Facebook at Work spamblocks some SQL queries | Hacker News Reader

Facebook at Work spamblocks some SQL queries

blog.koehntopp.info

92 pointsomnibrain76 comments

When it's 2018 and you're having trouble sending plain text over the network it might be worth stepping back for a second and asking: "have we regressed?"

Chat applications have mistakenly transformed code into emojis and links for as long as I remember. That isn't new. But facebook takes it to another level by blocking your messages because it doesn't like the urls.

Funny you'd mention that, the parent's post reminded me of my experience with Discord a while ago. I was trying to paste some code and basically nothing made it through unscathed because the chat kept interpreting the text in... interesting ways.

IRC has its quirks but at least it's relatively easy to send arbitrary ASCII text.

While Discord has many other limitations it's use Markdown so it's super easy to send little snippet of code using it.

Discord is (a subset of) markdown so you just use [`] to denote inline code and [```language-name] and [```] to denote code blocks.

I did not know that, thank you.

Yes, but that should be a configurable option on the client. Send me the damn text then let me decide if I want to look for URLs or substitute smileys for images.

Not to mention chat services don't provide any unified API and you need a different app for each of them.

Just counted, I'm currently logged in to 7 different chat systems, none mutually interoperable.

I'd pay for an application that provides me a unified view of all those, for phone and for desktop.

XMPP transports.

I wish.

Providers of popular chat apps force you to use their clients only. The little XMPP support that existed is dwindling now.

Transports, not service provided gateways.

I'm successfully using Facebook's Messenger and Hangouts from a single XMPP account right now. AFAIK Telegram and WhatsApp should be super easy too, but I don't use them at all.

Whatsapp actively bans users it detects using third-party clients, so that's always risky.

You're talking to people on FB with a XMPP account? or using your facebook credentials to connect?

I tried hangouts recently and the lack of message carbons made it pretty unusable.

Talking to people on FB and Hangouts with single XMPP account on my server, via transports.

The Facebook's XMPP gateway has been disabled for a long time already, while Hangouts' one works, but poorly. Plus using gateways still requires you to configure multiple accounts wherever you want to chat. Transports solve that.

ahh through transports/gateways you run - so you have a facebook account and just registering that.

I got excited for a moment thinking there was some unlisted way of messaging someone on facebook via XMPP.

What's the transport you're running for fb and hangouts?

There is an app called Franz that bundles the web versions of many services that have them. That doesn't sound very appealing to me either, though.

Automated censorship is what pisses me off the most about messenger.

I’m a old enough now to be able to privately share whatever I want to my friend. Yes Facebook, sometimes I want to purposely send a porn link to my friend!

"business version of Facebook"

There's your first problem.

Who thought "business version of Facebook" was a good idea?

My employer did. And while I was very extremely sceptical at first, I had to eat my hat on this. It's actually one of the best things for facilitation of enterprise cross-department communication and awareness that I have ever experienced in the last 33 years of my working life.

Could you explain what features make it so good for your use case?

I could, but to actually understand you have to try out, because it's an experienced quality and not some a thing that is amenable to description.

Before the corp FB instance we had Wikis, Email, Mailing Lists, Jabber and an internal "Youtube" like Video Store. It all sucked.

With the FB instance, the awareness of what goes on in other parts of the company is much higher, the noise level is lower, communication is more timely and generally you feel less stressed out. Email numbers are down, mailing lists practically do not exist any more (except for machine communication such as commit messages), things organize neatly in FB groups, and you kind of automatically find the groups that are relevant to work. The Wiki hardly sees discussion any more, and is mostly documentation.

There are a lot of problems in Workplace by Facebook, mostly in the messenger product (no spatial metaphor, i.e. no rooms, only groups, being the largest). But in general it has been an amazing improvement on what we had before.

My boss is deseperately trying to convince me that my project wiki can painlessly be replaced by Microsoft Team (build upon share point). Yet this is utter bullshit every workaround he proposed to replace missing feature look like regressions that will make us spend more time on solving share point issue than on actually writing documentation.

You seems satisfied with FB for business and you claimed it could advantageous replace multiple wikis. Can you develop your though cause from the outside it look like the same bullshit that salespersons will use to sell MS Team to gullible boss.

> My boss is deseperately trying to convince me that my project wiki can painlessly be replaced by Microsoft Team (build upon share point).

In my experience, the words "SharePoint" and "painless" do not exactly go well together.

Facebook Work is a communication tool. It doesn’t replace your wiki. The only real affordable is Notes, which solves the “update email” case, but not evergreen documentation case.

Facebook use Quip for wiki-like solution as well as some internal tools.

My bad op mentioned that they kept wiki for doc. Read to fast sorry.

Experience couldn't be more different for us. We also use the "Faceplace" as it has become "affectionately" known.

Everyone just turns off the notifications on the freaking thing, so really important things are still sent out via email.

