3 ms·

Ex Meta employee here (yes you are right to boo): The thing that really gets me is that internally there are 4 levels of data 1 being public domain shit (the s

Ex Meta employee here (yes you are right to boo): The thing that really gets me is that internally there are 4 levels of data 1 being public domain shit (the sky is blue) up to 4 which is private user data, or something that is sensitive if leaked or shared. I was told that by default all user data is level 4, as in if you do anything without decent approval, you're insta fired. There are many stories about at least one person a month during boot camp accessing user data and getting escorted out of the building within hours. The part where I worked, in visual research, we had to jump through a years worth of legal hoops to get permission to record videos in public. We had to build an anonymisation pipeline, bullet proof audit trail, delete as much data as possible, with auto delete if something went wrong. We had rigid rule about where that data could be stored and _who_ could access it. We were not allowed to share "wild" footage (ie data that might have the hint of anyone who hadn't signed a contract) for annotation because it would be given to a third party. THe public datasets we released all had traceable people, locations all with legal waivers signed. Then I hear they just started fucking hosing private data to annotators to _train_ on? without any fucking basic controls at all? Just shows that whenever Zuck or monetsization want something, the rules don't apply. I look forward to that entire industry collapsing in on it's self.

theplatman 6mo ago
have always wondered about this especially post Cambridge Analytica where Meta imposed really stringent requirements for API use even for personal things while it was blatantly obvious that internally it was a different story
- KaiserPro 6mo ago
  But thats the thing internally it wasn't. The user dat controls were really quite good. Its not a mistake that this data got into contractor hands, it was a decision that took lots of time, numerous legal reviews and signoff from Zuck himself.
dntrkv 6mo ago
> I was told that by default all user data is level 4, as in if you do anything without decent approval, you're insta fired. There are many stories about at least one person a month during boot camp accessing user data and getting escorted out of the building within hours. Given the size and nature of Meta's business, I would assume they would have better systems in place. SWEs should only have access to PII with explicit consent from users/customers e.g. support tickets. Especially someone going through boot camp. Do they have access to de-anonymized user data during training? Shit, at my last company I had to jump through so many hoops to access user data even with consent from the customer.
- donkey-hotei 6mo ago
  This is bogus. Meta doesn't have bootcampers escorted out of the building for accessing PII all the time. PII is locked down behind ACLs which are not auto-granted for just anyone asking.
- KaiserPro 6mo ago
  > I would assume they would have better systems in place. They did when I was there. every time you got close to user data an "interstitial" would pop up asking you for a ticket number and justification. There were a bunch of tools that ran searching for people accessing user data. For example in boot camp you'd create a page that pulled your profile details. this was to introduce the idea of "ents" (the API that manages the social graph) and mercurial. You could, if you wanted to then traverse your friend graph. as soon as you did that, it'd trigger one the automated rules and your account would be suspended and you'd be yeeted within hours. The point was, if you were doing something legitimate it was fine, but if you stepped out of line, the automated systems would find out and fire you on the stop. also as everything is done through remote dev boxes, _everything_ is recorded (along with all the files on your laptop, and the regular screenshots, plus all the browser history and keystrokes) Data exfiltraition is super hard, hence why there are hardly any "angry nerd extorts girl" type stories. Its not because meta isn't full of angry nerds, it because its really really difficult to get at user data without getting caught.

theplatman 6mo ago

have always wondered about this especially post Cambridge Analytica where Meta imposed really stringent requirements for API use even for personal things while it was blatantly obvious that internally it was a different story

KaiserPro 6mo ago
But thats the thing internally it wasn't. The user dat controls were really quite good. Its not a mistake that this data got into contractor hands, it was a decision that took lots of time, numerous legal reviews and signoff from Zuck himself.

dntrkv 6mo ago

> I was told that by default all user data is level 4, as in if you do anything without decent approval, you're insta fired. There are many stories about at least one person a month during boot camp accessing user data and getting escorted out of the building within hours. Given the size and nature of Meta's business, I would assume they would have better systems in place. SWEs should only have access to PII with explicit consent from users/customers e.g. support tickets. Especially someone going through boot camp. Do they have access to de-anonymized user data during training? Shit, at my last company I had to jump through so many hoops to access user data even with consent from the customer.

donkey-hotei 6mo ago
This is bogus. Meta doesn't have bootcampers escorted out of the building for accessing PII all the time. PII is locked down behind ACLs which are not auto-granted for just anyone asking.
KaiserPro 6mo ago
> I would assume they would have better systems in place. They did when I was there. every time you got close to user data an "interstitial" would pop up asking you for a ticket number and justification. There were a bunch of tools that ran searching for people accessing user data. For example in boot camp you'd create a page that pulled your profile details. this was to introduce the idea of "ents" (the API that manages the social graph) and mercurial. You could, if you wanted to then traverse your friend graph. as soon as you did that, it'd trigger one the automated rules and your account would be suspended and you'd be yeeted within hours. The point was, if you were doing something legitimate it was fine, but if you stepped out of line, the automated systems would find out and fire you on the stop. also as everything is done through remote dev boxes, _everything_ is recorded (along with all the files on your laptop, and the regular screenshots, plus all the browser history and keystrokes) Data exfiltraition is super hard, hence why there are hardly any "angry nerd extorts girl" type stories. Its not because meta isn't full of angry nerds, it because its really really difficult to get at user data without getting caught.