> "The tool itself worked properly and functioned as intended; however due to a bug in a separate code path, the system did not properly verify that the email address provided by the individual requesting a password reset matched the email address associated with that user’s Instagram account," said Meta in its breach notice.
I'm not sure "worked properly" and "as intended" accurately describe this situation.
Error: Success!
Read that as "worked as written" and "we disclaim any consequential or incidental damages and do not warrant this software."
I continue to believe we could fix a lot of things in the US if we updated the UCC[1] to disallow 'disclaiming liability on software used in a product.'
[1] Universal Commercial Code -- https://www.law.cornell.edu/ucc
The tool worked correctly and as intended, but due to a bug it did not work correctly nor as intended.
That sounds a lot like the justifications Claude and ChatGPT give when confronted about something they did wrong, or when asked to provide a customer support response about software issues
The argument here is that the AI is a glorified input page. The input field asks for your username and email and sends it to a backend function. Such an input page is working as intended.
The problem is when the backend function doesn't verify that the email matches the username.
Oh it was a downstream dependency. The tool worked, it was the downstream dependency. Glory to Arstotszka
Maybe they’re communicating exactly what it sounds like and are just owning up to being complete morons?
I'm sure. It was not working properly nor as intended.
I like to dunk on Meta as much as the next guy, but I think this makes sense: deterministic verification like this is not, and should never be, the LLM’s job. The tools it has access to should enforce the permissions layer, ensuring that the LLM can never perform actions the user themselves should not be allowed to perform. In this case, the tool failed to do that.
What was that mantra? Something about broken software is what they aim for?
> The tool itself worked properly and functioned as intended
The author of the post is close to the author of the AI code on the org chart
> however due to a bug in a separate code path, the system did not properly verify
The author of the post is far from the author of this "code path" on the org chart
Then ‘ The tool itself’ was not appropriate to the job in the first place
so how long was the bug there? was there a way to access it before/without the support agent? it feels like Meta will throw anything under the bus to redirect blame from the AI, because that would be the end of their $600B (depending on “which number you want to go with”) experiment
How very Wernher von Braun of them.
There should have been a test case for this. There wasn't because most shops don't actually test their product. They do some test theater such as unit testing.
This-is-fine.jpg
Isn't that exactly what they said when Cambridge Analytics data gathering happened?
Of course.
What I gather is that this internal tool was used by human support agents, and it was their responsibility to verify the email adresses and general validity of a claim.
But when implementing AGI TM that was overseen, maybe the oversight in the separate code path was a 'bug', but the mistake was making the chatbot obviously, if the separate code path had a bug, then it had become ossified into a feature, and it was internal, not exposed to the public.
This is an external communication, to save face sure, but if this is the internal excuse, it would be absolutely the wrong RCA and it reads as if the one who made the mistake is not admitting they made their mistake. Which to be honest, just making the mistake is enough to get fired, but not admitting it is enough to get ultra fired.
In italian we say "l'operazione è riuscita perfettamente, ma il paziente è morto" -> "the surgery was a complete success, but the patient died"