Hacker News Reader

Comment by pdimitar | Hacker News Reader

I very much like to believe the "trust in Facebook is destroyed" message but...

(1) On every meetup I attend people are genuinely extremely surprised when I share with them even 1-2 of the screwups Facebook did. They are ENTIRELY clueless. And we're talking tech-savvy business founders and CEOs -- and often times CTOs and CFOs.

(2) Most don't care. They write it off as "I am not important enough to be spied on" or just directly admit "Facebook is integrated too much in my life and work and I can't replace it" and that's the end of the discussion. Many even say "they have only a part of my data, they can't have it all, right?" -- and have no idea about how well the tracking industry does cross-referencing of seemingly unrelated data sets.

I don't think Facebook is going away anytime soon in any measurable way or form. Sure they might struggle monetizing their mountain of data and analytics, and sure the stock market circus might not be on their side right now but I can't see them actually losing a significant chunk of users in the next 5 years.

View on HN

"I am not important enough to be spied on"

Such a familiar phrase. I'm so tired of hearing it from people I know. This is exactly like saying "I'm too broke for anyone to steal my credit card".

What you think of your own importance has zero bearing on how some unknown third party perceives you. Neither can you predict how they will use your information or how it will affect you. It's insane that people spend time and energy on keeping secrets from their relatives and friends (which everyone does) and yet can't see that a third party that actively seeks your information is more likely to cause you harm than people you know. This is a trivial deduction, yet so many people can't comprehend it. They think that because they can't imagine how someone else could screw them up using their personal info, no one could possibly screw them up using their personal info.

Apparently, I'm not eloquent enough to convey this in a verbal conversation. I've tried. Funny thought: maybe I should print the paragraph above on a card and hand it out when someone says the key phrase.

Same, but I gave up. You can't make people care if they genuinely don't.

I noticed that Americans and part of Europeans (mostly Germans I believe but probably others as well) perceive leaks of personally identifiable information as outrageous but everybody I know here in Eastern Europe are indifferent. Unless they lose money or their company gets a negative PR, they could not care less.

I'd say some Americans. Social Security Numbers and Credit Cards kind of get people going, but basically anything else elicits a "meh." Shocking and sad that the Equifax hack and bungling didn't get more people going than it did.

Because most people really aren't affected. I've experienced no negative consequences of the Equifax hack, nor several other major leaks that I was included in (OMB to name one). I'm not happy about the situation, but it's also not affected me directly, yet.

I think my hope, with the massive amount of SSN data that Equifax has, was that we'd see the SSN system being looked at to convert to something almost like a private/public key type of system where if someone obtains someone's SSN, another one can be generated pretty painlessly with the old revoked and can be linked back to the owner.

I know the primary issue is that the SSN wasn't intended for the use case it is used in, but we're at the point now that it is so probably best to protect it in a manner that protects the user/owner.

> but everybody I know here in Eastern Europe are indifferent.

Fellow Eastern European here, I remember I was made fun of by my former colleagues back in 2005-2006 when I was saying that the United States requiring bio data in order to get a traveling visa (I think fingerprints became mandatory for US visa applicants back around that time) was very not ok, I received the same responses that you mention.

Nowadays that the bio thing has started reaching and directly affecting people more to the West the subject is fortunately debated on websites like this one and also in some parts of the Western mainstream media, but back in EE the subject is still ignored or at best is made fun of. I remember attending a street march/protest against bio ID cards/passports a couple of years ago, and the majority of participants were religious people that believed things like "666 the number of the Devil" and all that + a couple of tech people like myself which are still seen as paranoid by our friends and work colleagues. Unfortunately the civil society from this part of the world is totally mute on this type of subjects.

To be fair to all sides, it's really hard to care about societal problems that might morph into personally dangerous leaks -- especially when many people struggle to make ends meet and have food on the table. I get that part.

But most people in EE are also way too cynical and demeaning by default and yeah, that's a real problem when issues like these arise. Nobody takes them seriously until something monumental happens.

