Yesterday I did something dumb, and I only realized it today because I don’t trust an easy success. Let’s see if you can spot the flaw in my reasoning:

Background:

• A process (X) is run on a series of items in a queue.
• Items are added to the queue continuously, about 500 per hour.
• A processor (Z) is started once an hour. It performs X on all the items in the queue, then quits once the queue is empty.
• If there are any errors, the processor emails them to me after it quits.

The problem:

1. I noticed 100 random failures in process X each hour.
2. I hypothesized that X is failing due to intermittent system unavailability.
3. I checked the hypothesis by looking for clusters of X failures at times of high load. (There were.)
4. I “fixed” it by pausing the Z processor for 60 seconds whenever there’s a failure (to let system resources recover).
5. 12 hours after the fix, I got no failure emails and declared victory.
6. Not so fast: Not only did I not fix the problem, I caused something worse.

Can you figure out what I did wrong? Continue reading →

Starting today, I’m going to remove all my personal information from Facebook and “unfriend” everyone. I’m responding to a pair of status messages that appeared on my profile over the last few weeks, though I didn’t put them there. (John calls them “phantom status messages.”)

According to the site itself, the messages were both submitted “via Text Message”, which is odd because I haven’t authorized the Facebook Texts service. I submitted a bug report to Facebook Support, but so far they’ve done nothing aside from ask me to resubmit my request if I’m “still experiencing security issues.”

Just to be clear:

• My account hasn’t been “hacked”. I changed my password as soon as the first phantom status appeared, and that didn’t stop the second message two weeks later. Since the phantom messages came from the Facebook Texts service, they didn’t require my authentication anyway.
• My computer doesn’t have a virus. (If you know me at all, you’re chuckling at the idea.) Even if by some magical circumstance it did, the virus would have to send Facebook a text message somehow, and they’d still have to accept it.

That leaves two possibilities that I can see:

1. It’s a bug. Some bit of Facebook code is misrouting another user’s text messages to my profile by accident.
2. It’s a security exploit. A malicious user is exploiting some crack in Facebook’s text-message-handling code to drop messages in other users’ accounts. This is less likely, but not impossible; it would probably start with innocuous messages to test the exploit.

Either way, I no longer trust my Facebook account. The phantom messages have been benign so far, but all it would take is one generic hurtful statement to become a real nightmare. (Not to mention what this implies about Facebook’s security in general.)

I still plan to keep the account itself open, because I need it for work (to develop Facebook apps) and for space advocacy (as a page admin). I just won’t be posting to it, and it won’t be “friends” with anyone. I’ll miss the easy keeping-in-touch it provides, but that’s not worth the potential hassle.