It's corporate/business thing, right? And yet they kept the useless alrgorithmic feed. Just yesterday I couldn't find an important management post because it was buried below random crap from a dozen or so groups, and people, and events, and...

Well, it also sends email for some (not all) notifications. The email preview contains a total of 6 words from the original text and forces you to go to the crap.

Every single post including the really important ones are five lines of text with a "see more" link. Oh, and half of those texts are created as documents/notes (which are different from regular posts), reposted to half a dozen different groups that all show up in your timeline (nothing like seeing the same text 10 times I guess).

And it continuously nags you to get their crap good-for-nothing Chat App (just look at the f*ing thing https://grumpy.website/post/0PSSXS3k8).

Facebook cannot even imagine that business needs of business clients are not driven by engagement numbers, or by MAUs, or by LTVs or by any metric that is relevant to Facebook.

EDIT: Rephrased some sentences

EDIT 2: Re: replies to my comments. "Oh, it's da bomb, only you need to <a list of multiple things to setup before it's even remotely useless>". Stockholm syndrome in full swing

You need to turn off email notifications but carefully select which groups to leave notifications on for (and some you can use the “highlight” setting). Then every day or two you can use the “notifications” tool (the link on the left side bar) and quickly check all your notifications exhaustively and be sure not to miss anything (and as you do that refine your list of groups).

Used this way it’s an amazing tool for cross team collaboration, way superior to Slack which I used in my previous job but couldn’t keep up with.

Disclaimer: I just joined Facebook.

So, basically, spend countless hours tuning the most basic functionality. Skip the most useful functionality, as it's unusable (timeline and search, see other comments).

What an amazing tool though.

It takes no time to tune. If you see notifications from groups that bring little value, just turn them off. Very simple and natural process.

> carefully select which groups to leave notifications on for > every day or two you can use the “notifications” tool > as you do that refine your list of groups

So, continuous tuning for no reason at all.

Let's add things from other comments, shall we?

> The feed is pretty much useless. > You tune notifications to catch the “must read” stuff and filter out the rest of the noise. > STFU notifications, then carefully tune back in. > The feed is crap. Do not read the feed. Make a bookmark bar their search is crap.

etc. etc.

Facebook runs on Facebook. When I was there it worked really well.

You need to use it properly though. The feed is pretty much useless. Groups are where it’s at. Facebook has Company FYI groups, org-level FYI groups, Product team workspaces, etc. You tune notifications to catch the “must read” stuff and filter out the rest of the noise.

> You need to use it properly though.

"You're holding it wrong"

> <an unending list of things I have no desire to figure out or set up>

Why would I want any of that? :)

1. De-mail it in the preferences.

2. STFU notifications, then carefully tune back in.

3. The feed is crap. Do not read the feed. Make a bookmark bar:

3.1 https://companyname.facebook.com/chat/t/<..> Chat link

3.2 https://companyname.facebook.com/notifications/hub/all/ Notification hub link

3.3 https://companyname.facebook.com/?sk=h_chr Feed, force-chronological order, for hard cases only

3.4 https://companyname.facebook.com/profile.php?id=<your id here> Link to your profile, to write notes et al

3.5 https://companyname.facebook.com/groups/?category=membership Group Overview. This is your cockpit, basically

3.6 https://companyname.facebook.com/saved Saved Posts. Because their search is crap.

All I see is: "it's crap, and you have to work hard to make it even remotely useful" :)

I've used Yammer before and it was mostly useless so I'm a bit skeptical as well.

Facebook, apparently.

It's not exactly a terrible idea, either. Facebook is arguably a form of groupware, and so I could see its potential in a work environment...

Came here for that. I .. wasn't even aware that this exists, but that seems awful on so many levels?

What FB 'features' do you need in a company? I thought Slack is the go-to for cat pics and birthday gifs?

Slack does not even scale to corporate size, instance sizes are too limited. Also, they have no corp sales plan to speak of.

Finally, wrong kind of comms - chat is ephemeral, and messenger is only a small part of what is needed or corp facebook offers. And Slack is lacking the necessary controls for a corp environment.

> Slack does not even scale to corporate size

I don't understand what corporate size is. Care to give some numbers?

Upwards of 20.000 employees in my case here, with some serious variance and fluctuation because of the work being seasonal.

We have ~50k active users in our corporate Slack.

> Slack does not even scale to corporate size, instance sizes are too limited. Also, they have no corp sales plan to speak of.

Your information is outdated. Slack recently introduced an Enterprise product (on-premise AFAIK) where you can have multiple workspaces for each division, but auth is managed centrally and organization-wide channels can span across all workspaces. We're using it at SAP.

Don't knock it until you try it. It's actually quite a good application of "social media" for a company because the domain is so specific.

