5 ms·

Hi HN! Great feedback here, as always. I can talk about the commit, and I can talk about the article. We were getting crushed with scaling from 3M to 30M visi

by gfosco 6y ago

Hi HN! Great feedback here, as always. I can talk about the commit, and I can talk about the article. We were getting crushed with scaling from 3M to 30M visits a month, and every day was a 16 hour day. The site was falling over on a daily basis, and the performance of the home feed was atrocious. The APM traces were full of loops. The muting and blocking features were incurring tons of additional queries. As I remember it, one night I decided to write a SQL query to replace it. I believe I thought the values were already being sanitized, but I have no problem agreeing that I should've looked into that further and made sure. I'm not a rails dev, and I'm generally negative towards rails and ActiveRecord. I wrote SQL for many years in the past, and as the folks who went through my stackoverflow saw, I am not unaware of the importance of sanitizing user input. I've written much code that properly sanitized user input, in various languages. It's really easy to imagine that Gab is a large company, considering the breadth of their platform and products, but you'd be shocked and impressed. It's still really early days, like this is only Chapter 2 for us.. we're growing and will keep getting better. This article is interesting to me for other reasons though: 1. there's been no confirmation this commit was related to anything that has happened. and 2. the person who reached out to Ars with the story, a link to the commit and a quote, is a former co-worker with a personal grudge. I can only imagine the glee with which he wrote that email. For the last 2 days we were being extorted for nearly half a million dollars. I received a death threat today, first one ever. I think we're doing something important. Go ahead with your code critiques. Have a great day, Fosco

marcus_holmes 6y ago
I've been on the other end of a journalist with a grudge, and it's not something I'd wish on anyone. It's interesting that the technical language in the article is so clearly mangled. Either Ars Technica has no editors that know how to edit (unlikely), or that know the basics of git (again, it seems unlikely). It reads like a journalist taking notes from a dev ("uh-huh, a 'git', right. Oh, no a 'git commit'. really?").
heyitsjlac 6y ago
Diddums the people using your site send thousands of death threats on it every day. Try to toughen up, buttercup.
- 1shooner 6y ago
  Who's to say it wasn't in a support ticket?
  - heyitsjlac 6y ago
    It could be in anything. I’m nobody and I’ve had death threats uttered about me on Gab; it’s the only thing the site is good for, talking about who to kill. If this guy’s only had one it’s frankly perplexing.
lioeters 6y ago
> former co-worker with a personal grudge That explains a lot, and shame on ArsTechnica for enabling that person's petty revenge. Anyone, including a CTO, can make mistakes and introduce accidental vulnerabilities. It's not productive nor healthy as a culture to blame someone for being imperfect. The best thing to do, as a company, is to learn from such a mistake, and improve processes to catch and fix it earlier, before it gets released. It's disappointing to see Ars participate in a low-ball personal attack, calling out a "rookie coding mistake". They're encouraging a toxic mindset.
ufmace 6y ago
Thanks for the honest description of what really happened there. I've also had the experience of needing to rewrite a query that used a bunch of safe ORM statements but was painfully slow into a big, messy raw SQL query that was probably less safe in order to restore performance. It's easier than many would think to miss whether or not some check was performed somewhere along the line when it's in the middle of a complex process. Meanwhile, Ars still has a few decent articles/departments, but it seems like 50% of their content is tabloid-grade cheap and mindless bashing of anyone who disagrees with the elite mainstream opinion. Probably like 80% of the mainstream media right now is even worse. I wonder how Ars would fare if somebody was to tally up all of the boneheadedly stupid mistakes they've made in journalism, grammar, spelling, site administration, etc, and publish articles trashing the specific employee who did it each time.
msmaryjane 6y ago
Hi Fosco! Thanks for this breakdown. It’s helpful to know that you’re still incapable of accepting accountability. Can we assume from your cagey “there’s been no confirmation,” defensive sign off, and immediate retreat from transparency as confirmation that you did indeed shit the bed? Maybe you got a little rusty after 5+ years of Facebook paying you to post garbage on Workplace. And don’t give too much credit to Dmitry - he didn’t think of you differently than any other fascist white supremacist. You earned this coverage through the sheer force of your own incompetence. Best of luck to you all heading into Chapter 3! Can you give us any exclusive hints as to what’s coming? I think it’s even odds between a wave of mass shootings and being overwhelmed by child porn.
- gfosco 6y ago
  Lol. Whatever you say, clueless dude. I assume you still work for the company which is responsible for, what is it, two-thirds of all child porn reports online? Yes that was it... 12 Million cases in 2018. It's also the premier destination for live streamed violence... But, gotta stay focused on attacking those evil Trump supporters right?
  - msmaryjane 6y ago
    HAHAHA you worked there in 2018, genius. And yes, FB catches and removes more child porn than any other platform, but that’s because other platforms aren’t catching it and removing it, a pretty basic concept that literally anyone who has any business being CTO of a platform should know. LOL, Gab is so fucked. You’ve changed your tune since your bootlicker “we should all be Team Facebook” comments on every Zucc post were a mainstay on Workplace. You predicted Trump would win; he lost. You said Qanon was harmless; they stormed the capital. You thought you could do this job (and you started while you were still pocketing $ from Zaddy); you ate it just a few months in with a cock-up so basic that it would be laughable if it hadn’t seriously hurt your users, company, and reputation forever. Honestly, you should get therapy.

