Hacker News Reader

Comment by kenjackson | Hacker News Reader

I'm really surprised that all engineers have free access to the Facebook database. That's really scary. I know at other organizations, with much less sensitive data, this stuff was under lock and key.

I have a hard time believing many aren't abusing this, just out of human nature ("did she mention me to any of her friends?").

View on HN

Multiple employees were fired for accessing private data in the past. I suspect that it is a serious taboo at the company now to even joke about it.

That seems way to risky to me. You basically have to watch server logs for some interesting patterns. And of course, if they're smart they simply oversubscribe in a query (or temporally space out a query), and then pinpoint the data they are looking for locally.

Given they have 2000+ employees this is just a process that is looking to be constantly abused. I surely don't expect people aren't talking about it, but I'm nearly as confident that it is happening in a way that most people aren't aware of. No evidence, but again, I've seen people do worse, with less access.

So what you're saying is that now anybody can still do it, but everybody knows not to talk about it.

I'm gathering that this will never change.

Whenever I meet anyone who works at facebook, my first instinct is to extricate myself from that conversation.

Otherwise we might get to know each other, and become friends, and I'd never be sure that they weren't looking me up. My strategy for avoiding the prying eyes of facebook engineers is to be personally uninteresting to any facebook engineers.

This might not work so well if I were a chick.

I imagine that the database is enormous and constantly changing, so it's probably impractical to have development copies that are sufficient to test your code against realistically. I'll bet Google engineers have access to their full database too for the same reason.

On Reddit, someone mentioned that 'becoming someone', which I presume means making the software think you've logged in as that person, is unusual and must be justified and closely tracked when it happens. So I'm guessing that you can't just pull up records for some person from the database; you need to 'be' that person to get their data. The free access is probably just for stuff that is shared via the privacy controls.

> the database is enormous and constantly changing, so it's probably impractical to have development copies that are sufficient to test your code against realistically

What the hell? why not?

Considering they use mysql how feasible is it for the database to be constantly changing? I think ive read that they use it more as a key value store then a relational store but still.

As far as I know, Facebook uses Cassandra not MySQL.

Facebook uses both among others.

cassandra is just used for inbox search, and they stated recently that they were moving away from it.

For development/testing purpose, updated schema is enough; up-to-date data is not required.

That's sufficient for some kinds of testing. It's not sufficient for performance testing or testing for changes in user behavior.

I don't know. We use artificially populated data for performance testing. for user behaviour and other metrics, they would have programs running against the actual production database, not a stale developer copy of it.

Agreed. Every large company I've worked with has had scripts that create sanitized versions of the production DB, with PCI and PII stripped out or masked to allow for testing against full size datasets. It's not hard to do.

> I'll bet Google engineers have access to their full database too for the same reason.

No, we don't. We have test instances of everything. There are a privileged few who have access to sensitive production data, and their access is carefully monitored.

What's the test data like ? Is it a sample of real anonymous data or random strings ?

It varies greatly from system to system, but I don't know enough to comment in any specificity.

what happens when one of those 1000 engineers decides to leak the FB database to wikileaks?

Lots of divorces and breakups. More media and public attention on the data than past leaks by wikileaks.

Extracting terabytes of data is difficult to go un-noticed.

How do you transfer the data? rsync through external network is too slow.

The most convenient way would be to mount physical drive on one of database server and copy things directly. But that would require cage access, which I assume not many employees have.

That's an excellent interview question! "How do you get the maximum of data out before getting noticed?". I guess the most effective way is to tamper with source code and smuggle data out along with legitimate traffic.

Tampering the source code is an interesting idea. I think it cannot be the PHP code because that's peer-reviewed by 1000+ employees daily.

It would have to be code rarely seen by others, e.g. Apache's mod_rewrite.

Or you could simply produce a php version of a winning entry to the Underhanded C Contest: http://underhanded.xcott.com/

You don't need to extract the whole lot.

"Thousands of random users' data has been downloaded from Facebook and published on Wikileaks" would be enough for a good media scare story.

we'll finally know the extent of just how pointless facebook is - but we'll all keep using it.

Wikileaks exercises caution in what it leaks. I highly doubt wikileaks would leak personal information of millions of users. Their aim is to open up governments and public agencies, not people's personal lives.

Change Wikileaks to 4Chan.

That was their story last week. This week their story is "We're going to leak a bunch of folks' Swiss bank account details because some of them might be avoiding taxes!"

Yeah, that story confirms my suspicion that Assange is anti-authoritarian rather than just anti-coercion.

I think he'll be losing some of his libertarian fans if he publishes information of people who simply want to be more free.

They didn't redact informants and collaborators names from many of the documents they leaked. I would hardly call that exercising caution.

I understand that in some cases redacting names weakens the impact of the leak and its political statement. However, releasing the name of some random informant working on the ground in Iraq has no substantial effect on the impact of the whole leak, but can have an enormous effect on that person's life, especially if he's killed.

Assange asked the US government to specify which names and identities should be anonymized prior to the leak, but the US refused to cooperate.

Maybe governments have easier ways, but it sure seems like a good idea to have an employee working for you at facebook.

I think we can probably agree that if the access is available but carefully guarded, a clever and patient black-hat could make use of their access to get the data they want; but the white-hat who just wants to do their job gets blocked. While it's not the only valid choice, it strikes me as reasonable to just grant access and impress upon everyone the incredible responsibility they now have not to do unethical things.

I wonder how/if the access is restricted? Seems like a good compromise might be:

* Read-only all the time. * Access through a special shell which logs your actions remotely. * Seemingly in keeping with the aggressive name & shame culture, if you join across all tables or forget a limit or something else which affects live operation, you get called out.

But if I'm clever I can space out queries a week or two, or a month or two (depending on what I'm looking for and how important it is).

I'm fairly certain if you give me the schema, I can be very inconspicuous over a given amount of time.

You mean for the privacy thing? Yea, I doubt it's impossible to stop altogether.

Reply on news.ycombinator.com