5 ms·

It was called ‘super’ and it was most famously abused by an intern that blabbed to the press about using it. They then added more restrictions and auditing to ‘

It was called ‘super’ and it was most famously abused by an intern that blabbed to the press about using it. They then added more restrictions and auditing to ‘super’ which was supposed to be mostly for investigations and user operations teams to help users with their own account issues. Also at that time Zuck’s own account was always super so...

coderintherye 7y ago
Auditing sure, but almost any Facebook software engineer has permission to still take super user actions. The ability to abuse is still there, it's just a question if they actively audit well enough to catch the abuse.
- sonnyblarney 7y ago
  "but almost any Facebook software engineer has permission to still take super user actions" If this is true, I find it shocking in light of all of the recent allegations especially.
- kerng 7y ago
  Really? Any intern could just request access and get it, and maybe get caught abusing the access? Not sure if you can share more, but this seems way to easy and auditing is, well, to late.
  - gnu8 7y ago
    At a real company you have to write up something saying what you are planning on doing before taking any action, eg change control. I don't think that type of thing fits into the "move fast and break things" culture though.
  - darkwizard42 7y ago
    When I was at FB you had to go through two confirmation modals and at least from my team (biz intelligence on ads side) it said an email would be sent to my manager if I proceeded. I never worked in a role that required me to go further, but the penalty of losing my job deterred me just fine.
- barce 7y ago
  From an anonymous source, I found out it's automatic termination if you're using super mode unauthorized. Would love to get one more anonymous or non-anon source to verify.
  - acjohnson55 7y ago
    I know of someone who had to go in front of an internal audit committee of some sort due to unauthorized access. He did it during a demo, not really thinking it through. They were convinced it was unintentional, and he got to keep his job in the end. He was telling me it was definitely considered a termination-worthy thing, and was legit worried about losing his job.
  - darkwizard42 7y ago
    Spent time at FB, can confirm that you have to go through a few modals, your manager is notified via email, and the penalties are quite harsh. This was back in 2014
delusional 7y ago
What reasons do companies like facebook have to actually make these tools safe? As long as it has the veneer of only being used for the right things, they don't really have an incentive. No-one is going to check up on Zuck. So as long as he doesn't leak it himself, no-one is really going to know if he checks your nudes. I don't even really blame him. It's just human nature to be curious.
- Spooky23 7y ago
  It’s important because locks ultimately keep good people honest. A system where access control policy is capricious is a system that is fundamentally broken. I have been in jobs where I had the authority to hire and fire people, and make significant decisions that impact important things and spend lots of money. But guess what? I don’t have access to employee applications with PII. I don’t have access to the accounts for the business. Don’t know about employee healthcare or retirement. If I tried to use my position to get access to that data, I would expect that issue to be escalated, even if I were the CEO. A data driven company with casual disrespect of basic principles is a problem waiting to happen.
  - exfbthrowaway 7y ago
    This.
    - EGreg 7y ago
      That
      - jjulius 7y ago
        The other
  - delusional 7y ago
    I'm not disagreeing that it's important. I'm asking, in a corporate environment driven by capitalism and the ultimate pursuit of generating revenue/shareholder value. Why would a company care? I know that I've seen situations where departments critical to this access control policy system were chronically understaffed, because they are cost centers. They don't generate value. In the same way I've heard security and access control dissuaded from software development, because "we just need to get this out". What all of these situations end up with is "performative" access control. You have to act as though you need the data, but beyond that it's a free for all. This lets the company pretend like it's fulfilling it's obligations, while saving money.

coderintherye 7y ago

Auditing sure, but almost any Facebook software engineer has permission to still take super user actions. The ability to abuse is still there, it's just a question if they actively audit well enough to catch the abuse.

sonnyblarney 7y ago
"but almost any Facebook software engineer has permission to still take super user actions" If this is true, I find it shocking in light of all of the recent allegations especially.
kerng 7y ago
Really? Any intern could just request access and get it, and maybe get caught abusing the access? Not sure if you can share more, but this seems way to easy and auditing is, well, to late.
- gnu8 7y ago
  At a real company you have to write up something saying what you are planning on doing before taking any action, eg change control. I don't think that type of thing fits into the "move fast and break things" culture though.
- darkwizard42 7y ago
  When I was at FB you had to go through two confirmation modals and at least from my team (biz intelligence on ads side) it said an email would be sent to my manager if I proceeded. I never worked in a role that required me to go further, but the penalty of losing my job deterred me just fine.
barce 7y ago
From an anonymous source, I found out it's automatic termination if you're using super mode unauthorized. Would love to get one more anonymous or non-anon source to verify.
- acjohnson55 7y ago
  I know of someone who had to go in front of an internal audit committee of some sort due to unauthorized access. He did it during a demo, not really thinking it through. They were convinced it was unintentional, and he got to keep his job in the end. He was telling me it was definitely considered a termination-worthy thing, and was legit worried about losing his job.
- darkwizard42 7y ago
  Spent time at FB, can confirm that you have to go through a few modals, your manager is notified via email, and the penalties are quite harsh. This was back in 2014

delusional 7y ago

What reasons do companies like facebook have to actually make these tools safe? As long as it has the veneer of only being used for the right things, they don't really have an incentive. No-one is going to check up on Zuck. So as long as he doesn't leak it himself, no-one is really going to know if he checks your nudes. I don't even really blame him. It's just human nature to be curious.

Spooky23 7y ago
It’s important because locks ultimately keep good people honest. A system where access control policy is capricious is a system that is fundamentally broken. I have been in jobs where I had the authority to hire and fire people, and make significant decisions that impact important things and spend lots of money. But guess what? I don’t have access to employee applications with PII. I don’t have access to the accounts for the business. Don’t know about employee healthcare or retirement. If I tried to use my position to get access to that data, I would expect that issue to be escalated, even if I were the CEO. A data driven company with casual disrespect of basic principles is a problem waiting to happen.
- exfbthrowaway 7y ago
  This.
  - EGreg 7y ago
    That
    - jjulius 7y ago
      The other
- delusional 7y ago
  I'm not disagreeing that it's important. I'm asking, in a corporate environment driven by capitalism and the ultimate pursuit of generating revenue/shareholder value. Why would a company care? I know that I've seen situations where departments critical to this access control policy system were chronically understaffed, because they are cost centers. They don't generate value. In the same way I've heard security and access control dissuaded from software development, because "we just need to get this out". What all of these situations end up with is "performative" access control. You have to act as though you need the data, but beyond that it's a free for all. This lets the company pretend like it's fulfilling it's obligations, while saving money.