TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

A look inside Facebook's source code

207 点作者 evandrix超过 10 年前

8 条评论

anw超过 10 年前
Interesting.<p>It&#x27;s also interesting that Facebook developers are using Pastebin for things such as this. I would assume that they&#x27;d have an internal wiki, or gist-like app.<p>It&#x27;s also noteworthy to see how they set up their accounts: first initial, full lastname—same standard as many other companies. But seeing it laid out can help in the guessing of other names (or common name occurances, as you don&#x27;t even need a full first name).<p>While some leaks may not even be effective outside Facebook&#x27;s internal network (things such as database credentials, network shares… hopefully), having actual code that may be in production does pose a risk. The possiblity to see where, for instance, data isn&#x27;t fully sanitized, or where information being fetched might not require proper authentication[1] is more worrying. Facebook is known for promoting &quot;move fast and break things&quot;. Hopefully they have good QA and SDET teams to catch these things.<p>[2] One code snippet features the following: &gt; &#x2F;&#x2F; TODO: add privacy checks!
评论 #8761417 未加载
评论 #8761054 未加载
评论 #8761043 未加载
评论 #8760993 未加载
pilif超过 10 年前
Tangentially related, I&#x27;d like an opinion on this:<p><i>&gt;Okay, so it&#x27;s not the most secure password. But Facebook&#x27;s database servers are heavily firewalled. Though if you do manage to break in to Facebook&#x27;s servers, there&#x27;s the password.</i><p>What is the point on even having a database password? The application itself needs access to the database, so the application needs to know the password.<p>That means that an attacker who gains access to the application can easily just look at the file where the password is stored and then use that to access the database.<p>Even if you&#x27;d go great lengths at keeping asking for the password at server start and only keeping it in memory - once an attacker is on the application server, the password is in memory and can be snooped.<p>So the question is: Why even use a password for the web application? In my case, I&#x27;ll just let the application servers connect to the database without password.
评论 #8762613 未加载
评论 #8763552 未加载
评论 #8787989 未加载
评论 #8761741 未加载
评论 #8761644 未加载
misiti3780超过 10 年前
fascinating stuff. I&#x27;m still amazed at how many username&#x2F;passwords are freely available via github search:<p><a href="https://github.com/search?p=96&amp;q=gmail+password&amp;ref=searchresults&amp;type=Code&amp;utf8=%E2%9C%93" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;search?p=96&amp;q=gmail+password&amp;ref=searchre...</a><p>even if they have 2-step auth setup, people choose &quot;complete the email address&quot; as a form of authentication which you can most likely get from their github profile.<p>the moral of the story here is - if you do not want someone to find it - do not publish it online
评论 #8761152 未加载
评论 #8762018 未加载
评论 #8761260 未加载
评论 #8761110 未加载
评论 #8761592 未加载
评论 #8761162 未加载
评论 #8761066 未加载
shaunpud超过 10 年前
Part 2; <a href="http://sintheticlabs.com/blog/a-look-inside-facebooks-source-code-part-2.html" rel="nofollow">http:&#x2F;&#x2F;sintheticlabs.com&#x2F;blog&#x2F;a-look-inside-facebooks-source...</a>
Alex3917超过 10 年前
Somewhat ominous for top HN users:<p><a href="http://pastebin.com/6GeZnS9b" rel="nofollow">http:&#x2F;&#x2F;pastebin.com&#x2F;6GeZnS9b</a>
评论 #8761024 未加载
评论 #8761015 未加载
评论 #8761769 未加载
superasn超过 10 年前
I found an interesting post from &quot;karthimx&quot; [1] made on Jun 30, 2010.<p>It too contains the password &quot;e5p0nd4&quot;. This user didn&#x27;t do any hacking or googling but got this error browsing facebook. He says &quot;Suddenly I got this error message in Facebook&quot; (so apparently inside the production environment, wtf?).<p>[1] <a href="https://forums.digitalpoint.com/threads/facebook-error-message.1855399/" rel="nofollow">https:&#x2F;&#x2F;forums.digitalpoint.com&#x2F;threads&#x2F;facebook-error-messa...</a><p>[2] <a href="http://www.zyngaplayerforums.com/archive/index.php/t-545034-p-3.html" rel="nofollow">http:&#x2F;&#x2F;www.zyngaplayerforums.com&#x2F;archive&#x2F;index.php&#x2F;t-545034-...</a> - Another one from 2010!
Buge超过 10 年前
Reminds me somewhat of this <a href="https://twitter.com/dumpmon" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;dumpmon</a> which monitors all pastes for email and password dumps. You can use <a href="https://haveibeenpwned.com/" rel="nofollow">https:&#x2F;&#x2F;haveibeenpwned.com&#x2F;</a> to search if your email has ever been leaked&#x2F;dumped.
bmeckel超过 10 年前
Pastebin has TONS of stuff lying around, it&#x27;s pretty fascinating. I&#x27;ve always wanted to spend some time digging around there, but haven&#x27;t gotten around to it.
评论 #8761042 未加载