Hacker News Reader

Comment by pak | Hacker News Reader

So about 1000 people have unfettered access to all of the live data, but there are absolutely no safeguards against them modifying it, copying it elsewhere, or peeking at it? That's terrifying. I'm under the impression that Google has more a stringent philosophy about this, and even then, one of the few SRE's that they do give broad access to was caught stalking teens via GMail data. Imagine the range of bad behavior an FB engineer can get away with after just 4 weeks of "Boot Camp".

Part of the reason I never made a real FB account was my general feeling in 2005 that securing a MySQL/PHP site against internal abuse takes incredible effort, and they wouldn't ever bother to do it. According to this article, that's likely true. And the "everybody can modify anything anytime" philosophy with little QA explains why, after 6 years, FB is still a gaping maw of security holes.

View on HN

after boot camp, all engineers get access to live DB (comes with standard lecture about “with great power comes great responsibility” and a clear list of “fire-able offenses”, e.g., sharing private user data)

This is through a third-party, so I'm not shaking the finger at Facebook outright yet, but the wording of that — sharing private user data — is kind of frightening. What about merely accessing private user data? Like you mentioned, I know Google is super-paranoid about even simple data access.

And now someone from Facebook chimes in and replies to this and talks more about their developer privacy safeguards and makes us all feel better. Go!

> And now someone from Facebook chimes in and replies to this and talks more about their developer privacy safeguards and makes us all feel better. Go!

Former Facebook dev here. That's all I have to say in response.

Call me slow, but can someone explain to me what the above post mean?

I think he was talking about "developer privacy safeguards". Basically, there is none.

Since there was no denial we can reasonably assume there are no stringent safeguards against engineers accessing user data.

I believe he is not confirming or denying the allegations. Make of that what you will.

Since this is your alias, I hope you won't mind my curiosity--when did you leave the company, and do you have any thoughts about leaving?

I left late last year because I got a better offer and was fully vested. I suppose I was in a small minority that wasn't drinking the koolaid. The perks were nice, but ultimately I felt I wanted more stimulation than working on a social network, and didn't like some of the features that were being pushed (face recognition on photos, etc.) I'm grateful for the opportunity, and can't say much else.

From the people I've talked to at facebook, this is not true. Just because engineers have access doesn't mean the company doesn't have controls in place. As I understand it, access is carefully logged and you better be able to explain exactly why you needed to get specific information at any given time.

Reply on news.ycombinator.com