The failure to use the existing technology is peculiar.
Only if you have never coded software professionally in your entire life. A junior engineer on team B did not use the library code written by team A several years ago, which is probably documented mostly as a matter of oral lore among members of team A. Instead, mistakenly believing the problem to be trivial ("I have the URL they're going to! All I need is to output it. Hah, psych, I'm going to run it through our HTML escaper to make sure there is no cross-site injection. Security++ I am the awesome."), they handwrote a one-liner which worked fine. Two years later it is the subject of a WSJ article.
This only happens every single freaking day on every project I've ever been on. Heck, I have missed opportunities for re-use (and caused subtle side-effects through doing so) frequently when I was the only coder on the project.
Comments
The failure to use the existing technology is peculiar.
Only if you have never coded software professionally in your entire life. A junior engineer on team B did not use the library code written by team A several years ago, which is probably documented mostly as a matter of oral lore among members of team A. Instead, mistakenly believing the problem to be trivial ("I have the URL they're going to! All I need is to output it. Hah, psych, I'm going to run it through our HTML escaper to make sure there is no cross-site injection. Security++ I am the awesome."), they handwrote a one-liner which worked fine. Two years later it is the subject of a WSJ article.
This only happens every single freaking day on every project I've ever been on. Heck, I have missed opportunities for re-use (and caused subtle side-effects through doing so) frequently when I was the only coder on the project.
At this point, it seems FB could benefit from a thorough third party security audit of their web technology.