5 ms·
As a security researcher, the most impressive part of this is the response timeline from Facebook's security team. 3~ hours from first report to temporary patch
by neilwillgettoit 12y ago
As a security researcher, the most impressive part of this is the response timeline from Facebook's security team. 3~ hours from first report to temporary patch! That's insane.
- aristus 12y agoFacebook deploys code twice a day. It used to be once a day but as the org grew they decided to double down. They can deploy even more often if there's a "pusher i haz a hotfix" situation like this.
- Artemis2 12y agoYeah, I reported a simple security breach in Outlook.com to Microsoft three weeks ago, and it seems they still haven't fixed it yet. Way to go Microsoft.
- ttty 12y agothen you can share :D
- eugenez 12y agoWe also have a system for patching vulnerabilities which does not require a full code push. It has been useful on a number of occasions. (source: I patched this one)
- stevenh 12y agoDoes Facebook usually respond to exploit reports so quickly, or does the fact that the discoverer (Stephen Sclafani) helped Facebook find bugs in previous years mean that his emails were automatically flagged as high-priority?
- eugenez 12y agoWe try to respond to any exploit of this severity immediately, and will often disable a feature temporarily while working on a fix rather than letting the exploit remain open. It helps a lot when the repro steps are as clear as they were in this one.