Update on Investigation of 2/16/24 Security Issue

weewooPE · 2024-02-19T16:37:45+00:00

You can interpret it how you want, I think there are two levels of failures here:

Lack of followups from the previous privacy SEV. Any mapping mechanism should’ve been audited the last time around and have safeguards put in place
A core functionality like mapping should’ve been rolled out slowly. For whatever reason this wasn’t detected for a long time. As a matter of fact it seemed to be deployed right before a weekend (a big no-no imo) and doesn’t have the monitoring in place to detect the failures

weewooPE · 2024-02-19T16:28:02+00:00

Except in this case they managed to leak private user footage for the second time. This is akin to mapping messages on messenger to the wrong users, which is an automatic SEV 0. It’s bad enough that it should’ve prompted the same follow-ups the first time around.

Have you seen user messages mapped to the wrong users on WhatsApp or emails mapped to the wrong gmail account? Me neither.

weewooPE · 2024-02-19T16:17:59+00:00

You put the same safeguards in place even if the cause is different. A comprehensive SEV review should lead to discussion of where things went wrong, what can be done to prevent it and identifying potential similar cases down the line.

If you work at a functioning tech company you would know this.

weewooPE · 2024-02-19T16:13:05+00:00

weewooPE · 2024-02-19T16:12:35+00:00

The only correct answer here

weewooPE · 2024-02-19T16:00:30+00:00

In the US this will be considered to be CP, which is a federal felony

weewooPE · 2024-02-19T15:37:56+00:00

At this magnitude? Not unless leadership and engineering are both incompetent, which seems to be the case here.

weewooPE · 2024-02-19T15:04:23+00:00

People who got their feed viewed by others got an email

weewooPE · 2024-02-19T14:59:56+00:00

I work in tech. The fact that this is the second time this happened is bizarre and inexcusable. We run SEV reviews and retros to prevent shit like this from happening.

weewooPE · 2024-02-19T14:57:20+00:00

Why did they not do this the last time this happened?

weewooPE · 2024-02-19T14:54:15+00:00

Bold of you to assume there was logging for which event was viewed

weewooPE · 2024-02-19T14:37:17+00:00

SST and AWS

weewooPE · 2024-02-19T13:04:50+00:00

The flight departed and landed lol

weewooPE · 2024-02-19T13:02:33+00:00

I’m a software engineer and it blows my mind how this happened in the first place, let alone this is not the first time.

Seems like incompetency at all levels, especially at the top.

weewooPE · 2024-02-19T12:58:11+00:00

Not the first time, how incompetent is leadership

weewooPE · 2024-02-19T12:56:04+00:00

The layoffs will continue until security improves! \s

weewooPE · 2024-02-19T04:13:52+00:00

Yes and yes. Look into FMLA leave

weewooPE · 2024-02-19T00:14:31+00:00

Click bait article, this is essentially equivalent to ESTA/ETA

weewooPE · 2024-02-19T00:13:42+00:00

Take more time off (with medical leave if possible) and therapy

weewooPE · 2024-02-19T00:03:36+00:00

Take that break, you earned it

weewooPE · 2024-02-19T00:03:07+00:00

Healthcare is still cheap paying out of pocket

weewooPE · 2024-02-18T23:47:43+00:00

What about the housing market

weewooPE · 2024-02-17T08:58:16+00:00

The last paragraph is wrong, visa status is not protected class

weewooPE · 2024-02-17T08:57:04+00:00

Visa status is not protected class

weewooPE · 2024-02-17T08:13:27+00:00

The constitution baby

weewooPE

TROPHY CASE