While it's fun to take potshots at using Facebook for work, this is also a clbuttic issue in stodgy corporate environments based on crap like Lotus with overzealous "anti-virus" and anti-profanity filters

Also known as the Scunthorpe problem[0]

[0] https://en.wikipedia.org/wiki/Scunthorpe_problem

In the late 1980s I fought simple profanity filters that wouldn't let you send the words wristwatch or Scunthorpe United. Impressive just how far we've come.

clbuttic

10 years ago at school I could not search for documentation about strings or "insert" clauses (sql) because that would trigger the firewall. Fun times.

In 2017 I couldn't get a price on anything in the Cisco Select range because clicking the link triggered a WAF on the distributor's servers.

Gently caress that!

My GF worked on an mmo's tweens. Said one experiment with filters ended with a 12 you old boy writing, I'm going to stick my giraffe up your pink bunny.

I quite often encoded code snippets sent on Skype with Base64 to avoid formatting until I found out eventually they support markdown syntax for preformatted text. I see it is also supported by Facebook at Work, maybe this would help here? https://www.facebook.com/help/work/541260132750354

``` for quoting code does not prevent the sd.date_of_delivery problem. It still urlifies, and the DNS parser tokenises wrongly.

Thanks, I don't have access to Facebook at Work so I couldn't check it on my own.

So apart from the lack of control over URLification in normal messages that the author rightly pointed out, it seems they also have a bug in the noformat feature.

That sounds like a bug rather than a feature.

I have seen similar issues with overly aggressive parser in Messenger for Business, but with dates instead. It tried to turn the words in the following real conversations into dates for adding appointments

* "Christmas" in "Merry Christmas, and have a nice day"

* "at 100" in "It could be that you're not viewing the image at 100% zoom"

* Four digit module codes from my university that looks like four digit military time

and so on, ignoring context or even prefix/suffix text which makes it clear the text is not a date. It would be funny if these don't keep getting in the way when random words in conversation gets turned into links.

    > run a forked codebase on isolated servers[...]

It's not forked at all, when you use the business version of Facebook you can even URL hack public Facebook URLs to share the same global IDs to your "private" instance, and you might even see public comments from public Facebook users.

It's also possible to invite public Facebook accounts to your groups in your business instance, to them they're just browsing another group on Facebook.com.

So the Facebook Business instances really aren't separated out at all more than just being the equivalent of an aggregation on private groups on facebook.com + custom domain etc.

Edit: I just tested this by taking a random post of Zuckerberg's and replacing www. in the URL with <mycompany>. and sure enough, Zuck then shows up on our "internal" Facebook, albeit with a notice saying it's a public post. You can then "share" the post and get the same behavior as on public Facebook when you share an existing group post to another group or message.

So, you are saying one can share links on Workplace? I can see some uses for this feature...

Yes it's useful. Not saying it's bad if they've got their ACLs right. It's just an interesting leaky abstraction showing that it's little more than a whitelabel for Facebook.com.

It can still be a forked codebase and do all of what you say.

What you’re outlining is that it’s not isolated from public Facebook infrastructure.

Indeed. My comment only shows that, but as a follow-up it's also clearly not a forked codebase. Facebook UI changes show up at the exact same time, and as a practical matter they must be syncing regularly if both access the same underlying storage.

Why on earth would you use Messenger for anything useful?

People are happy to post business details on a FB for Work (tm). Really makes one think that Zuck was never wrong on his assertion on why people people trust him.

Introducing <FB for work or whatever tool> for internal communication and then not using it for internal communication kind of defeats the point then, doesn't it?

Sure, my point was why use FB for internal communication in the first place.

There are tools specifically made for that, and they are made by companies that respect their clients (the ones that pays the bills, instead of advertisers).

For what it’s worth: the expected behaviour to swap code snippets internally is to share a link to an internal version of pastebin/gist that allows comments, version control and referencing. Whether that has to be compulsive or whether casual code is fine is probably a worst contention that vim vs. emacs so I’ll just leave that here.

On Workplace by Facebook: I can see how that seems counter-intuitive, but I’ve worked for four distinct companies who had it or moved to using it, with or without Slack and (given some hints on how to use it properly) this is the most compelling solution to a lot of internal communication issues. It’s about as impactful as email or cellphone: you can’t really understand how things work without. I am not considering working for a company that doesn’t use it (or an improvement).

This depends on the snippet size and purpose. For collaboration on code it's likely the wrong tool. However when exchanging single statements there is no good reason to switch between tools.

Copying and pasting SQL (and other code) works just fine in Slack btw...

... if you mark it as such with backticks, else emojis, link detection, username lookup, ... destroy it.

I thought this was a protection against the Bobby Tables problem.

It's also quite weird when it linkifies a two-letter word (non-English) because it thinks I might be referring to a week day, which has never been the case so far.

On the other hand, it potentially punishes people for not putting spaces after punctuation. I say keep it like that.

> On a business instance of Facebook it has literally no business to listen in, but does.

What did he expect ?

I have never heard of the business version of facebook before. Is it common anywhere?

> Posted in: Hackerterrorcybercyber

Reply on news.ycombinator.com