> It's insane that people spend time and energy on keeping secrets from their relatives and friends (which everyone does) and yet can't see that a third party that actively seeks your information is more likely to cause you harm than people you know. This is a trivial deduction, yet so many people can't comprehend it.

I think this deduction is actually wrong. Ask yourself why you hide some things from your relatives and friends. Could it be because quite a lot of people are really bigoted, and the immediate social costs of them learning more about you would be dire? Whereas data collection currently has only one visible consequence on the individual level: what kind of ads & spam you get, and how much. People correctly recognize this as mostly harmless.

People do react to things that affect them directly. In my country it is widely known that people trying to cheat our IRS or social insurance got busted over Facebook photos, so they know not to present a lifestyle that's different than the one they report to the government. (E.g. if you're consistently reporting low income, don't post photos of your two limos. If you're on a (paid by social insurance) medical leave that restricts you to bed, you'd better not get tagged on a photo placing you in a restaurant.)

EDIT: I don't mean to imply that the government has a backdoor access to this data; it's just there were cases of people dumb enough to share incriminating evidence of fraud that found its way to government investigators, by e.g. being posted publicly.

Wow! Can I ask what country you live in?

There are definitely some parallels here to the way people now often friend their bosses on Facebook, leading to uncomfortable knowledge sharing.

Poland.

Customizing the ads and spam is the first step, because that's what technologically feasible and makes business sense. Before long, they'll start "customizing" your search results even when you're not logged in, because your IP and search history gives the gatekeeper enough to decide what you should and shouldn't see.

Net Neutrality in the US was obviously gamed in favour of ISPs, telecoms and large corporations, and the population didn't lift a finger behind posting sanctimoniously on Reddit/HN, and arguing with each other about the semantics of free/un-free markets.

>Whereas data collection currently has only one visible consequence on the individual level: what kind of ads & spam you get, and how much.

The key words are "visible" and "currently". There are less visible consequences like identity theft, scams and all kinds of sneaky profiling that affect you without your knowledge. And no one really knows how this data will be used in the future.

Reminds me of a great quote, from Ender's Shadow:

"If he's this good at making people love him, why didn't he do it before? Because these fools always look up for power. People above you, they never want to share power with you. Why you look to them? People below you, you give them hope, you give them respect, they give you power, 'cause they don't think they have any, so they don't mind giving it up."

Not saying you're wrong but I guess saying how it could harm you would be a good argument. Do you have any examples?

>a third party that actively seeks your information is more likely to cause you harm than people you know.

Says who? That's not deduction at all. As an example, if you get broken into its far more likely it was someone you know than completely random.

>It's insane that people spend time and energy on keeping secrets from their relatives and friends (which everyone does) and yet can't see that a third party that actively seeks your information is more likely to cause you harm than people you know.

You're more likely to get murdered by your spouse than by a stranger. Your kid is more likely to get kidnapped by its parent than a stranger. Statistically speaking, it's the people who fear the unknown bogeyman who are irrational, not those who fear their friend, relative or neighbour.

This reasoning works when you want to determine whether it's safe to interact with a (single) random person on the street. It does not work when reasoning about privacy, because:

1) Issues resulting from privacy loss mostly have nothing to do with murder and kidnapping statistics. Far more relevant would be the note that as of 2019 identity theft affected 23% of all US internet users [1]. And that's just one way to misuse your information. There are countless others.

2) Loss of privacy means loss of control over who interacts with your data and when that happens. I don't understand why this simple fact is so hard to grasp.

If your information ends up on sale or in a public data dump, anyone who wants to misuse it will have an opportunity to do so, probably forever. It's up to them to decide whether your info is "worth it" or how to use it.

Something you consider trivial today can be used in an elaborate scam tomorrow. Or it could be used for a social media stink campaign by your unhappy ex. Or something else.

The point is, "I am not important enough to be spied on" is a stupid statement, because whether you are important is determined by context. When you loose your privacy, you lose control over that context.

[1] https://www.statista.com/statistics/763130/internet-identity...

