3 ms·

Auditing sure, but almost any Facebook software engineer has permission to still take super user actions. The ability to abuse is still there, it's just a quest

Auditing sure, but almost any Facebook software engineer has permission to still take super user actions. The ability to abuse is still there, it's just a question if they actively audit well enough to catch the abuse.

sonnyblarney 7y ago
"but almost any Facebook software engineer has permission to still take super user actions" If this is true, I find it shocking in light of all of the recent allegations especially.
kerng 7y ago
Really? Any intern could just request access and get it, and maybe get caught abusing the access? Not sure if you can share more, but this seems way to easy and auditing is, well, to late.
- gnu8 7y ago
  At a real company you have to write up something saying what you are planning on doing before taking any action, eg change control. I don't think that type of thing fits into the "move fast and break things" culture though.
- darkwizard42 7y ago
  When I was at FB you had to go through two confirmation modals and at least from my team (biz intelligence on ads side) it said an email would be sent to my manager if I proceeded. I never worked in a role that required me to go further, but the penalty of losing my job deterred me just fine.
barce 7y ago
From an anonymous source, I found out it's automatic termination if you're using super mode unauthorized. Would love to get one more anonymous or non-anon source to verify.
- acjohnson55 7y ago
  I know of someone who had to go in front of an internal audit committee of some sort due to unauthorized access. He did it during a demo, not really thinking it through. They were convinced it was unintentional, and he got to keep his job in the end. He was telling me it was definitely considered a termination-worthy thing, and was legit worried about losing his job.
- darkwizard42 7y ago
  Spent time at FB, can confirm that you have to go through a few modals, your manager is notified via email, and the penalties are quite harsh. This was back in 2014

sonnyblarney 7y ago

"but almost any Facebook software engineer has permission to still take super user actions" If this is true, I find it shocking in light of all of the recent allegations especially.

kerng 7y ago

Really? Any intern could just request access and get it, and maybe get caught abusing the access? Not sure if you can share more, but this seems way to easy and auditing is, well, to late.

gnu8 7y ago
At a real company you have to write up something saying what you are planning on doing before taking any action, eg change control. I don't think that type of thing fits into the "move fast and break things" culture though.
darkwizard42 7y ago
When I was at FB you had to go through two confirmation modals and at least from my team (biz intelligence on ads side) it said an email would be sent to my manager if I proceeded. I never worked in a role that required me to go further, but the penalty of losing my job deterred me just fine.

barce 7y ago

From an anonymous source, I found out it's automatic termination if you're using super mode unauthorized. Would love to get one more anonymous or non-anon source to verify.

acjohnson55 7y ago
I know of someone who had to go in front of an internal audit committee of some sort due to unauthorized access. He did it during a demo, not really thinking it through. They were convinced it was unintentional, and he got to keep his job in the end. He was telling me it was definitely considered a termination-worthy thing, and was legit worried about losing his job.
darkwizard42 7y ago
Spent time at FB, can confirm that you have to go through a few modals, your manager is notified via email, and the penalties are quite harsh. This was back in 2014