Hacker News Reader

If someone is always late to everything, and then one day they really do have a flat tire and are late for good reason, and you doubt them when they say they have a flat, and that person asks "What am I supposed to do to make you believe me when I have a good reason?" The answer, though it may seem unfair in this particular instance, is to not always be late to everything else.

If you have a pattern of abuse even legitimate behavior may appear as abuse. The solution is to not engage in a pattern of abuse.

While this happens, is it a good thing? Or should try to avoid logical fallacies?

If you want an accurate understanding of what's going on in the world, then you should probably believe that people who are habitually late do sometimes also get flat tires. If they say they had a flat, the logical conclusion isn't blind trust or being sure they're lying, but mild skepticism.

GP's scenario poses that the late person asks in exasperation what they need to do to be believed -- there's no logical fallacy in telling them why perceptions are stacked against them. Or in your framing, why it's skepticism instead of presumptive trust.

Yes, the goal should be for both parties to reach a correct understanding: not at fault this time, but often is.

Facebook, to some, appears to be only loudly arguing about the specific injustices they feel, without giving up much ground on their habitual mistakes.

I can empathize with FB leadership, not condone of course. 5 years in SF consumer ad tech turned me into a shell of a person who was coming to accept that reality is created by certain peoples’ wills, so the only lie was deviating from the company message. “Air tight” stories and containment seemed like the M.O. and with 5 figure severance packages and more, I have a hard time seeing many people being the first to be vocal. Everyone wants that money, and most will lie hard for it. Not saying I went full shill, but memories of that time are interesting to reflect on. Surreal, disidentified. I think my soul is growing back, thankfully.

People aren't rational. If you want to deal with human behavior, you don't start by faulting them for their irrationality, you start by acknowledging that it's part of the package.

But it's perfectly rational to distrust someone who isn't trustworthy.

The only irrational part is when there's a disproportionate response, and that comes with part of the social contract - outside of existential threat, repetition and duration require an escalation of response until a behavioral correction is observed. It's a feedback system and feedback is also rational (only the form of the feedback might be questionable).

It should be more than mild skepticism.

If they’re late 10% of the time and the odds of a flat tire are 1 in 1000 (based on my driving experience I’d say that’s a high estimate, too) then you should start by assigning a probability of around 1% to the flat tire hypothesis. Then modify that based on how honest they typically are.

Nitpick: I would absolutely believe a chronically late person who said they had a flat tire, unless they also had a history of lying.

If they consistently "lost track of time" or "got caught up doing X" but they one day get a flat, why wouldn't I believe them?

I don't know if or how this affects the analogy.

Trust is earned and spent. If you regularly make commitments to be somewhere at some specific time and fail to meet that commitment you loose people's trust.

You can't do much over the behavior of people's whose trust you've lost, so if they don't believe your flat tire story, too bad for you.

How is systematically not meeting your time commitment not straigth up lying?

My question here is to the precise nature of Facebook's wrong doing in this instance, and why we don't expect the New York Times to provide specifics.

I am don't think any alleged previous wrongdoing answers those questions, unless you are saying there is no specific evidence of any wrong doing in the latest revelations, but we should assume there to be anyway.

>does anyone feel comfortable arguing that the reader will understand what is apparently the issue - the permission dialog was not clear enough?

There were leaked emails in which FB was discussing how to ACTIVELY ensure the updates for their app specifically obfuscated the fact that they were preventing the users from understanding what they were agreeing to, as it was bad PR, and Zuck authorizing with "yup do it"

I'm not on Zuck's side, and I'm not explicitly saying you're wrong, but this feels like a mix up of the response from Zuckerberg to blocking the Twitter API.

If you have a source for him saying "Yup do it" to an attempt at confusing their users on an agreement... that would be a big news story.

I'm looking for the actual emails - basically the discussion was about how to get a feature passively opted into by the user without letting the user know they were allowing that specific permission - and they discussed how to achieve this and then zuck approved the action.

https://www.cjr.org/the_media_today/british-parliament-faceb...

https://www.mercurynews.com/2018/12/06/facebook-knew-collect...

https://twitter.com/EFF/status/1071446556946001925

I think you're perhaps mixing two bad decisions into one. One is the decision relating to Android "read call log" permissions – this involves Michael LeBeau and Yul Kwon. The other is Justin Osofsky asking Mark Zuckerberg about shutting off Vine's Friends API access – for this, Zuckerberg personally gave the go-ahead. "Yup, go for it."

All from here: https://www.eff.org/deeplinks/2018/12/new-documents-show-fac...

> Apparently Facebook did it the wrong way. Why?

Do you honestly think that Facebook was trying to allow users to make the decision in an informed way? I suspect most people instead think Facebook was trying to get some way of SAYING that the users agreed while maximizing the odds that the users would be surprised to discover the implications.