This is congruent with the link I posted elsewhere in this thread: https://jakeseliger.com/2018/11/14/is-there-an-actual-facebo.... My favorite paragraph from it is:

To me, the story reads a lot like a media narrative that has very little to do with users’s actual lives. And I’ve been reading variations on “Why Facebook sucks” and “Why Facebook is doomed” for a very long time. It’s like the “Why this is the year of Linux on the desktop,” but for media companies.

Does anyone else remember reading on Slashdot about how Microsoft is evil and any day now, we're going to move to Linux and revolt? Except that normal people didn't care and didn't notice?

Yep, this is still mostly doomsaying and nothing much else. While all of the objections against Facebook are valid in my eyes -- and in the eyes of many others -- the truth is that the regular folk views Facebook as an utility, akin to having power, hot water and internet at home.

This will not change overnight. Or even after several years. If Facebook fades into irrelevance it will likely be a death by a million paper cuts and not after a short-lived revolution.

> Except that normal people didn't care and didn't notice?

What's IE's market share today vs 10 years ago?

How many Windows Phones are in people's pockets?

How many people opened Hotmail/Live accounts in the last year?

People do care, it just takes a long time to see the effects play out.

Also many people moved to Mac instead of Linux, but still left Windows behind.

Do they have to lose users? I'm still a user, but my engagement is way down. I largely use it to organize events I am hosting. I might respond if someone tags me in something. Otherwise I'm basically not using it. Speaking of which, the last event I hosted I invited 30 people. 16 of them did not see the invite. It used to be I had a few people I had to text or email because they would not see a Facebook invite. Now I basically have to include an event on Facebook out of inertia, but it's not the primary way I invite people anymore.

They don't have to lose users to lose value -- at least for a while. But their hydra heads are spread everywhere. Every single "Like" button on a 3rd party website is a tracking pod and this has been well documented. Every single advert hosted by Facebook is a tracking pod as well.

Your engagement might be low -- mine is almost zero -- but you are still a source of data even if a reduced one. I am not sure even disabling Javascript altogether will help; I am pretty sure they fall back to techniques like your IP history, known devices from which you logged in and few other such techniques.

My gut feeling is they are holding on very tight to their personally identifiable information harvesting practice and won't let go of it anytime soon. Hope I am wrong.

I think if you stay logged out of Facebook and use a VPN it should be hard for them to figure it out. Even better, use Facebook only in incognito.

Still wouldn't stop 1x1 pixel image tracking, which I can only assume they're doing alongside other cookie syncing techniques.

I have all of Facebook's domains routed to 0.0.0.0 in my hosts file. So their "like" buttons don't even appear for me.

And the GDPR might cause less tracking through like buttons: "the operator of a website embedding [...] the Facebook Like button, which causes the collection and transmission of the users’ personal data, is jointly responsible for that stage of the data processing" -- Advocate General Bobek [0] (emphasis mine)

[0] https://curia.europa.eu/jcms/upload/docs/application/pdf/201...

You have a good point but there are a couple of areas where they're starting to hurt:

1) Politically. While most users don't care enough to stop using the service, users in the US and Western Europe care enough that politicians who stand up to FB get praise and potentially votes. Looking tough on tech is now a quick political win and that will eventually hurt them, most likely in the EU.

2) Talent wars. HN might not a good proxy for the general population but it's reasonable proxy for people FB wants to hire and the general sentiment around here seems to be I don't want to work for FB anymore. IRL most of my engineering friends don't want to work for FB either.

It's a start.

I fear that (1) might turn into a witch hunt -- "all tech is bad". Mass population is not very good at distinguishing nuance, especially when charismatic politicians tell them what to think. But I guess in this case this will work to Facebook's detriment.

As for (2), I haven't thought of that because I don't live in the USA and lack the perspective. Thanks for providing it! I think this might actually hurt FB a lot.

I don't live in the USA either (UK), but even over here I've heard engineers saying they wouldn't work for them.

> 2) Talent wars.

It's already happening. See last month's New York Times story "‘I Don’t Really Want to Work for Facebook.’ So Say Some Computer Science Students." [1]

1. https://www.nytimes.com/2018/11/15/technology/jobs-facebook-...

Some college students have been saying this back in 2017, 2016, 2015, and so on and so forth. For some definition of 'Some'.

