4 ms·

> If true, then 2000 people decided not to raise the alarm Have you ever worked at a software co, discovered <terrible software practice>, raised a flag, and w

> If true, then 2000 people decided not to raise the alarm Have you ever worked at a software co, discovered <terrible software practice>, raised a flag, and were told "thanks, we've added a ticket to the backlog"? I'd bet that some of them did flag it.

rhacker 8y ago
Still interesting that not one of them went all out and publicly derided the company. The whistleblower clause would probably have protected them. However our whistleblower laws could use a brush up.
deusofnull 8y ago
You're probably right, and I would love to see that confirmed. FB wouldnt have to link to the Jira ticket or give the name or details of the ticket, but verify that was the case and then explain why nothing was done.
gwbas1c 8y ago
Explicitly logging a password is one of those practices that doesn't sit on the backlog. It's probably a bit more complicated than that. Usually the things that I encounter have to do with how HTTP requests are logged. For example, putting sensitive information in a URL that's loaded over HTTPS is considered insecure because many companies have policies where they log every URL that their employees visit. (Think of a password reset link.) A lot of inexperienced programmers don't realize this, because they don't realize that you can man-in-the-middle yourself, and that most corporate computers come preconfigured to allow the employer to man-in-the-middle everyone. So, if a password reset link never expires, it means that some guy in IT can own an account that was reset on a corporate computer. (This, basically, is how they catch people viewing porn on their work computers.) Anyway, my point is that the problem is probably something where a junior programmer transmitted a password in a way that they didn't realize was being logged.
- e7ebanlv 8y ago
  Back when I was sysadmin, I catched everyone watching porn by suddenly walking into their offices, but I'm sure your method is better.
  - deleted 8y ago
    [deleted]
- sqldba 8y ago
  > Explicitly logging a password is one of those practices that doesn't sit on the backlog. For you maybe. For Facebook obviously it's different.
  - Thorrez 8y ago
    >For Facebook obviously it's different. What evidence do you have for that? Nowhere in the article does it say facebook "explicity logged" passwords. The logging likely happened through some unintended and roundabout process that is far from explicit.
    - smueller1234 8y ago
      Why would this be down voted? I think incompetence over malice is almost certainly the right answer here.
      - 908087 8y ago
        How many times does a company of Facebook's size get to say "oopsie, we're sorry" before you'll stop giving them to benefit of the doubt? I see this as a malicious disregard for the security and privacy of their users, and their history aligns with that view.
        smueller1234 8y ago
        That's a valid point of view, of course. The failure is certainly well beneath what one should expect Facebook. Nonetheless, I stick to incompetence over malice. There's just so much more of the former in the world than the latter!
sqldba 8y ago
If it's not a feature that makes money why spent developer money on it? -- Every manager ever. GDPR may levy fines but ultimately it hasn't done anything to stop managers focusing on new features and sales income.

rhacker 8y ago

Still interesting that not one of them went all out and publicly derided the company. The whistleblower clause would probably have protected them. However our whistleblower laws could use a brush up.

deusofnull 8y ago

You're probably right, and I would love to see that confirmed. FB wouldnt have to link to the Jira ticket or give the name or details of the ticket, but verify that was the case and then explain why nothing was done.

gwbas1c 8y ago

Explicitly logging a password is one of those practices that doesn't sit on the backlog. It's probably a bit more complicated than that. Usually the things that I encounter have to do with how HTTP requests are logged. For example, putting sensitive information in a URL that's loaded over HTTPS is considered insecure because many companies have policies where they log every URL that their employees visit. (Think of a password reset link.) A lot of inexperienced programmers don't realize this, because they don't realize that you can man-in-the-middle yourself, and that most corporate computers come preconfigured to allow the employer to man-in-the-middle everyone. So, if a password reset link never expires, it means that some guy in IT can own an account that was reset on a corporate computer. (This, basically, is how they catch people viewing porn on their work computers.) Anyway, my point is that the problem is probably something where a junior programmer transmitted a password in a way that they didn't realize was being logged.

e7ebanlv 8y ago
Back when I was sysadmin, I catched everyone watching porn by suddenly walking into their offices, but I'm sure your method is better.
- deleted 8y ago
  [deleted]
sqldba 8y ago
> Explicitly logging a password is one of those practices that doesn't sit on the backlog. For you maybe. For Facebook obviously it's different.
- Thorrez 8y ago
  >For Facebook obviously it's different. What evidence do you have for that? Nowhere in the article does it say facebook "explicity logged" passwords. The logging likely happened through some unintended and roundabout process that is far from explicit.
  - smueller1234 8y ago
    Why would this be down voted? I think incompetence over malice is almost certainly the right answer here.
    - 908087 8y ago
      How many times does a company of Facebook's size get to say "oopsie, we're sorry" before you'll stop giving them to benefit of the doubt? I see this as a malicious disregard for the security and privacy of their users, and their history aligns with that view.
      - smueller1234 8y ago
        That's a valid point of view, of course. The failure is certainly well beneath what one should expect Facebook. Nonetheless, I stick to incompetence over malice. There's just so much more of the former in the world than the latter!

sqldba 8y ago

If it's not a feature that makes money why spent developer money on it? -- Every manager ever. GDPR may levy fines but ultimately it hasn't done anything to stop managers focusing on new features and sales income.