Hacker News new | ask | show | jobs
by cheeze 3030 days ago
Wow. That is extremely impressive that such a large company is able to get a fix out that quickly.
3 comments

The fix is probably 10 minutes but the deployment process, intake process and notification process took 3 1/2 hours
Is there an article or blog post somewhere about what Facebook's deployment process is like? It must be a massive operation.
What about code review process? Surely someone else verified the fix before deployment.
FB uses Phabricator, which was spun out into an open-source project:

https://www.phacility.com/phabricator/

If it took much longer than that for bugs like this, all of the HN doomsday posts about the Facebook mass exodus might actually come true
I think people leaving facebook en masse would be a good thing (TM) for society, not a doomsday. Fewer echo chambers, less disinformation, and people forced to make effort to contact each other.
It will only be replaced with another echo chamber.
Hopefully multiple smaller ones.
Already there - whatsapp, instagram oops...
Hacker news....
Scuttlebutt, mastodon, Riot, gab, stack overflow, d.tube, the list goes on
Some crtical thinking would be good for a society. Tools are just tools.
I've been following Josip's work on and off for years now (he's probably on every big white hat hall of fame there is), and I'm pretty sure he wouldn't go public even if it took them a month to fix this.

If he said in a public blog post that it took them a month to fix something so simple, I could see the shit storm aimed at Facebook on social networks (including here), but I highly doubt any user would be compromised.

It's a trivial bug. If the parameter is invalid, return nothing, rather than return all the credit cards.

I'd be worried if any company is not able to understand the problem and publish a patch in a few hours.

The fix isn't the hard part. It's the deployment and validation that can take time.

Pretty impressive.

Yep, clearly shows the value of a properly configured CI/CD pipeline.
Yeah here it is:

git pull; sh tests; rsync /prod/ all@prod:/var/www/

^ That is copyrighted by the way. Ill take a consultant fee. I know - I know it should be thousands of lines of puppet, jenkins, hooks, Kubernetes, Salt, and 2 million lines of python and ELM all piped through Docker containers -- I am NOT an animal.

Enterprise edition with test validiation and continuous deployment:

while true; do git pull; sh tests && rsync /prod/ all@prod:/var/www/;done

You forgot to rewrite the logic in xml, and then fetch it over the internet from unknown third parties by tunneling it through json, then http. Bonus points if the the whole thing is deployed via docker hub.
!!!

those ... those semicolons should be &&

You need to invoke the script via ‘sh -ex’ for proper exception handling + debuggability.

Also, mktemp and shell exit traps are your friends.

Except that this is Facebook, so `sh tests` is going to take 900 cpu-hours
Git pull - you have a staging server!?
I'd more impressed in some other context since a willingness to skimp on validation and "red tape" is how a bug like this ends up in production in the first place.
What validation? I'd assume for this one they'd take the "move fast and break things" approach.
The deployment and the validation should be trivial if the fix is trivial.

The difficult part is having someone who reads the report and escalates it, preferably in a timely manner.

The world is littered with the smoking, segfaulted, hulks of programs that were quickly deployed after an obvious fix.
> The deployment and the validation should be trivial if the fix is trivial.

Trivial. That's what Oculus said.

> If the parameter is invalid, return nothing, rather than return all the credit cards

I don’t think that’s the bug here, bug here is the authorization check not being there.

That parameter is trivial to obtain using other ways even now.