.
- jgalt212 10y agoNow, it would. But I think things were much different in the early days of Facebook. That's not to excuse Uber's current or recently current behavior.
- HappyTypist 10y agoVery originally Facebook used no version control, and code was managed manually via FTP. In login.php, there was a specific magic password that authorised you into every account. No one bothered to change it even after employee departures.
- evgen 10y agoGiven how much of Facebook's security team Uber has pillaged over the past few years I am surprised that this has not been fixed at Uber. Securing query logs, realtime alerting for anomalous queries and closing loopholes on internal tools that allowed for such access pretty much defined 2014 and parts of 2015 for the appropriate prodsec teams.
- HappyTypist 10y agoThey do, but there are limitations: 1. Most DOps, support staff, etc access user information of 100s of people per day. 2. Overzealous SQL queries are often written and are not questioned; such as complete driver/rider exports of a particular city. 3. Some tools, like Heaven, and many experimental tools have no access logging. 4. There is a permission that allows you to remove access logs. 5. Spot checks are unheard of. 6. Even direct queries for names like 'Barack Obama', 'Taylor Swift' can be easily justified as 'investigating fraud', which is part of a DOp's job role.
- walshemj 10y agoif you did the same at the telecom company I used to work at if you looked up say the queens private number you would hope that MI5 or the special branch got to you before our internal security guys did. People who had wide access to data (team leads) had to have PV clearance in us terms that's the same as a CIA Officer would have.