They then get 6-figure offers, and shit, have to pay those student loans somehow.

There was a time when I was younger, at the height of Microsoft’s unethical attack on Linux and open standards, when I would not have even considered working for them, and would automatically recommend “no-hire” anyone who had recent experience there (because what kind of depraved moral compass do you have working there?) If your company’s brand gets a black enough mark, it can have real consequences.

I recently graduated from college and was heavily involved in national hackathons, and this story is just BS. It's so laughably BS that this story can be used as proof of the New York Time's willingness to publish anything that'll hurt Facebook.

Facebook goes to the best schools in the country and hires the best of the best.

> They write it off as "I am not important enough to be spied on"

That made me nostalgic for 2013, which at the time felt like a bad year. I wonder how I'll feel about 2018 in 2023.

(Context: "I'm not important enough" was the standard rebuke to Snowden's leaks)

The "I'm not important enough" comment got me thinking about something Chris Rock said on a podcast (w/ Marc Maron) when he was asked if he faced racism when he was starting out as a comic.

He replied that when he was starting out, he was small fry, so he didn't face anything beyond what he would as an average, non-comedian African American. In the comedy circuit, he was mostly ignored, but not explicitly discriminated against.

Once he reached a certain popularity level, and he was in the running for spots on talk shows, SNL, TV episodes, he started to notice it. The stakes are a lot higher, and there are lots of people coveting those TV appearances. So suddenly, people who would otherwise never even notice him, were acting in ways to specifically exclude him from the running in areas that were traditionally reserved for white comedians.

Just because you aren't important enough to be spied on today doesn't mean that you won't appear on someone's threat radar later.

Yup. Pretty much none of my friends and familly care about these issues. It might seem like a big deal in the US but not outside.

Yes, public apathy is the biggest roadblock to most meaningful reform (in all aspects of life and politics, not just FB/big tech).

But looking at it another way, the sheer volume of incidents has got to some how desensitize the vast majority of people out there. Personally, probably half of the companies that I regularly do business with have had some major data breach within the last few years. But nothing ever comes of it - no real punishment, no new meaningful requirements to protect their infrastructure, and no specific harm to me personally. So should I stop interacting with these companies? What about all the other companies out there where it’s just a matter of time before their own data breach? Should I eschew all technology and go back to the barter system? I think the genie has already been let out of the bottle and maybe we need to look at solutions assuming that data breaches will happen and how to protect people after the fact rather than preventing them in the first place.

> but I can't see them actually losing a significant chunk of users in the next 5 years

I don't think they will lose users progressively. Nothing will happen until something does, and then everyone will leave en masse (or simply stop logging in, without deactivating their account).

We should just work to make that happen as soon as possible.

There probably is a strong distinction in Microsoft's decline in Windows/Explorer use versus a potential decline in Facebook. Since Facebook is network-based, losing users and engagement could have a much steeper multiplier effect. If one person switched to Chrome in 2007, it didn't change anyone else's Explorer experience. Eventually, if enough users switch, sites will be designed primarily around Chrome, etc., but this is a slow bleed versus a waterfall.

> Most don't care

True - but I still think there's a big difference between understanding that your info isn't private and not being bothered versus assuming that your info IS private. The real question is your #1: Is the group of people with this understanding growing by any significant margin?

Facebook is a quasi-monopoly. Its threat comes from regulators, not consumers nor advertisers. (You saw something similar with Uber, by the way. When they lost their Teflon coating, prosecutors and municipal regulators got bold while their grassroots supporters melted away.)

True.

But I'd argue Uber is largely replaceable -- you still have public transport and taxis while Facebook has no alternative and most people are too inert to even think of replacing it...

We can all see how the media grows bolder and reports quite negatively on Facebook but I wonder if that even makes any difference.

Facebook has no alternative because it takes years to build something halfway decent. A social network today must work across all devices seamlessly, integrating with realtime notifications, user accounts and addressbooks across devices and that’s just for a start.

At https://Qbix.com we have spent our own money on a free open source alternative platform to Facebook.

