[nashashmi]

Some Jr engineer got tired of handling stupid support requests and automated the job with an agent. That’s how.

Assigning Jr engineers for security support is ridiculous partly because young people don’t understand how critical security is sometimes. And partly because they don’t value privacy as much.

[parable]

As a "young person" (under 30), my thoughts: There's a minority of us that do genuinely care, possibly more than most - so hiring someone from this minority would be helpful - but the vast majority of my peers don't care about privacy nor security. They often take this defeatist mindset of "my data is already out there, why should I care?", or prefer convenience over security. For example, "why should I switch to Signal if I have a public Instagram profile?" or "I can't remember all those passwords! I just use one for everything."

As for your comment about junior engineers, see kennywinker's reply to this thread - I share the same thoughts.

[kennywinker]

Very generous of you to blame the screw up of one of the largest companies in the world on a jr engineer.

I’ve been a jr engineer at a large company. I had the power to implement absolutely jack shit on my own. I deeply doubt the security flow for account recovery in meta ai account security was a single jr engineer.

What i think is actually going on is basically a soft form of ai psychosis. Senior engineer gets ai to code ai account recovery feature, that same or a different engineer asks ai to review the feature, and then it gets pushed to prod. Move fast, break things. The ai coded it, the ai reviewed it - the people trusted the ai because it sounds confidently right.

Just like how the ai doesn’t know if you should walk or drive to the car wash, the ai doesn’t understand exploits like this one.

[acdha]

If a single junior engineer can do this, it’s an even bigger indictment of Facebook’s senior management than this exploit. A well-designed system doesn’t rely on individuals never making mistakes and if our hypothetical junior developer can make critical security policy changes without oversight, that should be a C-level job loss event.

If our goal isn’t to make excuses for the top of the org chart, a more likely explanation is that senior management is heavily incentivizing shipping AI features and this went out as a high-impact change reviewed in a rush, probably by AI.

[garethsprice]

Watch the ageism there, older devs can be lazy and ignorant of security too! (And are responsible for building a dev process that catches such things in review - which points to larger systemic issues over there)

I will agree that anyone that works at Meta is likely not somebody who values privacy very much, though.

[alex1138]

...yeah, but its CEO is also who he is. The guy who refers to people using his products as "dumb fucks". That's kind of important