logoalt Hacker News

Cyan488yesterday at 7:10 PM20 repliesview on HN

> "The tool itself worked properly and functioned as intended; however due to a bug in a separate code path, the system did not properly verify that the email address provided by the individual requesting a password reset matched the email address associated with that user’s Instagram account," said Meta in its breach notice.

I'm not sure "worked properly" and "as intended" accurately describe this situation.


Replies

vb-8448yesterday at 8:22 PM

In italian we say "l'operazione è riuscita perfettamente, ma il paziente è morto" -> "the surgery was a complete success, but the patient died"

show 4 replies
tyleotoday at 12:47 AM

Error: Success!

ChuckMcMyesterday at 10:21 PM

Read that as "worked as written" and "we disclaim any consequential or incidental damages and do not warrant this software."

I continue to believe we could fix a lot of things in the US if we updated the UCC[1] to disallow 'disclaiming liability on software used in a product.'

[1] Universal Commercial Code -- https://www.law.cornell.edu/ucc

show 1 reply
nkriscyesterday at 7:53 PM

The tool worked correctly and as intended, but due to a bug it did not work correctly nor as intended.

show 3 replies
nicoyesterday at 7:32 PM

That sounds a lot like the justifications Claude and ChatGPT give when confronted about something they did wrong, or when asked to provide a customer support response about software issues

show 1 reply
Cpollyesterday at 7:31 PM

The argument here is that the AI is a glorified input page. The input field asks for your username and email and sends it to a backend function. Such an input page is working as intended.

The problem is when the backend function doesn't verify that the email matches the username.

show 4 replies
RobRiverayesterday at 7:25 PM

Oh it was a downstream dependency. The tool worked, it was the downstream dependency. Glory to Arstotszka

show 1 reply
ofjcihenyesterday at 7:16 PM

Maybe they’re communicating exactly what it sounds like and are just owning up to being complete morons?

az226yesterday at 11:16 PM

I'm sure. It was not working properly nor as intended.

ludwikyesterday at 7:16 PM

I like to dunk on Meta as much as the next guy, but I think this makes sense: deterministic verification like this is not, and should never be, the LLM’s job. The tools it has access to should enforce the permissions layer, ensuring that the LLM can never perform actions the user themselves should not be allowed to perform. In this case, the tool failed to do that.

show 2 replies
stephenhueyyesterday at 10:40 PM

What was that mantra? Something about broken software is what they aim for?

teaearlgraycoldyesterday at 10:33 PM

> The tool itself worked properly and functioned as intended

The author of the post is close to the author of the AI code on the org chart

> however due to a bug in a separate code path, the system did not properly verify

The author of the post is far from the author of this "code path" on the org chart

totetsuyesterday at 7:45 PM

Then ‘ The tool itself’ was not appropriate to the job in the first place

laweijfmvoyesterday at 7:47 PM

so how long was the bug there? was there a way to access it before/without the support agent? it feels like Meta will throw anything under the bus to redirect blame from the AI, because that would be the end of their $600B (depending on “which number you want to go with”) experiment

tomkarhoyesterday at 8:13 PM

How very Wernher von Braun of them.

dborehamyesterday at 10:38 PM

There should have been a test case for this. There wasn't because most shops don't actually test their product. They do some test theater such as unit testing.

cynicalsecurityyesterday at 10:08 PM

This-is-fine.jpg

saltyoldmanyesterday at 9:15 PM

Isn't that exactly what they said when Cambridge Analytics data gathering happened?

TZubiriyesterday at 8:21 PM

Of course.

What I gather is that this internal tool was used by human support agents, and it was their responsibility to verify the email adresses and general validity of a claim.

But when implementing AGI TM that was overseen, maybe the oversight in the separate code path was a 'bug', but the mistake was making the chatbot obviously, if the separate code path had a bug, then it had become ossified into a feature, and it was internal, not exposed to the public.

This is an external communication, to save face sure, but if this is the internal excuse, it would be absolutely the wrong RCA and it reads as if the one who made the mistake is not admitting they made their mistake. Which to be honest, just making the mistake is enough to get fired, but not admitting it is enough to get ultra fired.