6 ms·

> Within two days, we closed the vulnerability That is very slow for a server-side vulnerability. Was the fix that complicated that it could not be safely depl

> Within two days, we closed the vulnerability That is very slow for a server-side vulnerability. Was the fix that complicated that it could not be safely deployed within minutes or hours? Or did the FB management not take the issue seriously?

samat 8y ago
Or were they asked by FBI to keep the thing going’s so they could catch the attacker? Lots of reasons to delay.
- vthallam 8y ago
  that's not how things work.
zackkitzmiller 8y ago
Doesn't the FB deploy process take a day in itself? Edit: This hasn't been the case for years.
mikevin 8y ago
> > Within two days, we closed the vulnerability "Within two days, we closed the vulnerability, stopped the attack, and secured people’s accounts by resetting the access tokens for people who were potentially exposed. As a precaution, we also turned off “View As.” The last sentence could mean they disabled the feature and then spent two days fixing the vulnerability before re-enabling it. It's not clear though, maybe this is just wishful thinking on my part.
fjsolwmv 8y ago
Under 2 days is good timing to code, test, and globally deploy a bugfix. The only way to close a hole more quickly is either shut down the system (which might be worse than the bug) or if the bug was extremely recently introduced and you can rollback to a recently tested good version of the system.
pcanahuati 8y ago
I lead Security and Privacy Engineering at Facebook and wanted to chime in on this thread. As soon as we found the vulnerability, our first priority was to determine how we could protect people most effectively. If we had closed the vulnerability immediately, the attackers could have escalated their attack to modify information or post as someone else by using the access tokens they had already acquired before we reset them. Instead, we determined all the potentially affected accounts and reset their access tokens in a coordinated way to prevent further misuse of the vulnerability. We haven't reset 90M accounts all at once before. Identifying the attackers, defining our remediation, validating that it would work, and closing the vulnerability while simultaneously ensuring all accounts were secure is complex to do at scale.
- trevyn 8y ago
  >our first priority was to determine how we could protect people most effectively. You could have taken the site down until it was fixed. So protecting people was your second priority.
  - btian 8y ago
    +1 Everything should be in lock down mode while accessing vulnerability and working on a fix.
  - shawn 8y ago
    When you respond like this, you discourage comments like the parent from being posted to HN. It would be fine if your point was reasonable. But it's not. It's little more than an excuse to hate on Facebook.
    - ric2b 8y ago
      He's just tearing down the PR speak.
  - maslam 8y ago
    Yes exactly. A rational response to this is to delete your FB account.

samat 8y ago

Or were they asked by FBI to keep the thing going’s so they could catch the attacker? Lots of reasons to delay.

vthallam 8y ago
that's not how things work.

zackkitzmiller 8y ago

Doesn't the FB deploy process take a day in itself? Edit: This hasn't been the case for years.

mikevin 8y ago

> > Within two days, we closed the vulnerability "Within two days, we closed the vulnerability, stopped the attack, and secured people’s accounts by resetting the access tokens for people who were potentially exposed. As a precaution, we also turned off “View As.” The last sentence could mean they disabled the feature and then spent two days fixing the vulnerability before re-enabling it. It's not clear though, maybe this is just wishful thinking on my part.

fjsolwmv 8y ago

Under 2 days is good timing to code, test, and globally deploy a bugfix. The only way to close a hole more quickly is either shut down the system (which might be worse than the bug) or if the bug was extremely recently introduced and you can rollback to a recently tested good version of the system.

pcanahuati 8y ago

I lead Security and Privacy Engineering at Facebook and wanted to chime in on this thread. As soon as we found the vulnerability, our first priority was to determine how we could protect people most effectively. If we had closed the vulnerability immediately, the attackers could have escalated their attack to modify information or post as someone else by using the access tokens they had already acquired before we reset them. Instead, we determined all the potentially affected accounts and reset their access tokens in a coordinated way to prevent further misuse of the vulnerability. We haven't reset 90M accounts all at once before. Identifying the attackers, defining our remediation, validating that it would work, and closing the vulnerability while simultaneously ensuring all accounts were secure is complex to do at scale.

trevyn 8y ago
>our first priority was to determine how we could protect people most effectively. You could have taken the site down until it was fixed. So protecting people was your second priority.
- btian 8y ago
  +1 Everything should be in lock down mode while accessing vulnerability and working on a fix.
- shawn 8y ago
  When you respond like this, you discourage comments like the parent from being posted to HN. It would be fine if your point was reasonable. But it's not. It's little more than an excuse to hate on Facebook.
  - ric2b 8y ago
    He's just tearing down the PR speak.
- maslam 8y ago
  Yes exactly. A rational response to this is to delete your FB account.