mkjones

6 ms·

1.
by mkjones 11y ago
I had a similar but less-awful experience (fortunately as a renter rather than owner). Living in a similar slab house, I was surprised when my shower became slow to drain and draino had no effect. I called the plumber, he came by, and eve
2.
by mkjones 12y ago
I suspect flash is generally used to play sounds from chat messages - the https man-in-the-middle detection is heavily sampled, as referenced in https://www.linshunghuang.com/papers/mitm.pdf . [I work at FB, but not on
3.
Windows SSL Interception Gone Wild(facebook.com)
263 points by mkjones 12y ago|130 comments
4.
by mkjones 12y ago
OK, I can think of a few ways they might do this (DNS tricks and per-user IPv6 addresses, <src ip, src port, dst ip, dst port> => user mapping). These all seem significantly more complex than HTTP header injection though.
5.
by mkjones 12y ago
How would ISPs tag requests going over HTTPS as being from a particular subscriber?
6.
by mkjones 12y ago
Yep, "URLs shared primarily by not-sharey people" sounds similar to a lot of classifiers we have.
7.
by mkjones 12y ago
Yeah, we've played with that idea a bit. It doesn't help the sparseness problem (actually makes it worse), and if we took action as a direct result, it would give people the power to DoS content they disagree with. For sites oper
8.
by mkjones 12y ago
So I can't speak for twitter, but I work on anti-spam at Facebook, and imagine the problems we face are relatively similar. It's worth noting that there's a constant barrage of people trying to send varying degrees of spam.
9.
by mkjones 12y ago
hey I work on anti-spam at FB. Happy to talk sometime. facebook.com/mkjones or @fisherrider on twitter (lol). You can learn a little about how we think about securing login here: http://vimeo.com/80460475 .
10.
by mkjones 12y ago
I'm surprised more aren't mostly-white for the first 3/4, and then they split at the end. It seems like all the action in basketball always happens in the last 2 "minutes."
11.
GIF that swaps time and space(imgur.com)
5 points by mkjones 13y ago|0 comments
12.
by mkjones 13y ago
We (I'm another eng at FB) definitely hire interns who are not juniors in college. You can be younger or older (or you could be a junior - I did my internship here after junior year). As I understand it you just need to be going back
13.
by mkjones 13y ago
Hmm, wanna report at facebook.com/whitehat with more details? Please include repro instructions :).
14.
by mkjones 13y ago
I think there's a spectrum between letting whitehats do anything (including violating privacy, hurting real user accounts, etc) vs. suing everyone who changes a GET param somewhere. Having a whitehat program with (IMO reasonable) guid
15.
by mkjones 13y ago
OK - so I work on a security team at Facebook and sometimes help with reviewing Whitehat reports. To be clear, we fixed this bug on Thursday. The OP is correct that we should have asked for additional repro instructions after his initial r
16.
by mkjones 13y ago
Hey folks - I work on security at Facebook (though not specifically the Whitehat program) and just wanted to let you know we're looking into this right now.
17.
by mkjones 14y ago
Compromising an up-to-date machine is usually a bit harder than just pointing nmap at it and enumerating running services. Getting someone to visit a web site is relatively easy.
18.
by mkjones 14y ago
Yeah, the moment we realized what was going on, it was like one of those horror stories you tell as a kid: "...the call was coming from INSIDE THE HOUSE." The only way an attacker could have come across this URL would be if they had access
19.
by mkjones 14y ago
I was one of the people involved here (the guy quoted as saying "which means that whoever discovered this is looking at our code"). As the article noted, they started the whole drill relatively early in the morning on a workday (a Wednesday
20.
by mkjones 14y ago
I assume the 10.0.0.0/8 responses were from other hosts on their network?
21.
by mkjones 14y ago
Cow-orker of ldbrandy (and nbm!) here, and one of the clients of FXL. We definitely make use of machine-learned models to catch some kinds of spam. They're good at keeping old attacks at bay, and some are pretty good at catching new attac
22.
by mkjones 14y ago
I think he's confusing the key-derivation function this article talks about for your "master key" with the MAC-in-JS this particular thread is discussing.
23.
by mkjones 14y ago
I suspect they care a lot more about the effect these additional upstream bytes have on response time than their own network ingress. Especially for a site that cares so much about performance, an extra handful of bytes on a slow connectio
24.
by mkjones 14y ago
https://www.facebook.com/whitehat/bounty/ describes our bug bounty program, linked to from the "bounty" tab on the left of https://www.facebook.com/whitehat/ .
25.
by mkjones 14y ago
We're working on improving this flow. However, if you tell us to trust a given computer when you log in, you shouldn't have to enter the code more than once.
26.
by mkjones 14y ago
Yep as chucknthem points out, try clicking the "bounty" on the left side: https://www.facebook.com/whitehat/bounty/ . Sorry I didn't make that clearer!
27.
by mkjones 14y ago
A robots.txt file disallowing crawling on the sites that display the contents of user email would help fix this. However, as some of the discussion below points out, I don't believe that disallowing crawling of these URLs in our robots.txt
28.
by mkjones 14y ago
I'm not sure either, but I doubt that Chrome or any of the badware-stopping features that are built in to it cause the URLs they're checking to be indexed. I'd be even more surprised if Firefox did this. If you've got the toolbar installed
29.
by mkjones 14y ago
My name is Matt Jones, and I work on the Facbook security team that looked into this tonight. We only send these URLs to the email address of the account owner for their ease of use and never make them publicly available. Even then we put p
30.
by mkjones 14y ago
Glad you found our anti-scraping stuff to be neat! I work on the team that builds a lot of that technology at Facebook. Any interest in interning here sometime and helping us improve our systems even more?

More ›