30 ms·

This should be the main takeaway. If true, then 2000 people decided not to raise the alarm. And 9,000,000 queries with results that had passwords. This complete

This should be the main takeaway. If true, then 2000 people decided not to raise the alarm. And 9,000,000 queries with results that had passwords. This completely invalidates the other thread of people discussing giving facebook a pass because accidental logging could happen to any company.

weka 8y ago
How much do you want to bet that some of those FB employees decided to login by turning off "location detection" flag and in an incognito browser? I would not be surprised. Some of those 9,000,000+ queries and 2,000+ employees must have had some nefarious use. Statistically speaking...
- kitsune_ 8y ago
  Judging by the maturity level of the discourse on teamblind this precisely what happened.
  - sanderjd 8y ago
    Judging by working with hundreds of software engineers over a decade, this seems very unlikely to have happened.
cellularmitosis 8y ago
> If true, then 2000 people decided not to raise the alarm Have you ever worked at a software co, discovered <terrible software practice>, raised a flag, and were told "thanks, we've added a ticket to the backlog"? I'd bet that some of them did flag it.
- rhacker 8y ago
  Still interesting that not one of them went all out and publicly derided the company. The whistleblower clause would probably have protected them. However our whistleblower laws could use a brush up.
- deusofnull 8y ago
  You're probably right, and I would love to see that confirmed. FB wouldnt have to link to the Jira ticket or give the name or details of the ticket, but verify that was the case and then explain why nothing was done.
- gwbas1c 8y ago
  Explicitly logging a password is one of those practices that doesn't sit on the backlog. It's probably a bit more complicated than that. Usually the things that I encounter have to do with how HTTP requests are logged. For example, putting sensitive information in a URL that's loaded over HTTPS is considered insecure because many companies have policies where they log every URL that their employees visit. (Think of a password reset link.) A lot of inexperienced programmers don't realize this, because they don't realize that you can man-in-the-middle yourself, and that most corporate computers come preconfigured to allow the employer to man-in-the-middle everyone. So, if a password reset link never expires, it means that some guy in IT can own an account that was reset on a corporate computer. (This, basically, is how they catch people viewing porn on their work computers.) Anyway, my point is that the problem is probably something where a junior programmer transmitted a password in a way that they didn't realize was being logged.
  - e7ebanlv 8y ago
    Back when I was sysadmin, I catched everyone watching porn by suddenly walking into their offices, but I'm sure your method is better.
    - deleted 8y ago
      [deleted]
  - sqldba 8y ago
    > Explicitly logging a password is one of those practices that doesn't sit on the backlog. For you maybe. For Facebook obviously it's different.
    - Thorrez 8y ago
      >For Facebook obviously it's different. What evidence do you have for that? Nowhere in the article does it say facebook "explicity logged" passwords. The logging likely happened through some unintended and roundabout process that is far from explicit.
- sqldba 8y ago
  If it's not a feature that makes money why spent developer money on it? -- Every manager ever. GDPR may levy fines but ultimately it hasn't done anything to stop managers focusing on new features and sales income.

weka 8y ago

How much do you want to bet that some of those FB employees decided to login by turning off "location detection" flag and in an incognito browser? I would not be surprised. Some of those 9,000,000+ queries and 2,000+ employees must have had some nefarious use. Statistically speaking...

kitsune_ 8y ago
Judging by the maturity level of the discourse on teamblind this precisely what happened.
- sanderjd 8y ago
  Judging by working with hundreds of software engineers over a decade, this seems very unlikely to have happened.

cellularmitosis 8y ago

> If true, then 2000 people decided not to raise the alarm Have you ever worked at a software co, discovered <terrible software practice>, raised a flag, and were told "thanks, we've added a ticket to the backlog"? I'd bet that some of them did flag it.

rhacker 8y ago
Still interesting that not one of them went all out and publicly derided the company. The whistleblower clause would probably have protected them. However our whistleblower laws could use a brush up.
deusofnull 8y ago
You're probably right, and I would love to see that confirmed. FB wouldnt have to link to the Jira ticket or give the name or details of the ticket, but verify that was the case and then explain why nothing was done.
gwbas1c 8y ago
Explicitly logging a password is one of those practices that doesn't sit on the backlog. It's probably a bit more complicated than that. Usually the things that I encounter have to do with how HTTP requests are logged. For example, putting sensitive information in a URL that's loaded over HTTPS is considered insecure because many companies have policies where they log every URL that their employees visit. (Think of a password reset link.) A lot of inexperienced programmers don't realize this, because they don't realize that you can man-in-the-middle yourself, and that most corporate computers come preconfigured to allow the employer to man-in-the-middle everyone. So, if a password reset link never expires, it means that some guy in IT can own an account that was reset on a corporate computer. (This, basically, is how they catch people viewing porn on their work computers.) Anyway, my point is that the problem is probably something where a junior programmer transmitted a password in a way that they didn't realize was being logged.
- e7ebanlv 8y ago
  Back when I was sysadmin, I catched everyone watching porn by suddenly walking into their offices, but I'm sure your method is better.
  - deleted 8y ago
    [deleted]
- sqldba 8y ago
  > Explicitly logging a password is one of those practices that doesn't sit on the backlog. For you maybe. For Facebook obviously it's different.
  - Thorrez 8y ago
    >For Facebook obviously it's different. What evidence do you have for that? Nowhere in the article does it say facebook "explicity logged" passwords. The logging likely happened through some unintended and roundabout process that is far from explicit.
sqldba 8y ago
If it's not a feature that makes money why spent developer money on it? -- Every manager ever. GDPR may levy fines but ultimately it hasn't done anything to stop managers focusing on new features and sales income.