5 ms·
Literally every single time Facebook announces something like this, they always announce low numbers and then repeatedly revise them upwards. Is there no penal
by eridius 8y ago
Literally every single time Facebook announces something like this, they always announce low numbers and then repeatedly revise them upwards.
Is there no penalty to them for basically lying to everyone in their initial announcement? Doing it once can be explained as they sincerely thought their original number was correct, but they have a history of doing this and there's no chance I believe now that they aren't doing this on purpose.
- UncleMeat 8y agoThis seems like it would happen with most breaches. You learn about an issue, do some investigation, get an estimate, then inform the public. If Facebook had waited for months to complete the investigation and get these numbers, do you think people would have accepted that? Probably not. So they publish what they know when they think they've got it figured out. But probably this launches up a team that goes looking for other bad logging. Then a while later they find some more errors and the numbers are revised up. This seems expected.
- eridius 8y agoI can't think of any other company that has a history of downplaying breeches and then revising the numbers upwards. If you don't know how many people are impacted, you aren't supposed to just make up a number. At a bare minimum you'd say something like "We know 10k users are definitely impacted, and we estimate this could be as high as 5M" or whatever the appropriate ballpark is.
- kibibu 8y agoLinkedIn went from 6 million to 107 million...
- eridius 8y agoOuch. Is this a one-time thing, or do they have a history of that? What I was trying to say was that I can understand companies making this mistake once. Maybe even twice. But once a company has an established pattern of doing this, they lose the benefit of the doubt and we have to assume they're doing it deliberately. Even more-so if they do scummy things like try to bury their "it's 1000x worse" update with other high-profile news. Facebook has a long history of this kind of thing now, every single new privacy violation of theirs must be met with the expectation that it's actually 1000x worse than they say. I'm not aware of any other companies with a history of doing this multiple times.
- londons_explore 8y agoI think revising upwards is them looking for other bugs of the same type, and finding lots. I can totally imagine someone on the instagram photo pinch-to-zoom team saying "Whoa - if someone re-logs in while a photo is partially zoomed, our metrics capture the password. Thats bad!". They find thats super-rare, and only impacts 10k users. Later, other logfiles are grepped for passwords (possibly even by doing a fulltext search across all fields and blobs for common passwords), and more and more are found. Then someone says "but some of our data is in fields base64 encoded - did you try grepping for base64 encoded plaintext", and even more are found, etc.
- eridius 8y agoYou're giving them far too much credit.
- antris 8y agoBenefit of the doubt.
- eridius 8y agoBenefit of the doubt is something you give to a company the very first time it does something like this. Not something you give the umpteenth time they do something like this, and especially not when they try and hide their "sorry it was waaaay worse" update amid other high-profile news.
- Kalium 8y ago> Then someone says "but some of our data is in fields base64 encoded - did you try grepping for base64 encoded plaintext", and even more are found, etc. This is painfully accurate. I've encountered exactly this kind of thing, including having to repeat search efforts.