Facebook's New Policies Make Harassment Easy
readwriteweb.com
readwriteweb.com
They're playing with fire and they will get burned.
It is unclear to me which "new" policies they are referring to in this article: (a) Pages you fanned have always been public. (b) The "Religious Views" and "Political Views" fields on your profile were not included in the conversion to Page connections, explicitly to avoid this sort of thing. (c) I'm also not sure how they decided that profiles were being automatically deactivated based on reports. (d) The article doesn't really clarify how these "targets" are being identified -- that seems somewhat important to decide whether Facebook's "new" policies are making harassment easy...
Separately, while it is true that you can be seen on the Fans section of a Page, the chances that this will happen are pretty small- try this Page: http://www.facebook.com/pages/The-Lord-of-the-Rings-film-tri... . I believe the six or so images of non-friends are random each time.
The chances are small, but there is a chance as demonstrated in the article. Consider this profile (random, and I'm not connected to him) http://www.facebook.com/profile.php?id=1189567657 where all his profile info is public and linked to "pages". It wasn't the case earlier.
I'm not convinced that the article demonstrates anything yet -- it doesn't really explain how this targeting was done, just vaguely claims this is because of some "new" changes in connections privacy. My whole point is that there isn't anything new about the way Page connections behave.
What is new, as you said above, is that the plain text boxes where users put in their favorite movies etc, are now links to Pages. Previously, these movie strings were actually links to a search for users who mentioned the same text. What has changed is the target of this link -- it is now a Page instead of a search result. And as before, you can still control the visibility of these boxes on your Profile.
Sorry, nothing personal against you, but then that is the same line taken by the upper management in FB who say that there is no real loss of privacy. And yet, I ask you to just do a time bound google search/YC search and you will see HOW many people are raising concerns with FB's recent changes. And this hasn't even gone to instant personalization yet or the forced opt out instead of opt in (I'd really like if you actually addressed this opt out policy if you choose to respond to this comment)
<i>And as before, you can still control the visibility of these boxes on your Profile</i>
Please tell me how? The privacy options themselves have become so convoluted that I am not sure if it is set as I desired. And I have no way to check it as well. You know why? Cos my profile URL shows a 404 if I'm not logged in to FB. Check it out: http://www.facebook.com/anantj - Try with your logged in browser and another which you've never used to login to FB.
Why is it that I can't have free form text at all? Why _must_ it be linked to pages? At least give me an option to prevent that for movies, tv, religion etc
If you're interested in seeing if your settings are working, you can try the "Preview my profile" button on that page.
Btw, I found that page under top right Account->Privacy.
- I wasn't involved enough with the Instant Personalization product to be comment on it competently.
- As for criticism, you can be sure we're watching very closely. IMO, much of it is because people don't really understand the changes or what is affected (as you point out, this stuff is insanely complicated, and we need to do a lot better at explaining and clarifying it to people).
- You can absolutely have free form text. The "Bio" field on your profile is free form.
Why can't you have it in the "Favorite blah" boxes?
(a) Users simply used Pages to do this a lot more than they used the free form text. That stuff was edited once, and it wasn't convenient to maintain as your likes and dislikes changed.
(b) We think there is significant utility that we can provide to the user from having this information in a structured format. Instant personalization aside, going to Pandora and hearing your favorite music play is pretty cool. We think we can do a lot more here.
Religion is already not in this set -- it was not included in the Connections change recently.
Also, not sure if you have read but this is not good either: http://www.readwriteweb.com/archives/facebooks_high_pressure...
Don't you think that is a little misleading? You provide users with a privacy control that in reality doesn't do what you say it does. You are tricking people into thinking that they have control over visibility and then you go and share that with anyone. Who cares if the connections that are shown are selected randomly? It doesn't change the fact that you ignore the privacy control that you have supposedly given your users. I think that's what bothers people. If you don't think people would care, maybe you should put a warning on the privacy settings that says it only applies to your profile.
You've created publicly accessible aggregations of members expressing interest in a potentially limitless set of categories (whatever you may choose to call them). You've taken previously private profile information and pre-emptively linked it to these public categories. Even where some of this information was previously publicly visible, it wasn't so conveniently publicly indexed; someone would have to visit individual profiles in order to turn it up.
