I’ve been trying to avoid writing random stories just for the sake of it. I want these pieces to have a real point, but the posts I’ve been sharing about my time at Facebook have been getting a lot of attention, so I’m going to tell a classic one. This is the story of how I forced the CEO, the CTO, and the COO of Facebook into a meeting with me within forty-eight hours of writing a line of code. Yes, that means Mark Zuckerberg, Mike Schroepfer, and Sheryl Sandberg in one room, reacting to a single engineer who refused to take no for an answer.
At the time, I was working on Facebook Groups. The team was tiny—only about three engineers, and I don’t even think we had a product manager yet. It was one of those rare products that somehow had hundreds of millions of monthly active users but still lived slightly under the corporate radar. There was infinite room to try weird things, and because the team was so small, your personal leverage was massive.
We were in a feature meeting with Schrep (Mike Schroepfer, our CTO) and maybe our manager, talking about what to build next. Mark Zuckerberg was highly involved with our team, and I’m pretty sure it was him who floated the idea of letting people upload regular files into Groups. Up to that point, Facebook only knew how to handle text, photos, and videos. There was no way to upload a generic binary. We started talking about use cases: maybe a closed family group wants to share a PDF of a travel itinerary, or a dad needs to upload a PDF of a receipt. Things you’d only ever want to show people inside a locked room.
The room immediately treated this like a massive, months-long corporate initiative. It would need scoping, staffing, cross-team reviews, and a long timeline.
I sat there and said: “Today is Friday and I’m gonna build this by Monday.”
Schrep literally laughed out loud—like hysterically. It wasn’t a polite chuckle. It was the look you give a kid who says they’re going to build a rocket ship in their backyard before dinner.
As soon as the meeting ended, I walked back to my desk, opened up internal chat, and wrote a direct message to Mark Zuckerberg. I told him: “Look, I’m going to build this by Monday.” I think Mark actually believed me—or at least, he’d seen me ship fast enough to know it was possible—but he was still skeptical.
But here’s the thing: when you have two people of great influence and power at the company, who think you’re joking, that is the most motivation I could get to prove them all wrong.
I didn’t start from scratch over the weekend, but I didn’t have a clean, ready-to-use pipeline either. I had to glue together systems that were never really meant to talk to each other.
Before Groups, I had worked on the internal tools team. In internal tools, we had to upload files all the time—tasks, support tickets, marketing assets, ads. We had a basic internal file storage abstraction that saved files into a simple internal bucket. I knew this code inside and out because I’d built on it, but that bucket was built to handle traffic for a few thousand employees, not hundreds of millions of users. It would have crumpled in seconds.
For production scale, we had “Haystack.” Haystack was our magic, custom-built cloud storage system—Facebook’s equivalent of Amazon S3 or Dropbox—built specifically to distribute billions of photo files instantly across the globe. It was highly optimized, but it was designed for image files, not arbitrary binaries.
So I basically said: what if we allocate one of these Haystack magic buckets to just be a generic file store? I went to the infrastructure team to get a quick, informal sign-off. I wasn’t going to deploy new servers myself, but I asked them to bless the idea.
With that bucket secured, I wrote a new generic file upload abstraction. Rather than have every different corner of Facebook write its own proprietary API to store a pointer to a file, I built a generic “file object.” This file object didn’t just hold the file itself; it held the generic handle, the metadata, and most importantly, its own permission checks.
It was beautifully abstracted. The file object knew how to determine its own visibility based on where it was plugged in. If a file was connected to a Group, it would check the visibility settings of that specific Group. If it was attached to a user profile, it would check that profile. If it was linked to an individual post, it would check the privacy settings of that post.
The last missing piece—and I won’t go into all the technical details—was that we needed a way to sign our URLs for this custom Haystack storage. If a user uploaded a private document to a secret group, we couldn’t have the CDN serve a raw URL that anyone could share. The server had to sign the URL on the fly, so if someone tried to scrape or share the raw CDN address, they’d get blocked if their active session didn’t match the file’s permission context.
Then came the UI. I had to integrate this directly into the “composer”—the box where you type how you’re feeling today. I had to build file-upload progress indicators, size-limit checks, and file-type restriction UI. Today, AI would generate those frontend components in seconds, but back then, navigating our massive codebase and custom JS framework to inject files cleanly into the composer was tedious, manual work. I worked straight through Saturday and Sunday, gluing UI code to CDN signing logic, making sure the object validated itself at every step.