I think we’re still pretty bad at marketing it. Would appreciate some feedback if you check out the site and watch the video.

It’s far far ahead of Mastodon, Solid, OwnCloud or whatever else is out there. It has full documentation (https://qbix.com/platform and https://qbix.com/platform/guide and https://qbix.com/platform/tutorials) and can be tried out of the box. It has been audited by third party security firms and come out with flying colors.

Here is a laundry list of features: https://qbix.com/features.pdf

But it needs a huge effort to make it as nice and appealing as say stripe.com is for payment integrations. Those guys are amazing.

We recently released version 1.1 on github. We have chatrooms, galleries, events, trips, back end and front end components which all work together like BSD systems all work together. Just slap them on pages, theme it and there u have your own social network. It took us years and nearly $1M in funding. But you can’t see much of that at a glance, or play around with it, yet. That should change in 2019.

Dear EGreg,

PHP? I'll pass.

Don't bother with any arguments that PHP powers huge sites including Facebook and Wordpress. The whole point of this thread, and presumably Qbit's very existence, is that they are not good role models.

If you are trying to be a modern, secure, respectful replacement for Facebook, be modern, secure, and respectful.

A strange response considering you’re not the only person on the Internet. You didn’t post any alternative, and if you had, it would probably have the 1% of the install base of PHP. Remember that most people hosting this thing aren’t going to be setting up their own VPN and Linux. In fact, even YOU don’t do it, you probably will just use AWS creating MORE centralization in “the cloud”. That’s pretty hypocritical. Meanwhile the LAMP stack or NGinX + PHP stack is widely deployed on the web. And many of the installations have the latest PHP. What is less secure about the latest PHP than your favorite language?

Finally, about being modern and chasing trends. Wordpress is not modern but it powers 1 in every 3 websites. Ghost is modern and is used on 0.1% of websites. Thanks but we’ll pass.

I am not even sure how PHP is disrespectful, so I’ll leave that one alone.

If it makes you feel better, we are also working on an app hosting the whole network from a random computer or a mobile phone on a local network.

[1] https://serverfault.com/questions/922074/list-of-most-popula...

[2] https://www.quora.com/Is-Node-js-killing-PHP

Your answer somehow conflates popularity with quality.

PHP has a lot of very well documented problems.

Also, do you have a source when claiming that most PHP installations use more modern versions? I seriously doubt that particular claim is true. Most business people think of IT as a one-time expense. You can still find a ton of 5.0 - 5.3 installations out there. Hell, in my country there are good amount of PHP 4.x websites as well.

> Facebook has no alternative

Sure it does—Instagram.

Instagram is owned by Facebook.

You switch FB for FB, basically. :)

> Instagram is owned by Facebook

Right now, yes.

I’m responding to your “most people are too inert to even think of replacing [Facebook]” comment. My point is, they already have. That presents an easy regulatory solution to Mark Zuckerberg. Break up Facebook.

Facebook does have alternatives, though. The website does nothing new, only serves it to you in one place. This used to be great when your feed was populated by content generated by people you actually know and care about in your personal life, but facebook pulled the rug out from under us when they gradually increased the amount of advertising pollution you had to sift through to get to any original thought.

Facebook has changed from that useful platform it once was to basically nonstop custom-tailored commercials, but the alternatives that it sought to replace have not and never will. Want to keep in touch with your relatives or friends? Directly engage people again. This can be as simple as an email thread, group text messaging, or an application like GroupMe. Need to plan events with your group? Throw it on a google calendar, who cares about who said they are going or who left your invite on read? Contacts? Your phone and address book on your computer. Keep your photos on something nonproprietary and therefore future proof; contrary to popular belief, no one will remember all the likes your pictures from Cabo got you in two weeks anyway.

Most people don't care as they should. Facebook is a useful utility for many people, and the narrative of the marco risk where Facebook is destroying the foundation of social governance isn't accepted by them.

> "I am not important enough to be spied on"

“Then surely you wouldn’t mind sharing your fb password with me, with your spouse and your manager at work. Moreso, we would like to have access to all your messaging activity in real time.”

Reply on news.ycombinator.com