Be Excellent To Each Other

Because they can get it back any time they like due to a password that works on any account and none deletion of deleted stuff. Don't worry, you didn't want your privacy anyway.

I think this is true. While I still get stroppy when Google caches shit I don't want it to because I dared to email a link to it once, people ten or more years younger than me are being bought up in a world where nothing you do or say is private any more.

Ye gods is it just me or does the founder of Facebook look like he is twelve?

Personally I never put anything on there that I am not happy to have in the public domain which is most things as I am quite a private individual.

Aye, but other people might put stuff of you on there, and tie it to your account.

Speaking of 12 year olds...

Damnit, I have a beard and everything, I am a proper grownup!!!

It might be worth pointing out that there's nothing there that suggests they can retrieve deleted accounts, only deleted things on that account. Which isn't that odd.

I don't think you can delete an account; only deactivate it.

A friend of mine 'left' FB a while ago. But then he lost his phone (and, ergo, people's numbers) and decided to start a new FaceBook account to get their deets again. And, when he started again, his profile was exactly as it had been. It remembers everything, seemingly.

I've not read the link as it wouldn't surprise me. Facebook has me linked with my ex despite the only connection between us that it could possibly be aware of is that her email address was in my gmail contacts when I did an address book search, 3 years ago. And she wasn't on facebook at the time.

You can, but it's tedious.
There are instructions on the Internet for people that car.

I car (I usually refer to it as drive, though), where can I find these instructions?

That hasn't worked for a long time and only ever worked inside the Facebook offices from internal IP addresses. It's still not great but it's not quite what the media have portrayed it as either.

I stand corrected! That's actually heartening news.

All the stuff I make for work has a master password. It's not a rare thing.

A master password for impersonating user accounts is a bit odd though. I wonder why they thought they'd need to do that, given that they've got access to everything in the DB anyway.

I would guess so non-technical QA staff can reproduce and examine issues.

It's not just odd, it borders on the criminal (in the Daily Mail sense of the word).

It's highly unlikely that the master password allowed staff members to pose as the users in question.

It was for logging in with "Any existing user account name", using the master password. From the details I saw.

Yeah, but it's unlikely that it'd let that staff member pose as the person in question, it probably just allows them to login as that person (but with limited privileges) so that they can check items for problems and stuff like that.

At least, I would hope that's the case.

That's exactly what we use it for.


Grow up, man. In what sense is it even 'unreasonable', let alone criminal?
At any point, a tech at any database driven site with user logins could go into the database and replace your (encrypted or not) password with his. I could do so to log in as you on Beex in seconds. If this sort of thing is an issue, the Internet is probably not a place you want to be.
Having a global password is sensible for many reasons - it allows non-techies to examine your account for problems or abuse (as mentioned above) and it cuts down on editing the DB directly (which should really be avoided).
Facebook hammers your privacy in many ways which I think are shit, but this is not one of them.

I'd go further than "non technical QA staff" actually; we wouldn't let even mid level devs have SQL access to our production systems (and if you're working on a fault that has occurred in production that's often the only place you can work). It's just too easy to wreck shit. One badly written SELECT with an expensive join operation and no MAXDOP setting (or an INSERT missing some NOLOCKS) and I could halt all searches on the largest travel website in the UK for several minutes.

I'd rather the non-rockstar programmers were kept away from access like that. I'd rather I didn't have it, frankly.

The awesomely huge company I work for has only two levels of tech staff

I guess we have four:
1) Superstars (I'm in this tier, because I talk a good game and bluff well)
2) Mid-level solid guys who will never become 1)
3) Junior devs who will one day become 1) or 2) but probably at another company
3.5) The cleaning lady
4) Outsourced devs

Outsourcing has been great for us. I mean, they're idiots, and their code stinks, but they are so cheap! Seriously, we'd have to pay a lot more to get UK based idiots.

My comment was more a reflection on the nature of tabloid journalism than IT security

Possibly due to the transperambulation of pseudo-cosmic antimatter.

Hello, my awesomely-named chum! What are you doing out of the Metal thread?
Oh, misquoting me, I see

Other tech at my old company:



Me: Uh, are you going to put a WHERE clause in that?

Them: Oh yea... shit, I've already run it.

*facepalm*

Before someone picks me up on it, we didn't store passwords in plain text

You didn't? We do.

Not being an expert... he reset *all* of the user passwords with one command? That's power.

When we moved from Groupwise to google mail in the summer, one of the network techs told me off the record that that had to use a hacking tool to retrieve novell passwords for hundreds of users to manually port the accounts over. That worried me.

Yup. Normally it'd be something like or
Without a WHERE statement to restrict it, SQL will simply adjust everything it can. That's why accessing the database directly is a bad idea.

You can also have which would empty the user table completely.

Or presumably

See - you can do SQL*!

*although it really should end with a semicolon

I did do a Database course a while back, but my Select statements were pretty basic.

And it used Access. I know, I know...

Developers don't get to touch production. Ever.

What a luxurious world of adequate staffing you live in.

That's because all our developers are paid lots less than you.

Good job you have rollbacks, regular backups and all that sort of thing, right? Right?

Shh. It's been a while, I didn't look at what I was posing. Bloody silly quote system.

We had a daily backup, and fortunately this guy did this fairly early in the work day so we didn't lose any new user accounts.

The amusing thing is, because we didn't store our passwords in plaintext, even if he had remembered to put the WHERE clause in the SQL, it wouldn't have worked anyway.

I have done the "DELETE FROM `table`" without putting a WHERE in it though, by mistake. Fortunately it was just on a test server and was for a personal project so wasn't a major loss.

And all the girls are pretty. And it never rains.

Nah - it's a compromise thing. Your workplace has the pretty women, mine has the developers who can't touch production. And it still rains.

I ran some live SQL the other day. It was exciting. What does it mean if it asks me "is this a pass through query?"

A pass-through query works on the SQL database directly, rather than the Access (or something else) tables.

The NYTimes analysis of Facebook privacy options is fascinating. I'm quite close to deleting my account so I don't need to think about how complicated it is.

Wow! And I thought SharePoint was a fucking mess.

I've become increasingly annoyed by it in recent months. On the other hand, it is the closest thing to a contacts book I've ever had, so unless I port everyone's email addresses and give out carte de visites rather than just adding people I might as well keep it open.

I usually have it open at home in a background tab. The other day, I took a look at one of the 'privacy' settings and was shocked to see the names of several sites I frequent appear there. Not that there's anything to be ashamed by these sites, of course, but it felt very underhand for them to appear on Facebook behind my back.