Comment by forapurpose | Hacker News Reader

Comment by forapurpose | Hacker News Reader

Parent Full thread

This argument is repeated so often today that it seems like the latest FB talking point. It's whataboutism yet again - who cares if someone else is doing wrong? 'There are other rapists too' is not an accepted plea in court. The argument also is disingenuous for several other reasons:

First, [EDIT: this point has many flaws and is too complex to state succinctly, so I'm pulling it]

Much more importantly: The problem isn't who I need to trust, it's that Facebook is deliberately capturing and distributing large quantities of user data, and in addition they are giving it to some exceptionally unsavory people that are doing great harm to the world, including damaging the foundations of democracy and civil society.

Finally, it's disingenuous because few other companies have the power and data of Facebook. Why does Facebook get more attention than other violators? Is that a serious question?

EDIT: And finally finally, the argument overlooks the fact that security is defense in depth. Just because some other component isn't secure doesn't mean you shouldn't secure this one.

Hi forapurpose. I don't want to minimize the problems with Facebook and its practices around data. On the contrary I'm quite critical and skeptical of them. However, right now I'm trying to get to the bottom of this particular issue which has just come up in the news.

This issue seems to be about particular APIs that Facebook gave to certain partners. As I understand it, the partners don't get any data until a user gives them their username and password, for instance by typing it into that third party's app.

Now in my opinion, if a user is already trusting that third party with their entire Facebook account, then everything else is a secondary issue. It is primarily a trust relationship that the user themself has established with that third party.

Again, I'm just focusing on this issue at hand. I'm not saying this is a more important issue than Facebook's general data practices or anything like that.

>security is defense in depth

You misunderstand what this means. This refers to the need to have multiple layers of security, such that if one fails, the others will continue to protect you. If you have two doors to your house, there is little point in putting more locks on the front door when everyone knows you leave your back door unlocked.

> If you have two doors to your house, there is little point in putting more locks on the front door when everyone knows you leave your back door unlocked.

I'm familiar with this reasoning and formerly used it myself, but now I see it differently. You need to secure both doors; if you're the front door designer, 'the back door isn't secure either' is a poor excuse for not doing your job and it's counterproductive in securing the house.

Who do you refer to with this?

>and in addition they are giving it to some exceptionally unsavory people that are doing great harm to the world, including damaging the foundations of democracy and civil society.

The US government? NSA? Big Business? China? All of them?

> First, if my application encrypts something, such as if my browser encrypts traffic, then the layers beneath it cannot access the data (without intentionally hacking the application).

If your browser is running on an operating system when it applies the encryption, then yes, you are indeed trusting that OS.

This. Many security systems protect you laterally and from layers above you. Layers below can still be vulnerable (e.g. non-standard openSSL library in the exception case, keyloggers in kernel space, etc)

https://en.wikipedia.org/wiki/Protection_ring

Reply on news.ycombinator.com