3 ms·

If it's literally Zuckerberg building all this, I bet it's full of security holes (not that he's a bad dev, I wouldn't know, just that one dev can't reasonably

by dimino 10y ago

If it's literally Zuckerberg building all this, I bet it's full of security holes (not that he's a bad dev, I wouldn't know, just that one dev can't reasonably be expected to develop a secure app at a pace even remotely quickly). Dunno what that means, just that it would be mildly funny if someone used this fact to try to get a job at Facebook or something.

jhartmann 10y ago
Actually, there are some ways to make this very secure that don't take much effort that in are common use around facebook. It is quite easy to build secure thrift services, and to design a thrift api it is just creating a text file with the necessary idl. You can then access the service from most any language by generating the right client. I'm sure same thing goes for gRPC and Stubby on the google side (more familiar with the fbthrift, folly, wangle, proxygen tech stack myself, but I'm sure its just as easy.)
- dimino 10y ago
  Ah yes, the "security is quite easy" argument. As long as people like you think security is easy, people like me will continue to have a job, unfortunately.
  - jhartmann 10y ago
    I'm not saying its easy, I'm saying a developer using the tools and processes available at a large internet corporation building something small need not be insecure. Basically until we look at the code and the security processes in place, or do pentesting, we have no clue one way or the other. I'm mostly just saying we shouldn't discount something like this automatically as insecure. It might be terrible, it might be very well thought out and have security be one of the most important considerations that was top of mind when he coded it.
    - dimino 10y ago
      I didn't mean to sound like I'm "discounting" this, though I guess I "discount" everything that hasn't had a cycle of security focused QA, let alone zero QA at all. I bet, with no information other than what's supplied, that this system is insecure. It's not really a knock on Zuckerberg, just a statement based on my experience. I am totally open to being wrong, I just think we know more than nothing about hobby projects and their propensity to consider security secondary, tertiary, or not at all. Admittedly, this is Mark Zuckerberg, so who knows, it might have been meticulously coded to be perfect. The guy's a bit of an obsessive, based on what I've read, so I would also not be surprised to find it's tightly locked down and very high quality code. I don't the guy, just the general situation.
carlosdp 10y ago
I've seen people go down this road before, even specifically toward Zuckerberg. It's never actually a good idea, it just makes you look like a psycho. Big difference between revealing an exploit on Facebook and demonstrating a proof of concept to their bug bounty and exploiting Mark's personal home. Not saying you would do that, just saying for other people reading that it's not really a joking matter when it really happens =P
- dimino 10y ago
  I don't recommend doing it, I was just commenting on the concept. I recall reading someone trying to PM Zuckerberg their resumé by using a bug in Facebook to force him to be friends with her. Though, I do disagree. I think it's mildly funny when someone does something like this. Not in an encouraging way, I guess, but more as a news item I get to read safely in my pseudo-anonymous home.

by dimino 10y ago

jhartmann 10y ago

Actually, there are some ways to make this very secure that don't take much effort that in are common use around facebook. It is quite easy to build secure thrift services, and to design a thrift api it is just creating a text file with the necessary idl. You can then access the service from most any language by generating the right client. I'm sure same thing goes for gRPC and Stubby on the google side (more familiar with the fbthrift, folly, wangle, proxygen tech stack myself, but I'm sure its just as easy.)

dimino 10y ago
Ah yes, the "security is quite easy" argument. As long as people like you think security is easy, people like me will continue to have a job, unfortunately.
- jhartmann 10y ago
  I'm not saying its easy, I'm saying a developer using the tools and processes available at a large internet corporation building something small need not be insecure. Basically until we look at the code and the security processes in place, or do pentesting, we have no clue one way or the other. I'm mostly just saying we shouldn't discount something like this automatically as insecure. It might be terrible, it might be very well thought out and have security be one of the most important considerations that was top of mind when he coded it.
  - dimino 10y ago
    I didn't mean to sound like I'm "discounting" this, though I guess I "discount" everything that hasn't had a cycle of security focused QA, let alone zero QA at all. I bet, with no information other than what's supplied, that this system is insecure. It's not really a knock on Zuckerberg, just a statement based on my experience. I am totally open to being wrong, I just think we know more than nothing about hobby projects and their propensity to consider security secondary, tertiary, or not at all. Admittedly, this is Mark Zuckerberg, so who knows, it might have been meticulously coded to be perfect. The guy's a bit of an obsessive, based on what I've read, so I would also not be surprised to find it's tightly locked down and very high quality code. I don't the guy, just the general situation.

carlosdp 10y ago

I've seen people go down this road before, even specifically toward Zuckerberg. It's never actually a good idea, it just makes you look like a psycho. Big difference between revealing an exploit on Facebook and demonstrating a proof of concept to their bug bounty and exploiting Mark's personal home. Not saying you would do that, just saying for other people reading that it's not really a joking matter when it really happens =P

dimino 10y ago
I don't recommend doing it, I was just commenting on the concept. I recall reading someone trying to PM Zuckerberg their resumé by using a bug in Facebook to force him to be friends with her. Though, I do disagree. I think it's mildly funny when someone does something like this. Not in an encouraging way, I guess, but more as a news item I get to read safely in my pseudo-anonymous home.