That'd be my answer as to "why". I could be wrong, but I can't think of an occurrence where FB seemed to be acting in their (non-advertising, non-paying) users' interests. Yet FB will claim otherwise.

And that disconnect is what people are finding "wrong".

Just Devil's Advocate here, but you're essentially saying that people affirmatively agreed to something that they didn't understand in a contract of adhesion.

I mean, that's kind of a tough thing to hang our hats on if the idea is to take Facebook down. From congress the best you could hope for there is for companies to be required to use "more clear" language when writing up consumer agreements in the future. Which would be a nightmare requirement in and of itself, so it would likely never happen.

> that's kind of a tough thing to hang our hats on if the idea is to take Facebook down

I'm not taking a position on "taking Facebook down" - I'm arguing that legal isn't the same as moral/ethical, and it's entirely correct to label an activity as "wrong" and to be upset by it without that activity being illegal (In fact, I'd argue there's great value in having such legal-but-not-moral areas as long as they aren't too vast). I'm not well-versed enough in the legalities to SAY if the behavior is legal, but I feel well qualified to say when something feels deceptive and wrong.

Outside of the general issue of legal vs moral: While I agree with you about the legal requirements of agreements, I'm also okay with saying there is such thing as bad faith in entering an agreement, and a reasonableness standard about what people are actually agreeing to seems legit - the alternative grants all the power to people who can afford the time and lawyers for every agreement. Whether such standards would have any impact on this situation is way beyond my knowledge level to be certain (i.e. I'm not saying that's the solution to this particular problem, it's just a related thought)

These are the right questions. It is disappointing that our top journalists sometimes prefer to fit a story into an existing narrative but narratives capture the public's attention so the incentives get a little weird.

Anyway I do sometimes think that it might be good to have an actual screen recording of everything I do online, just so that I could look back and see what a permission dialog looked like for instance.

Maybe I will build a Chrome extension for myself.

Perhaps not "recording",but I can see a real case for an extension that:

1) automatically grabbed a screen text (so it snags the text hidden inside a scrollable container, for example) capture (with notification) when you had a page with a button or link with the text "Agree" or "Understand" or "Accept" in it. Capture would be "tagged" with referrer url, current url, and timestamp. Possibly a screenshot of the rendered page as well.

2) Allowed you to manually trigger such a capture.

I'd think that would involve reasonable space, and even if I wasn't trying to gather legal evidence, it'd be interesting to see the results after, say, only a month.

It is disappointing that our top journalists sometimes prefer to fit a story into an existing narrative but narratives capture the public's attention so the incentives get a little weird.

1) It's not "sometimes." It happens many, many times a day. It's basically become the way they do things.

2) "narratives capture the public's attention so the incentives get a little weird" -- So the news is no longer about finding and transmitting the truth. It's about selling narratives? And the more the legacy news industry progresses on its inevitable collapse, the worse it's going to get? Nice.

1) We can debate the frequency of this all we want (though I don't think it's useful). In my opinion the top (note this is an important qualifier) journalists are not lazy on purpose and in general are trying to deliver accurate information. You may disagree and that's fine. Also technology reporting is particularly difficult when you yourself are not a technologist, but that's a separate issue.

2) I'm not sure what point you are trying to make here. I didn't say that news isn't about finding the truth. But when describing complex systems and situations there is always going to be judgement applied in the distillation process. So for instance, you could say "Facebook provided private message data to some application partners" or you could say "Facebook's users inadvertently agreed to share private message data with application partners." Both are true.

The only permission dialogue I have seen was the spotify one from a few years back on Stack Overflow.

I have also seen Facebook exec emails about obfuscating permission dialogues in order to get more permissions, though. It seems to have been pretty accepted practice.

> Say I am running a social network. I want to allow my users to give access to their own damn data to third parties.

You don't. There is no safe way to do this, but more to the point, this is not something that your users want to actually do. If people want to give their data to a "third party" they can just go directly to that party and give it their data. Your permission or participation is not required.

If you'd like to try it, start a social network and then start serving big dialogue boxes that say "Would you like to give all your personal data to a third party? Click here to get started." Note that Facebook worked very hard to do the exact opposite of serving that kind of clear dialogue.

> I want them to be able to use third party chat UIs.

Why? If you are running a chat system, why not just build the UI you want your chat system to have? This doesn't even make sense to me.

I think maybe what you mean is that you want your users to be able to interact with 3rd party services through your chat UI? In which case the answer is to build an API for that which properly handles data and privacy. "Let this 3rd party do everything with a user account that a user can do" is a shitty, lazy and/or deliberately permissive way to deliver that feature. Note that Apple and Whatsapp, among others, provide 3rd party chat integrations without letting the 3rd parties read every message in the user's archive.

