Wow, I've just lost a great deal of respect for the programming skills of Facebook and its employees. This is really obvious stuff. I can understand a junior programmer missing something like this (or a non-junior one, everyone makes stupid mistakes sometimes) but surely someone should be checking?
I've just set up a similar system (non-public media served from a faster server without access checking) and the fact that the urls needed to be non-guessable was pretty damn obvious. The timeout thing is also really really obvious if you don't want people to be able to pass around a permanent link.
Whn I interviewed at Facebook I was kind of thrown back by the lack of engineering discipline. If I remember the quote accurately (this was about 1.5 years ago), they averaged 1 hour of downtime per subdomain (i.e. <college>.facebook.com) per week, which may or may not effect all users associated with that domain. To make scaling issues easier, race conditions are also all over. There is no data integrity of any sort. Some/all of these design decisions I could see being justified, because it is afterall just social profiles... but I was a little surprised. The weird thing is they release some really cool open source stuff and have some pretty great engineers there, so I'm not sure where this stems from.
Comments
Wow, I've just lost a great deal of respect for the programming skills of Facebook and its employees. This is really obvious stuff. I can understand a junior programmer missing something like this (or a non-junior one, everyone makes stupid mistakes sometimes) but surely someone should be checking?
I've just set up a similar system (non-public media served from a faster server without access checking) and the fact that the urls needed to be non-guessable was pretty damn obvious. The timeout thing is also really really obvious if you don't want people to be able to pass around a permanent link.
Whn I interviewed at Facebook I was kind of thrown back by the lack of engineering discipline. If I remember the quote accurately (this was about 1.5 years ago), they averaged 1 hour of downtime per subdomain (i.e. <college>.facebook.com) per week, which may or may not effect all users associated with that domain. To make scaling issues easier, race conditions are also all over. There is no data integrity of any sort. Some/all of these design decisions I could see being justified, because it is afterall just social profiles... but I was a little surprised. The weird thing is they release some really cool open source stuff and have some pretty great engineers there, so I'm not sure where this stems from.