Hacker News Reader

Comment by cheeze | Hacker News Reader

Wow. That is extremely impressive that such a large company is able to get a fix out that quickly.

The fix is probably 10 minutes but the deployment process, intake process and notification process took 3 1/2 hours

Is there an article or blog post somewhere about what Facebook's deployment process is like? It must be a massive operation.

https://code.facebook.com/posts/270314900139291/rapid-releas...

They also use bittorrent:

https://arstechnica.com/information-technology/2012/04/exclu...

What about code review process? Surely someone else verified the fix before deployment.

FB uses Phabricator, which was spun out into an open-source project:

https://www.phacility.com/phabricator/

If it took much longer than that for bugs like this, all of the HN doomsday posts about the Facebook mass exodus might actually come true

I think people leaving facebook en masse would be a good thing (TM) for society, not a doomsday. Fewer echo chambers, less disinformation, and people forced to make effort to contact each other.

It will only be replaced with another echo chamber.

Hopefully multiple smaller ones.

Already there - whatsapp, instagram oops...

Hacker news....

This effect is partially muted by the fact that one can only see the vote status of one’s own post. There is still a tendency toward conformity, but at least the suggestion to vote with other readers isn’t apparent like it is on many content aggregators/discussion media.

Except downvoted posts here turn gray.

Which is why I make a point of logging in and upvoting the non-egregious ones.

Yeah but I can predict pretty accurately which of my posts will get downvoted and they all have the same thing in common; they challenge the left-leaning groupthink common here.

Some might claim they get downvoted because they are "low quality" to which I'd retort why spend a lot of time crafting a "quality" reply when you know it's going to be suppressed?

While it might just be me, I find myself downvoting your comments purely because I find them low-quality noise (or worse) that I'd rather not see more of.

I even tagged you as 'shitty commenter', which I don't do this too often. But with some commenters I'm just amazed at how they can consistently keep this up without tiring of it.

Hacker News is at least somewhat informative in the tech sphere. It tends to favor more esoteric technology like Lisp in lieu of things like Java & JavaScript which is far more favored on Reddit/Programming. Politics are mostly left leaning mixed with some Libertarian views. There is a good splattering of non tech stuff as well (music, art, literature, linguistics...etc). I'd say it's a far cry from fake news and cat videos.

Its cause of the people. The more popular something is the worse it gets until eventually its all cats and outrage-culture "fake news". The medium is irrelevant.

Media sucks because you* suck.

*The collective societal you, not the particular individual you.

I think some studies have shown that the same set of people (or, let's say, people randomly assigned to one group or the other) can have very different behavior depending on the situation they're in. It seems at least possible that a forum could maintain its rules and norms while people join... though received wisdom says that if too many join at once, then the norms can be broken.

Yea, but HackerNews is really only going to appeal to a select group of people. Computer illiterate folk aren't going to be talking about compilers, lisp, APL, Smalltalk, blockchain, or the other 1000 compsci things that come up on here daily.

Oh, look at them rush to White Knight their own bubble. "Not OUR echo chamber, no! We're different, you see, because reasons."

Scuttlebutt, mastodon, Riot, gab, stack overflow, d.tube, the list goes on

Some crtical thinking would be good for a society. Tools are just tools.

I've been following Josip's work on and off for years now (he's probably on every big white hat hall of fame there is), and I'm pretty sure he wouldn't go public even if it took them a month to fix this.

If he said in a public blog post that it took them a month to fix something so simple, I could see the shit storm aimed at Facebook on social networks (including here), but I highly doubt any user would be compromised.

It's a trivial bug. If the parameter is invalid, return nothing, rather than return all the credit cards.

I'd be worried if any company is not able to understand the problem and publish a patch in a few hours.

The fix isn't the hard part. It's the deployment and validation that can take time.

Pretty impressive.

Yep, clearly shows the value of a properly configured CI/CD pipeline.

Yeah here it is:

git pull; sh tests; rsync /prod/ all@prod:/var/www/

^ That is copyrighted by the way. Ill take a consultant fee. I know - I know it should be thousands of lines of puppet, jenkins, hooks, Kubernetes, Salt, and 2 million lines of python and ELM all piped through Docker containers -- I am NOT an animal.

Enterprise edition with test validiation and continuous deployment:

while true; do git pull; sh tests && rsync /prod/ all@prod:/var/www/;done

You forgot to rewrite the logic in xml, and then fetch it over the internet from unknown third parties by tunneling it through json, then http. Bonus points if the the whole thing is deployed via docker hub.

!!!

those ... those semicolons should be &&

You need to invoke the script via ‘sh -ex’ for proper exception handling + debuggability.

Also, mktemp and shell exit traps are your friends.

Git pull - you have a staging server!?

Except that this is Facebook, so `sh tests` is going to take 900 cpu-hours

The deployment and the validation should be trivial if the fix is trivial.

The difficult part is having someone who reads the report and escalates it, preferably in a timely manner.

The world is littered with the smoking, segfaulted, hulks of programs that were quickly deployed after an obvious fix.

> The deployment and the validation should be trivial if the fix is trivial.

Trivial. That's what Oculus said.

I'd more impressed in some other context since a willingness to skimp on validation and "red tape" is how a bug like this ends up in production in the first place.

What validation? I'd assume for this one they'd take the "move fast and break things" approach.

> If the parameter is invalid, return nothing, rather than return all the credit cards

I don’t think that’s the bug here, bug here is the authorization check not being there.

That parameter is trivial to obtain using other ways even now.

Reply on news.ycombinator.com