Sure there is. Of course people want to use third party email or chat clients. In fact, this is in many ways the bete noir of Hacker News whenever a related subject comes up, just today Slack blocking Iranian user. People point out that Slack, and Google Talk, used to have to speak Jabber. So I type my password into a Jabber WebClient, and I have just shared all the messages you sent me with a third party. It is literally this thing.

People who used the Nylas N1 client, or now, any app that uses the Nylas APIs are sharing all their email messages, contacts and calendars with a third party - this includes your messages and your telephone number.

There are some useful screen shots for Spotify and Netflix here: https://newsroom.fb.com/news/2018/12/facebooks-messaging-par.... Not the permission dialog but the integration UIs from the user perspective.

> What was the permission dialog like, really? Does anyone have a source for this?

There have been studies on Facebook's permission dialog and its lack of usability, and it's hard to escape the conclusion that it was deliberately designed to make it hard for users to understand. It has been improved several times over the years.

For example http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.183.... (from 2010) which discusses how permissions dialogs are not designed in a way that allows users to easily understand permissions (using Facebook as one example) https://dl.acm.org/citation.cfm?id=2078843 (from 2011) which found that Facebook users were unaware of the extent of 3rd party apps' data access even after viewing the permissions screen.

https://www.ftc.gov/news-events/blogs/techftc/2015/05/usabil... discusses usability concerns around permissions dialog boxes in general so it's been on peoples' radar for a while as an issue.

From the politico article:

> Facebook also regarded these partners as extensions of itself because they committed to abide by its privacy guidelines, according to the Times report, and therefore the company felt it did not need users' permission before sharing their data.

So what is being claimed here, then? That user did not see a permission dialog? That the permission dialog did not mention the full details? Is it too much to ask from our journalists that they go into this level of detail?

> Now, how do I do it in a non-evil way? I am presuming here that everyone agrees that should be possible to make that work [...] Apparently Facebook did it the wrong way. Why?

I really like Steve Jobs' comments on how to operate, with regards to questions of user privacy: https://www.youtube.com/watch?v=39iKLwlUqBo (3 minutes)

While I'm not convinced about the need for devices to be locked down, the rest of his response should be the gold standard in my opinion.

your comment is 100% true, if somewhat pedantic.

i think we can use a dose of common sense to understand that what FB did was ... let's say not in the interest of users. so really, the problem is not that fb is being unfairly taken to task. the problem here is the NYT reporting isn't a deep investigative enough piece for your taste. it's more of a drive-by "oh boy, what did FB do now" click attractor.

Say I am running a social network. I want to allow my users to give access to their own damn data to third parties. I want them to be able to use third party chat UIs.

This is precisely why I keep pounding on the idea that "Trusted Execution" technologies need to be turned around 180 degrees. It's intimately tied tot he idea of privacy. It's horrible when governments and big companies have "privacy" but use their power to strip individuals of it. Likewise, it's a public good for individuals to have privacy, and for governments and big companies to be transparent. Likewise, it's horrible when big companies turn "Trusted Execution" against individuals -- this is DRM. However, it would be a tremendous good if the voting public got some laws passed requiring big companies to subject themselves to Trusted Execution technologies when handling customer data.

Doing this would give individuals the keys to control their own personal information.

This is also an area that is of great interest to me. I've been saying for the last couple years that the only way out of this mess is for "Can't be evil" to replace "Don't be evil".

An easy way to solve this is to have a permanent data explorer that shows you your own FB data, but through the lens of each entity you've shared it with, and a one click opt out.

Maybe a list of entities, and when you click on one, you see what they would see.

If you care, you opt out. If you don't, you do not opt out. Either way, it makes it hard to plead ignorance or vagueness of permission dialog text.

> I am presuming here that everyone agrees that should be possible to make that work

But not on precisely how. I think what we’ve identified, nationally, is a need to legislate standards around digital privacy and information monopolies. Your confusion is reasonable. We, as a nation, never had these conversations. Democracy is, at the end of the day, a reactive system.

By stating the result of data sharing directly. e.g. if they are sharing the data with a bank, then state clearly that the bank can deny you loan based on what you're doing on that social media. They know this, but will not say. Silicon valley tends to hide or obfuscate as much as possible without being illegal.

To clear it up, we could just refer to the Facebook blog post where they tell the truth, the whole truth, and nothing but the truth on this matter. Is there such a thing?

The Facebook newsroom posts on this matter go into much more detail than the Times reporting. That said, I don't expect Facebook to tell me the inconvenient truth. But I am paying the New York Times so that they improve my understanding of the situation, not make me feel like I can learn more from Facebook PR.