Comment Re:Never Meta! (Score 1) 14
All the AI companies are shady as hell but Meta takes the cake. Why do people continue to believe Zuck and friends? They have been shown, time and time again, to ignore privacy in the place of profits, people are fools.
To be honest, I don't think this is them ignoring privacy. I think this is them having gotten so complacent about privacy that nobody there even understands how to protect privacy anymore.
I mean the first rule of privacy on the Internet is "DNS isn't private." This is such a basic mistake that nobody with an ounce of privacy sense should make it. The URL's hostname should contain only the organization name or individual username and maybe some unique identifier if they really need that. But 99% of titles aren't secret in and of themselves, so I'll give them a pass on this one for now, even though it is still a horrible bug for the remaining 1%.
And the second rule of privacy is "Knowledge of a resource is not authorization." The fact that a resource that has not been shared can be accessed by its URL, and that apparently no attempt has been made to ensure that only people who are authorized to access that URL can view its contents means that they effectively have no access control at all. This would be an epic fail even if the first security bug weren't there.
This makes me suspect that some intern vibe-coded this thing as a prototype with no human design review at all, and that their team shipped it without actually taking the time to understand how it worked, relying too much on AI to do the review, and that the AI had inadequate training on how to implement privacy and security. Either that or the design docs did not adequately cover how the authentication worked and the reviewers did not bother to ask, which is an even bigger concern.
Either way, Meta needs to seriously clean up their act. This should have never shipped without a proper security review, and the fact that problems this severe were not caught is clear evidence that a proper security review did not happen. Identifying the underlying reasons for that failure should be a top priority, and the answer is never "Fire person X for not doing their job," because something this bad is never the fault of one person or even a small number of people. It's always systemic. It's always a lack of adequate controls, adequate numbers of eyes on design, adequate review, etc. And until they address the systemic problems that led to this outcome, I won't trust anything that Meta does going forwards as far as I can throw it.
So my advice to Meta would be that they do a very detailed internal postmortem, identifying all of the different places where this could have been caught and why it was not caught, identifying mitigation strategies to ensure that similar things don't happen in the future, etc., then implement all of those mitigation strategies, and finally create a second, publicly sanitized version of that doc and publish it externally as a "Here's what we're doing to make sure this never happens again" document. That's what they need to do to restore the faith of the folks who have witnessed this disaster.
Anything short of that level of public documentation showing that they truly understand how badly they screwed up and have genuinely taken steps to ensure privacy and security in future products would be inadequate, given the level of corporate ineptitude required to reach this point.