By the way, religious and political views do not only express themselves in the fields you mention. What disrespectful soul there decided to take my "Favorite Quotes", with access previously restricted to "Only Friends", and plaster them -- without so much as a warning -- all over my public profile?
I've been pretty cautious, and there was nothing very incendiary or damaging in them, but it still caught me out.
For me, it was the last straw. I hope FB, or at least its current Management and, ahem, "policies", follows MySpace into a death spiral, taking their accumulated financial equity with them before they have a chance to cash out.
I hope HN will pardon a bit of unusual vehemence from me, but Facebook has come to be, simply stated, slimy. I guess I write this comment in the vague hope some fraction of the message might get through whatever reality distortion field they're currently running in-house.
Finally, as a few commentors have started to point out, as Facebook continues to publicize their members' data, those members more and more tightly control their expression. The result is that the site continues to become blander and blander, less and less "personal". There's only so long people will continue to find novelty and interest in generic updates.
Control over privacy. Personal expression. What brand-building feature are you going to kill off, next?
I remember when "everyone" was on AIM. Even if you preferred another platform, you used AIM because that's where the bulk of the general (U.S.) population was, for IM; they'd "won" the IM platform war. I don't think I've even signed on to the thing in a year or more.
A lesson for any "winner".
P.S. As for fanning being public, it used to be someone would have to seek your ID out on those different fan pages. Then, around the end of the year, Facebook decided to (pre-emptively, again) display that information in aggregate for each user on their public profile. Maybe googling might have exposed some or all of it previously, but you sure made it a lot more convenient. (E.g. for that HR staffer looking for a quick means to winnow a stack of resumes.) And I'm not even addressing the publication of everyone's friends, etc.
If you've read this far, thanks for taking the time to consider my response. It's not meant to be personal. (Well, except against those setting these policies at Facebook. Even then, it's the policies that elicit the response; the people I don't know personally.) It's strongly phrased to emphasize the points, and the frustration they cause.
Previously, the text in these boxes was a link to a search result for users who mentioned this text. Now it is a link to a Page where a small, random set of the users who mentioned the text are displayed. You can still control the visibility of these links on your profile. You'd still have to either visit a lot of users' profiles (and they'd have to have set their interests to be visible), or you'd have to reload a Page a lot of times.
(As for "Favorite Quotes", I will look into what is going on with it).
Thank you for your detailed feedback, btw.
Is the following definition of "visibility" accurate in your context?
http://www.eff.org/deeplinks/2010/04/handy-facebook-english-...
"As Facebook explains, "Keep in mind that Facebook Pages you connect to are public. You can control which friends are able to see connections listed on your profile, but you may still show up on Pages you're connected to." Likewise, "While you do have the option to hide your Friend List from being visible on your profile, it will be available to applications you use and websites you connect with using Facebook." Because Facebook deems this information "public," it reserves the right to share that information with its business partners and third party websites, regardless of your visibility settings. "
"regardless of your visibility settings."
Isn't that completely backwards from what people would want from a social site? If my understanding of this issue is correct (and I confess, I haven't been able to hold FB's privacy policy and settings regime in my head for some time), then this would be like hiding my street address from my friends but broadcasting my address to junk mail companies with a hearty "Catalogs? Send 'em here!"
Separately, I'll mention the following just in case it is of any interest or use.
Last night shortly before 11 pm Pacific time, I "fell" into what appeared to be the public view for a profile named "Everyone". My memory's hazy, but I believe this happened as the page flow returned to me when I was backing out of the privacy feature/page that allows one to view one's profile as it appears publicly. I backed out by clicking the button "Return..." dedicated to that purpose on that page.
I'm not certain this is how the flow occurred, but it seems to be what I remember. If it's not the precise flow, it happened somewhere in the flow I used to view my publicly visible profile.
If this is a concern, I can provide you a bit more in the way of details, out-of-band. (I doubt it would be the case, but in case this exposed some test or "magic" ID (the ID does look unusually long).) I just browser back buttoned to a former page and clicked "Home" or whatever to resume what I was doing.
This.
[1] https://www.eff.org/deeplinks/2010/04/handy-facebook-english...
[Where there are valid criticisms, you can be sure we're taking them very seriously.]
If Facebook cares about protecting the data of their users, making the privacy settings more intuitive would be more productive than worrying about needing to "educate" users. This includes having default options that hide data instead of making it public.
