Comment by eternalban | Hacker News Reader

Comment by eternalban | Hacker News Reader

Parent Full thread

> maybe they just didn't build a strong enough engineering team and quickly ran into the limits of their experience and skills levels.

"Free Speech platform Gab has announced Fosco Marotto as the company’s new Chief Technical Officer (CTO). According to a blog post from the company, Marotto was formerly a software engineer, production engineer, and developer advocate during a seven-year career at Facebook.

Marotto reportedly brings 23 years of industry experience to the platform along with extensive knowledge in backend infrastructure and insight that will help Gab scale as it becomes increasingly popular."

CTO: https://github.com/gfosco

Parse Server: https://github.com/parse-community/parse-server

Parse Server API doc snippet:

"If your app is compromised, it’s not only you as the developer who suffers, but potentially the users of your app as well. Continue reading for our suggestions for sensible defaults and precautions to take before releasing your app into the wild."

https://docs.parseplatform.org/rest/guide/#security

Per Ars, he removed security code.

So there are a couple of things here:

*A strong engineering team should've had vulnerability scans at some point in their build process. That SQL injection vulnerability would've been easy to spot

*That SQL injection probably should've been picked up in a code review

*They should have been using parameterized queries in the first place. The fact he removed input sanitization methods is besides the point, that they shouldn't have been relying on those in the first place.

*A senior engineer or CTO should've known better. But I've seen very senior people make bad mistakes before. These mistakes are much more likely with immature processes and safeguards.

*Sometimes someone can get to a 'senior' level without necessarily knowing how to do some aspects of software engineering well.

A strong engineering team is about the performance and practices of the whole group. You can have individuals who are experienced at particular skills but have big gaps in the skills and experience needed to build a strong team.

I couldn’t reply earlier (“posting too fast”).

These are all solid points modulo the optics of memory holing commits.

I mean, "worked at Facebook for a while" isn't a guarantee of competence. And some security boilerplate text isn't a guarantee of being good at security.

You want guarantees in software resources? Have you heard about the famous interview torture for jobs?

Your OP wanted to paint a picture of inexperienced development team. Both items in my post show that both the team (who initially had it right) and the CTO (who inexplicably removed the two lines) are definitely experienced.

That Parse Server looks like a substantial piece of code and there is a community around it, so let's be fair and grant the CTO a measure of competence, shall we?

I mean, given a choice between "an incompetent programmer with seven years work experience exists", and "Gab as a whole is some sort of weird honeypot", Occam's razor probably suggests the incompetent programmer.

23 years of experience + Existing codebase demonstrating care for matter such as filtering input == experienced. Certainly not clueless.

I said absolutely nothing about a honey pot. Review my posts. Occam's razor strongly suggests to not make un-necessary assumptions. My post challenges your assertion of incompetence. You need to remove that assumption from your analysis.

The thread was about the claim that it _must_ be a honeypot because it's so incompetent. What's your theory for how this happened, if neither incompetence nor deliberate?

Well, take that up with the GP.

> What's your theory for how this happened, if neither incompetence nor deliberate?

Honestly no theories, just rubber necking here :) but since you ask, here is what my shaving session with Occam brings up:

- cognitive impairment (alcohol, various fun chemicals)

- emotional agitation (relationship, personal matter, etc)

- rushed for time (silly mistake)

- arrogance ("I can do C++, Scala, JS, and PhP. This Ruby stuff will be cake, and I do not need to ask my team why they had those 'funny' filters on top of the function")

- malicious coding ("Sure, I'll help you scale it. I hate SV too. I hate it so much I spent 7 years at FB.")

So re. that last possibility, I also do not agree with your GP that this indicates that that platform was a honeypot. This specific event can be construed as placing a backdoor in their code.

True. I worked at a company that once hired this former Yahoo engineer when they were hot and he sang the Smurf song often and wrote shit code. All the engineers were happy he was the only dev in his section because he also smelled.

Even with all that, I would still expect him to not make any commit similar to this CTO.

Reply on news.ycombinator.com