Hacker News Reader

Comment by bo1024 | Hacker News Reader

I'm in the camp that this anger at Facebook is largely misdirected, even though I'm very privacy-oriented. It's very interesting seeing nontechnical reactions to this news.

As technical users, we all know that every layer of software down to the hardware potentially has access to the data flowing on top of it. If you're running X browser on Y operating system on Z device and you log in to Facebook, you've just trusted X, Y, and Z with your FB username, password, and data. (An API works the same.)

But nontechnical users are just now realizing this as privacy and data security become hot. They're lashing out at Facebook, but I think the scrutiny absolutely should be leveled at the software and hardware vendors. People should be asking phone companies: why can I trust your phone enough to type my facebook username/password into it?

An ideal outcome would be a huge push toward open source (and also toward free software), but that's probably too optimistic.

View on HN

> An ideal outcome would be a huge push toward open source (and also toward free software), but that's probably too optimistic.

Realistic outcome will be, unfortunately, companies playing all kinds of tricks to manage the perceived safety of their brand, combined with further locking down hardware and software stacks to reduce the attack surface.

>As technical users, we all know that every layer of software down to the hardware potentially has access to the data flowing on top of it.

Yeah, but that's a double sided sword. We're the only ones that have had to internalize the idea that incidental access to data will trying to monetize it as much as possible.

In the real world, there are huge expectation that incidental access to something _isn't_ license to do whatever you want with it. The standards of behavior everyone adheres to are almost always narrower than what the law allows. Regular people don't expect others to suddenly become the must ruthless motherfuckers possible just "because computers."

>An ideal outcome would be a huge push toward open source (and also toward free software)

how much does open source improve security? (And does it at all?) In my experience nobody reads the source code before executing it. Maybe the situation is different for big project with many users. On the other hand for example smart contracts (which are open source) had security issues several times in the past which were discovered too late.

I read the source code of programs I use often, mostly for learning purposes. The first thing I do when I want to evaluate the security of a program I don't trust is look at the system calls it performs, especially those related to I/O.

Since I don't need to reverse engineer binaries, open source code allows me to spot malicious code much faster. More importantly, it allows me to more easily remove that code from the program.

The rate of vulnerabilities caused by honest mistakes is probably the same.

Yeah, everybody is going to start reading the entire source code of the apps they use.

There's still a benefit even if only a small amount of people read it, because they can call it out. You don't go to the production areas of packaged food you buy to make sure you know they're not making any mistakes/pumping sawdust into the food, but you trust that because everyone else is buying it and no one is getting sick that there's a fair chance you won't either.

You broke your analogy a bit there. You don't go to the production areas of packaged food companies because you assume that others are doing so - specifically, state regulators. It's not that no one is obviously getting sick - they might be getting sick in subtle ways they can't pin on the food, like long term heavy metal poisoning, in the same way that malicious software can be very quiet about it.

That's a good point. It's not a 1-1 analogy, but I think the overall principle applies. If it's open source, more people can regulate it, as opposed to less.

Oh no, it's a fine analogy! I just thought you muddled it a little at the end with the 'no one getting sick' part. It's important that source code be available for the same reason that food preparation not be done behind locked doors with secret ingredients - not so much so that everyone can see for themselves, but so that someone can, and raise the alarm for the rest of us if anything is amiss.

The 'getting sick' part actually works too - it's important to be able to review the process precisely because it's not always immediately obvious if something is wrong.

> In my experience nobody reads the source code before executing it

It's not so much that people need to read the source code before executing it as it is about the code being auditable by any third party, with or without permission.

You definitely have some good points, but I think there are good responses. (1) It doesn't have to be perfect to be better. (2) You don't need everyone to read the source code, just a few people. (3) Open-source not only makes it technically harder to do malicious things to users. It also (hopefully) improves the incentives.

>In my experience nobody reads the source code before executing it

Joe Schmo isn't going to be auditing it, actual security researchers are. Heartbleed was only discovered because some research firm was auditing random open source software. Imagine how long the exploit would have gone unnoticed in a closed source application. Now imagine if said exploits were intentionally added and used by the software authors since day 1.

Non-technical users read the hitjob published by the NYT yesterday and just assume Facebook lies and continue on their lives with absolutely zero understanding of the OSI model.

This argument is repeated so often today that it seems like the latest FB talking point. It's whataboutism yet again - who cares if someone else is doing wrong? 'There are other rapists too' is not an accepted plea in court. The argument also is disingenuous for several other reasons:

First, [EDIT: this point has many flaws and is too complex to state succinctly, so I'm pulling it]

Much more importantly: The problem isn't who I need to trust, it's that Facebook is deliberately capturing and distributing large quantities of user data, and in addition they are giving it to some exceptionally unsavory people that are doing great harm to the world, including damaging the foundations of democracy and civil society.

Finally, it's disingenuous because few other companies have the power and data of Facebook. Why does Facebook get more attention than other violators? Is that a serious question?

EDIT: And finally finally, the argument overlooks the fact that security is defense in depth. Just because some other component isn't secure doesn't mean you shouldn't secure this one.

> First, if my application encrypts something, such as if my browser encrypts traffic, then the layers beneath it cannot access the data (without intentionally hacking the application).

If your browser is running on an operating system when it applies the encryption, then yes, you are indeed trusting that OS.

This. Many security systems protect you laterally and from layers above you. Layers below can still be vulnerable (e.g. non-standard openSSL library in the exception case, keyloggers in kernel space, etc)

https://en.wikipedia.org/wiki/Protection_ring

Who do you refer to with this?

>and in addition they are giving it to some exceptionally unsavory people that are doing great harm to the world, including damaging the foundations of democracy and civil society.

The US government? NSA? Big Business? China? All of them?

>security is defense in depth

You misunderstand what this means. This refers to the need to have multiple layers of security, such that if one fails, the others will continue to protect you. If you have two doors to your house, there is little point in putting more locks on the front door when everyone knows you leave your back door unlocked.

> If you have two doors to your house, there is little point in putting more locks on the front door when everyone knows you leave your back door unlocked.

I'm familiar with this reasoning and formerly used it myself, but now I see it differently. You need to secure both doors; if you're the front door designer, 'the back door isn't secure either' is a poor excuse for not doing your job and it's counterproductive in securing the house.

Hi forapurpose. I don't want to minimize the problems with Facebook and its practices around data. On the contrary I'm quite critical and skeptical of them. However, right now I'm trying to get to the bottom of this particular issue which has just come up in the news.

This issue seems to be about particular APIs that Facebook gave to certain partners. As I understand it, the partners don't get any data until a user gives them their username and password, for instance by typing it into that third party's app.

Now in my opinion, if a user is already trusting that third party with their entire Facebook account, then everything else is a secondary issue. It is primarily a trust relationship that the user themself has established with that third party.

Again, I'm just focusing on this issue at hand. I'm not saying this is a more important issue than Facebook's general data practices or anything like that.

Reply on news.ycombinator.com