4 ms·
How on Earth did this endpoint pass code review at Facebook? The person who wrote it probably was working under the assumption that the calling user was logged
by petters 6y ago
How on Earth did this endpoint pass code review at Facebook?
The person who wrote it probably was working under the assumption that the calling user was logged in, but still....
- underwater 6y agoIt's undoubtably some third party system, not code written at Facebook.
- np_tedious 6y agohttps://legal.tapprd.thefacebook.com/ https://legal.tapprd.thefacebook.com/ You're probably right. Windows Server / IIS doesn't seem like them
- petters 6y agoThanks, this seems likely.
- dboreham 6y agoYou have an unrealistically high expectation of code review.
- anonytrary 6y agoEveryone has an unreasonably high expectation of engineer quality at FANG.
- petters 6y agoI have worked several years at FAANG, and error like this were very hard to make due to how the frameworks were written. But it seems that this was third-party code, which I guess explains it.
- forgot_old_user 6y agoI think it depends on team dynamics. On a team I was on (Fortune 100 company), a techlead would just buddy up with a very junior one, and have them rubber stamp their code review. The techlead almost committed a bug similar to one in this post- I had to step in and leave a review comment to prevent this vulnerability. I almost wanted to have it shipped to get back at at these code review buddies, but decided against it as I valued not having a vulnerability more.
- allie1 6y agoI assume project handed from one person to another, one of them kept notes outside the code, maybe got fired. Or an intranet app originally and devs not expecting it to be exposed to the internet? But i’d bet it wasn’t a mishap but an assumption gone wrong (or stale).
- woutr_be 6y agoYou would be surprised how little effort sometimes goes into code reviews or security scans. Up until recently the team I was dropped into didn’t have any authentication for all their endpoints, I pointed this out and secured them all, except for one. This one endpoint was only used internally, but was still exposed. During multiple security scans and a penetration test, this didn’t even come up. I even had a hard time convincing our product manager this should be secured, and could be done in an hour or two, if I could get some time.