5 ms·

I don't think anyone will ever know how much impact, but it implies that Facebook is not good at security.

• shawn 8y ago
  I have bad news for you. No one is good at security.
  • bluntfang 8y ago
    This is great news for me, I work in security :)
    • amelius 8y ago
      But the reason why nobody is good at security might be that security is always last on the budget list.
• tetha 8y ago
  No one talks about the working parts of security. Like, in this case, having the application on a separate box, and having that box separated by vlans from important things.
  • bluntfang 8y ago
    I don't think the solution is to put things you don't care about behind vlans and having applications on separate boxes. This box is/was an attack vector. It was holding secrets. Secrets provide other attack vectors.
    • tetha 8y ago
      It is - it is defense in depth. The application should be secure, and there should be steps to secure it. Especially because a secure application can protect a less secure network setup. But on the other hand, the server or the network should not trust the application to be secure at all. The infrastructural setup should assume the application to be an <exec($_POST['do_me']);>. And that's why the application should be isolated on a system level, on a network level, and as much as possible. That's the good part I mean - the part that worked.