by gfosco 6y ago

marcus_holmes 6y ago

I've been on the other end of a journalist with a grudge, and it's not something I'd wish on anyone. It's interesting that the technical language in the article is so clearly mangled. Either Ars Technica has no editors that know how to edit (unlikely), or that know the basics of git (again, it seems unlikely). It reads like a journalist taking notes from a dev ("uh-huh, a 'git', right. Oh, no a 'git commit'. really?").

heyitsjlac 6y ago

Diddums the people using your site send thousands of death threats on it every day. Try to toughen up, buttercup.

1shooner 6y ago
Who's to say it wasn't in a support ticket?
- heyitsjlac 6y ago
  It could be in anything. I’m nobody and I’ve had death threats uttered about me on Gab; it’s the only thing the site is good for, talking about who to kill. If this guy’s only had one it’s frankly perplexing.

lioeters 6y ago

> former co-worker with a personal grudge That explains a lot, and shame on ArsTechnica for enabling that person's petty revenge. Anyone, including a CTO, can make mistakes and introduce accidental vulnerabilities. It's not productive nor healthy as a culture to blame someone for being imperfect. The best thing to do, as a company, is to learn from such a mistake, and improve processes to catch and fix it earlier, before it gets released. It's disappointing to see Ars participate in a low-ball personal attack, calling out a "rookie coding mistake". They're encouraging a toxic mindset.

ufmace 6y ago

Thanks for the honest description of what really happened there. I've also had the experience of needing to rewrite a query that used a bunch of safe ORM statements but was painfully slow into a big, messy raw SQL query that was probably less safe in order to restore performance. It's easier than many would think to miss whether or not some check was performed somewhere along the line when it's in the middle of a complex process. Meanwhile, Ars still has a few decent articles/departments, but it seems like 50% of their content is tabloid-grade cheap and mindless bashing of anyone who disagrees with the elite mainstream opinion. Probably like 80% of the mainstream media right now is even worse. I wonder how Ars would fare if somebody was to tally up all of the boneheadedly stupid mistakes they've made in journalism, grammar, spelling, site administration, etc, and publish articles trashing the specific employee who did it each time.

msmaryjane 6y ago

Hi Fosco! Thanks for this breakdown. It’s helpful to know that you’re still incapable of accepting accountability. Can we assume from your cagey “there’s been no confirmation,” defensive sign off, and immediate retreat from transparency as confirmation that you did indeed shit the bed? Maybe you got a little rusty after 5+ years of Facebook paying you to post garbage on Workplace. And don’t give too much credit to Dmitry - he didn’t think of you differently than any other fascist white supremacist. You earned this coverage through the sheer force of your own incompetence. Best of luck to you all heading into Chapter 3! Can you give us any exclusive hints as to what’s coming? I think it’s even odds between a wave of mass shootings and being overwhelmed by child porn.

gfosco 6y ago
Lol. Whatever you say, clueless dude. I assume you still work for the company which is responsible for, what is it, two-thirds of all child porn reports online? Yes that was it... 12 Million cases in 2018. It's also the premier destination for live streamed violence... But, gotta stay focused on attacking those evil Trump supporters right?
- msmaryjane 6y ago
  HAHAHA you worked there in 2018, genius. And yes, FB catches and removes more child porn than any other platform, but that’s because other platforms aren’t catching it and removing it, a pretty basic concept that literally anyone who has any business being CTO of a platform should know. LOL, Gab is so fucked. You’ve changed your tune since your bootlicker “we should all be Team Facebook” comments on every Zucc post were a mainstay on Workplace. You predicted Trump would win; he lost. You said Qanon was harmless; they stormed the capital. You thought you could do this job (and you started while you were still pocketing $ from Zaddy); you ate it just a few months in with a cock-up so basic that it would be laughable if it hadn’t seriously hurt your users, company, and reputation forever. Honestly, you should get therapy.