On Monday morning, I walked in and pulled up a demo of the file uploader working inside a live Group. Mark Zuckerberg was sitting there, and when it actually rendered as a downloadable object in the feed, he applauded—if I remember correctly.
Schrep looked at it, stunned, and asked, “When are we going to ship this?”
I could tell he was expecting me to say we needed a couple of weeks to polish the edge cases, write test suites, and schedule the release.
I said, “Let’s just ship it tomorrow.”
Schrep frowned. “I don’t think so. But let me ask around.”
The next day I opened my laptop and saw a calendar invite that made my stomach drop. It was a meeting with Mark Zuckerberg, Sheryl Sandberg, and me. No one else. No manager, no director, no PM. I knew I wasn’t in trouble, and I knew this was about the file uploads, but I had never actually had a meeting with Sheryl before, let alone a meeting with Sheryl and Mark at the same time.
I walked into the room, and Sheryl was the dominant player. She was extremely concerned. She spent her days managing our relationships with our massive advertising partners, which included all the major music labels. She did not want the labels thinking we were building a private music-sharing service inside Facebook Groups—private spaces no one could get visibility into, where people could share music without any repercussions. Maybe things are different now, but back then that sounded a lot like Napster and the various services that got shut down. She was a bit freaking out. She also pointed out the security exploits, malware, and illegal files people would start throwing onto our servers the second we opened the floodgates.
I listened to all of this, but in my head all I could think was: but I really want to launch this tomorrow.
And then everyone’s like no and I’m like yes, we’re gonna figure this out. When they told me no, I didn’t see it as a final product decision. I saw it as a list of engineering requirements.
I walked straight out of that room and tracked down the Site Integrity team—the engineers responsible for keeping the platform safe. They already had an old-school machine learning pipeline that flagged photo uploads for manual human review. I realized we could quickly adapt that system for files to give us some immediate guardrails. I also found out they had a third-party music fingerprinting service integrated elsewhere on the platform. We worked flat-out to hook my file-upload engine directly into that fingerprinting API.
I brought the solution back. We would run every upload through the automated integrity system, and for the initial launch we’d simply block any file type that looked like a music format and let everything else through. Sheryl was fine with that compromise. We shipped the feature.
Looking back, this story sounds insane. Facebook had about 10,000 employees at the time. It was not a scrappy garage startup. Yet here I was, basically telling the executives when I wanted to launch this thing, telling them I wanted it in days, getting told no, and not letting them. I genuinely don’t think there’s anything special about me—or anything special about the code I wrote that weekend. There was nothing intellectually revolutionary about it. It was a lot of glue between things that already existed: pattern matching, reusing the internal storage blocks, reusing Haystack, and negotiating directly with the infrastructure, site integrity, and release teams so they wouldn’t freak out when we pushed the deploy button.
What made it possible was a culture of ownership.
And this wasn’t superficial. It wasn’t people trying to get political points on a performance review. It was literally: if you own something you take full responsibility for every aspect of it, no excuses, no blaming. No “I didn’t know about this.” No “the servers crashed, let me ask another team to fix it for me.” If you truly owned something, then no one at Facebook would say no—even if your idea was terrible, even if it didn’t work—because you were the person carrying the weight of the consequences.
This environment empowered very young engineers, straight out of college, to swing for the fences. It’s the same culture that let junior teams build React and GraphQL—not because a manager handed down a spec sheet, but because they saw a problem, owned it completely, and grew it because they had the authority to do so.
But I’ve been sitting here turning over a question.
Can this kind of engineering sovereignty survive anymore? We are entering a world where we increasingly outsource our glue-work to machines. We use AI models to generate the frontend components, write the type checks, and construct the APIs. But if the code is generated by things that have no concept of responsibility, who actually owns the resulting system?
If an engineer doesn’t sweat through the weekend gluing the raw UI to the CDN signing logic, will they have the courage to stand in front of the COO and CEO of a major company and argue for a launch? Or does outsourcing the tedious, manual glue-work also accidentally rip out the human ownership that makes engineers brave enough to defy their own leadership?
I don’t have a clean answer for this. I don’t know if we’ve traded our engineering agency for speed, or if we’re just building a different kind of rocket ship. I don’t know if it’s a good thing or a bad thing—it’s just very interesting to me. I want to write more about whether this same spirit can, or should, apply to the world we live in now, because things have clearly changed, and I’m still trying to figure out what we lost along the way.