logoalt Hacker News

Cyan488yesterday at 7:10 PM27 repliesview on HN

> "The tool itself worked properly and functioned as intended; however due to a bug in a separate code path, the system did not properly verify that the email address provided by the individual requesting a password reset matched the email address associated with that user’s Instagram account," said Meta in its breach notice.

I'm not sure "worked properly" and "as intended" accurately describe this situation.


Replies

vb-8448yesterday at 8:22 PM

In italian we say "l'operazione è riuscita perfettamente, ma il paziente è morto" -> "the surgery was a complete success, but the patient died"

show 4 replies
nkriscyesterday at 7:53 PM

The tool worked correctly and as intended, but due to a bug it did not work correctly nor as intended.

show 3 replies
nicoyesterday at 7:32 PM

That sounds a lot like the justifications Claude and ChatGPT give when confronted about something they did wrong, or when asked to provide a customer support response about software issues

show 1 reply
ChuckMcMyesterday at 10:21 PM

Read that as "worked as written" and "we disclaim any consequential or incidental damages and do not warrant this software."

I continue to believe we could fix a lot of things in the US if we updated the UCC[1] to disallow 'disclaiming liability on software used in a product.'

[1] Universal Commercial Code -- https://www.law.cornell.edu/ucc

show 1 reply
Cpollyesterday at 7:31 PM

The argument here is that the AI is a glorified input page. The input field asks for your username and email and sends it to a backend function. Such an input page is working as intended.

The problem is when the backend function doesn't verify that the email matches the username.

show 4 replies
RobRiverayesterday at 7:25 PM

Oh it was a downstream dependency. The tool worked, it was the downstream dependency. Glory to Arstotszka

show 1 reply
ludwikyesterday at 7:16 PM

I like to dunk on Meta as much as the next guy, but I think this makes sense: deterministic verification like this is not, and should never be, the LLM’s job. The tools it has access to should enforce the permissions layer, ensuring that the LLM can never perform actions the user themselves should not be allowed to perform. In this case, the tool failed to do that.

show 2 replies
ofjcihenyesterday at 7:16 PM

Maybe they’re communicating exactly what it sounds like and are just owning up to being complete morons?

warmedcookietoday at 3:10 AM

Having had my 2FA Facebook account banned 3 years ago because a bot signed up under my email for Instagram (which I did not have), I can confidently say the email verification issue has been a problem for a long time at Meta.

trumpdongtoday at 11:26 AM

They're saying: our AI worked perfectly, we just prompted it wrong.

As you do. All AI failures are caused by bad prompting because AIs are perfect.

Schlagbohrertoday at 12:35 PM

No no the tool worked fine, it was the system that failed. They blame society, basically.

totetsuyesterday at 7:45 PM

Then ‘ The tool itself’ was not appropriate to the job in the first place

laweijfmvoyesterday at 7:47 PM

so how long was the bug there? was there a way to access it before/without the support agent? it feels like Meta will throw anything under the bus to redirect blame from the AI, because that would be the end of their $600B (depending on “which number you want to go with”) experiment

stephenhueyyesterday at 10:40 PM

What was that mantra? Something about broken software is what they aim for?

teaearlgraycoldyesterday at 10:33 PM

> The tool itself worked properly and functioned as intended

The author of the post is close to the author of the AI code on the org chart

> however due to a bug in a separate code path, the system did not properly verify

The author of the post is far from the author of this "code path" on the org chart

az226yesterday at 11:16 PM

I'm sure. It was not working properly nor as intended.

tyleotoday at 12:47 AM

Error: Success!

xysttoday at 3:33 AM

It’s a public release prepped/reviewed by the in house legal counsel.

Don’t read too much into it. Facebook wants to face as little accountability and keep the future class action lawsuit to a minimum.

photochemsyntoday at 1:37 AM

Our autonomous client-assistance system is managed by a teenager that usually makes good decisions but sometimes makes bad decisions and so all the teenager’s decisions are checked by a minder before being implemented. Unfortunately the minder wasn’t paying attention, so, here we are. However, our teenager is a great kid and did nothing wrong! It’s all the minder’s fault.

P.S. Would you like to have our teenager manage your system too? Terms are reasonable! Of course you accept all liability, so better get a good minder - and no, don’t use an AI as the minder, that just introduces a new failure mode.

tomkarhoyesterday at 8:13 PM

How very Wernher von Braun of them.

saltyoldmanyesterday at 9:15 PM

Isn't that exactly what they said when Cambridge Analytics data gathering happened?

hsbauauvhabzbtoday at 2:11 AM

‘Hey Claude, write me a PR statement’

cynicalsecurityyesterday at 10:08 PM

This-is-fine.jpg

TZubiriyesterday at 8:21 PM

Of course.

What I gather is that this internal tool was used by human support agents, and it was their responsibility to verify the email adresses and general validity of a claim.

But when implementing AGI TM that was overseen, maybe the oversight in the separate code path was a 'bug', but the mistake was making the chatbot obviously, if the separate code path had a bug, then it had become ossified into a feature, and it was internal, not exposed to the public.

This is an external communication, to save face sure, but if this is the internal excuse, it would be absolutely the wrong RCA and it reads as if the one who made the mistake is not admitting they made their mistake. Which to be honest, just making the mistake is enough to get fired, but not admitting it is enough to get ultra fired.

dborehamyesterday at 10:38 PM

There should have been a test case for this. There wasn't because most shops don't actually test their product. They do some test theater such as unit testing.