Hacker News Reader

Comment by hublott | Hacker News Reader

Response from FB: "Why We Disagree with the NYT" https://newsroom.fb.com/news/2018/06/why-we-disagree-with-th...

Agree with FB on this one. The privacy issue with 3rd party developers was that friend data was sent to the 3rd party developer databases. Here, the data just stays on the device.

The way the article is titled can make it look like the device makers actually got to make their own database of Facebook users.

Edit: I read it again, the article does say "Facebook acknowledged that some partners did store users’ data — including friends’ data — on their own servers," but they don't follow up on that at all, they go back to messing with a BlackBerry. That's the big question.

Once an app has particular data, there is nothing FB can do to prevent it from uploading that data wherever. It would be difficult for Google or Apple to prevent that, and they control the platform. With enough apps, it is a certainty that this happened.

Have you heard of the power of legally enforceable contracts? Lots of things aren't technically impossible but are forbidden by the law or by a contract. It's one of the ways modern societies function, check it out!

Have you heard of the power of contracts that have never actually been to court. It turns out many of them aren't legally enforceable. It's one of the ways modern society is dysfunctional. Check it out: http://www.ycombinator.com/legal/

How many firms have FB sued for breach of this hypothetical contract? Other than "Cambridge Analytica", can you think of one they might sue?

The NYT article is definitely overblown. It’s popular to hate on Facebook about privacy, and yeah, they’ve made mistakes in the past, but that’s largely because they’re just engineers trying their best to do the right thing. IMO they need more non-engineer types to inform them what “the right thing” actually is, when it doesn’t align with the typical attitude of “Oh, there’s a technical solution to this problem!”

> the BlackBerry app had access to all of the reporter’s Facebook friends and, for most of them, returned information such as user ID, birthday, work and education history and whether they were currently online.

User ID and birthday are both public information, and people typically share work and education history as public (or at least “networks” thereof, for finding friends). AFAIK online status is the only thing that’s usually friends-only, but perfectly reasonable to share with a device messaging app.

Also from the article:

Some device partners can retrieve Facebook users’ relationship status, religion, political leaning and upcoming events, among other data.

Are those public?

Also, is it the data belonging to the user of the device and the Facebook account the device is logged into?

"Facebook integration on device OS allows viewing user's own profile after logging in to account" doesn't seem that shocking.

I generally agree with you that this piece is a bit sensationalistic but...

> [...] they’re just engineers trying their best to do the right thing.

What makes you say that? Beyond potential abuses of data by third parties (or whatever), I would expect that most FB employees are trying their best to get paid. Whether or not all or any single one of them cares about “the right thing” is mostly unknown to outsiders. I have always assumed, based on FB’s overall business model, that there is a general disregard for any particular interpretation of “the right thing” at least when it comes to the privacy of the platform’s users.

I worked there in the past. Everyone I met was earnestly trying to do good work and afraid of getting fired or sued for doing something that would impact privacy and thereby FB’s bottom line. Facebook is strongly incentivised to protect user data because that is their primary market advantage—having ad targeting data that other ad networks don’t. Leaks and breaches of trust are bad for business and bad for the RSUs that employees and acquirees are given.

There is a huge distance between "Doing the right thing" and "doing one's best to avoid getting sued". There are lots of things that are legal but frowned upon in a decent society.

And no, Facebook is not "just engineers <...>". There are lots of other positions who make high-level decisions, e.g. decide how the company is going to make money.

"We are not aware of any abuse by these companies." - seems to be carefully worded. They do not make claims that there are no abuses, nor do they elaborate what checks/audits they have in place to detect abuse.

Yeah - try reading between the lines since FB's response is not in line with your confirmation bias against them.

I was trying to read the article critically, but am open to alternate parsings / viewpoints on the article. Would love to hear your thoughts on the subject matter of the article.

> They do not make claims that there are no abuses

How can any honest people make such claim? It is the same as proving the non-existence of abuses.

I think point of above is more that it's in their interests to make sure they never do any checks, so no doubt they never do any.

They could probably catch 99% of abuses by just specifying it in the contract with the 3rd party, but they have't done that.

How do you know that they didn't already catch 99% of the abuses, but it's just that 99% is still zero?

What I apprehended from the article is that those API's still exist, and even still work in full.

Meaning that today it is still possible to generate an access_token using a client_id extracted from an old blackberry device with a valid facebook account and extract much more data (using the private device API's) than what that user should be allowed to see.

Do I understand that correctly? Because that seems like an enormous security breach.

Disagreement lies in there, fb says devices access as much as fb app access, NYT claims otherwise but probably wrong

Reply on news.ycombinator.com