The information is being exposed, not because of confusion, but because Facebook wants the information exposed (to business partners and affiliates). The confusion leads to surprise, not exposure.
"making the privacy settings more intuitive would be more productive than worrying about needing to "educate" users."
This was exactly my thought earlier in the thread. If it's this hard to understand and explain, there's some simplification yet to be done.
But my claim is (a) for a site like Facebook to work "well" [where we can argue ad infinitum what "well" means], some information needs to be shared in the system, and some needs to be private. (b) this is often different for different groups of people. You now have to implement a privacy system that works for every piece of content, for every set of users that I want to define a setting for. I think you'll quickly come to something fairly complicated. There are very smart people trying to come up with abstractions and interfaces that make this easy to do, but I fear that at the end of the day, users are simply going to have to learn some new tricks if they don't want to be surprised. And that means, we have to figure out how to explain this complex system to them.
come from a poor understanding of the privacy policies, the motivations and the implications
What are the motivations? The key, primary, and focal motivations behind all of these changes?
The most important thing is that although we started as a very simple profile-plus-friends social network, there are now a very large number of people connected in this manner.
We have the opportunity for the first time to really let a user define their identity in one place [their relationships to real people and entities in the real world, their likes and dislikes], and shape the content on the web around that identity.
We have the ability to share that opportunity with smart hackers everywhere -- but we obviously cannot just willy-nilly hand over the data to anyone. We need to define a usable API, a set of acceptable practices, a way to enforce these things so we respect the user's trust without completely destroying the app developer's ability to do something useful.
This is really hard. We're slowly finding our way to doing this well, but there are many unforeseen issues, especially because app developers have a lot of money at stake. We're iterating on our API, trying to change up the constraints on developers.
At the same time, several cool applications wouldn't be possible if everyone were to keep everything private from everyone -- you have to be social to some extent on a social network if you are to derive any value from it. So we're trying to get people using this complicated privacy interface where you can control publicness/privateness at a very fine grained level, but you need to understand many things to do this correctly.
We're also trying to set things up so that you can hide things as you want from the real people who might judge you for it or whatever, but at the same time, you can get functionality related to that interest from some application [for example, you may not want to tell your friends you like Britney Spears, but Pandora should still be able to play you Britney Spears and similar music].
There's a whole other dimension related to the Open Graph stuff -- building a "semantic web", having one graph where users and entities are connected and organized in a way that can be leveraged to do all these cool things that the web originally promised but hasn't been able to deliver.
There are tremendous engineering challenges to putting all this together.
As you can see, this is a lot of balls to be juggling. Our philosophy has always been to iterate quickly, correct missteps just as quickly, and not be afraid to innovate.
There are a few things I'm pretty confident we don't ever want to do-- the first of which is that we don't want to ever sell user data. That would be an incredibly stupid business decision for a company that wants to help you manage your identity on the web, and we recognize better than anybody that users need to trust us.
I think I've gone on long enough-- I'm not sure I actually answered your specific question. Hopefully my blathering was useful to give you some feel for our motivations though. If you want to learn more, you can listen to some of the talks here: http://apps.facebook.com/feightlive/ . I recommend the closing remarks by Chris Cox.
1. New features are rolled out without advance notice and without prior explanation of their privacy implications.
2. The privacy policy changes without advance notice, often towards ensuring less privacy.
3. Features that expose more personal information are frequently enabled by default (opt-out rather than opt-in).
4. With instant personalization, social plugins, and the 'likes' feature, FB has switched to making no distinction between 'public if you look for it' and 'publicly broadcast'.
5. These features also indicate that FB has started tracking users browsing habits across the web. It's not enough to know everything about a person's social life, FB wants to know as much as it can about their private life, too.
6. FB asks to inspect user's email address books while suing a company that uses the same basic technique to manage FB profiles on the user's behalf. This is staggeringly hypocritical.
7. That same Friend Finder feature does not explain what gets pulled from your email account, and it does not adequately explain that those email addresses are stored and may be used not only to help that user connect with people who already have FB accounts. It does not explain that FB treats the information it pulls from email accounts as a shadow social graph.
8. There is no easy way to export user data.
9. The privacy settings are lengthy and confusing, and there's no simple way to restrict everything in one go. To ensure your privacy, you literally have to wade through page after page, and you have to do so on a relatively frequent basis as new features can undo your work (see #1,2,3).