Hacker News Reader

> we should advocate that users have the right to delegate data-access through APIs to third-parties

From my PoV, for my purposes, as a technically minded user I might agree.

But thinking about the numpty-on-the-street, this could be a privacy nightmare with people being easily conned into allowing a random application full unrestricted access to slurp their data. This can happen already, of course, but the provider could detect a remote API scraper and try to block it, and a user-local malware scanner can be trained spot a rogue browser extension that scrapes the UI, but if API access like that is mandated they'll have to provide the access and won't be able to tell the difference between that which the user requested and that which the user was conned into requesting.

Again though, all that needs to be done is to make sure that the liability for leaked data falls on the user. That's the other part of it right? You delegated access to your account, so InstaFaceTwitter is no longer responsible for what happens to the data on that account. They are only responsible for making sure they give anyone presenting the keys you authorized access to edit and read data on your account.

I mean, there are obviously responsibilities that naturally come with having delegated that access. And word will get around. The first GDPR violations because some user delegated access to their account and the entity that was authorized slurped up all of that user's contacts' personally identifiable data without the contacts being notified, will undoubtedly set the tone. That's still likely a GDPR violation. This doesn't change any of that. The only thing that changes is that the consequences for the GDPR violations now fall on the entity that was authorized, or maybe on the user who authorized the entity? (Not sure which?) But it obviously would not fall on Twitter since it is only complying with the law.

It's important that legal and criminal liability is matched to authorization or delegation. In practice, it will be the threat of legal liability that ensures data security and data privacy, so that needs to follow delegation to ensure incentives are always aligned properly.

> all that needs to be done is to make sure that the liability for leaked data falls on the user

I don’t think that was the point of what the parent commenter was saying.

As I read it, they were talking not about liability but the likely negative side effect of having more people be conned out of their private data that will then be abused.

Who is liable is a secondary concern. The main problem is the fact that people’s private data end up in the wrong hands.

The solution I think that the PDS2 "open" banking system has come up with is that all the API integrators are also subject to regulatory approval. So you can't just spin up a shadowy data-slurping shell and connect it to people's bank accounts.

Then we'd have to apply for website licenses at the California Department of Cyber Vehicles. I hope my website is up to the Cyber Building Code. Yikes.

Would you rather have everyone who can afford a car drive around without any oversight?

Building Code for websites is something I would be willing to support, e.g. no plain-text password storage allowed.

Meanwhile, the reality of building code:

User must rotate their password every 7 days or be locked out pending in-person approval. The software must enforce this restriction while allowing a two-hour grace period on days when daylight savings changes.

You: this is retarded and anti-security.

Them: the lawyers are on their way. Stay put.

The building codes I am familiar with (fire alarm systems) are completely sane "best practice" guides.

I recently renovated a 1950s building, among other things I designed and wired a fire alarm system from scratch, and passed inspection on first attempt. The building code gave very valuable pointers: what kind of cables should I use, how zones should be wired, how many sensors I should have, how they should be placed, how long backup batteries should last, etc.

Unfortunately a lot of FIPS is more like the contrived absurd example.

You say you are familiar with building codes. But have you ever tried to build or renovate a building?

Some areas are okay. Others are not. The issue is not so much building codes, although there are definitely codes that e.g. push specific products from specific vendors and other shenanigans, but the approval process that gives the local authority unlimited time to mess with you for any reason.

There is, I think, a single US state that puts reasonable limits on project authorization, but I can't remember which it is.

All in all, doing anything with real property opens you up to just having your money taken by the government and lawyers while accomplishing nothing.

I'm sure the regulators are knowledgeable about APIs.

Can’t you already post through the Facebook API, just in a non-standardized format? I know you can’t anymore for Instagram, but I thought that third parties could post to your feed with your authorization.

The API can post to Pages and Groups (with Facebook's approval and review of your use case), but not to personal profiles.

(It used to be possible, but they removed that API after Cambridge Analytica.)

>Beyond advocating for data-exports, we should advocate that users have the right to delegate data-access through APIs to third-parties.

IMO we should first and foremost be advocating for the right to have our data destroyed.

I agree. But this is the government, they are definitely going to be loathe to accede to that request.

This is a "take what we can get" type of step.

Someone will write an app that uses a delegation API to destroy your data. Possibly including better or more nuanced ways than simply deleting your account, like removing all pictures of yourself smoking or wearing a beret.

The concept of data ownership is a very anti-freedom/pro-copyright concept.

With such a shallow view of freedom, physical property ownership is a very anti-freedom concept as well, is it not? Ownership of a house is an infringement on the freedoms of other poeple who want to live there?

Intellectual property is no different than any other sort of property. The right to own property is invaluable, and serves the purpose of maximizing freedoms in the long run.

> Intellectual property is no different than any other sort of property.

Is this rhetorical or literal?

Ill-gotten goods can be confiscated.

The same for knowledge would involve lobotomies.

Would you please hold still for a moment?

Knowledge != intellectual property

> physical property ownership is a very anti-freedom concept as well, is it not?

I am sure that some here would agree with that. I personally do not.

> Intellectual property is no different than any other sort of property

This is a very extreme view. You are basically saying that specific numbers can be owned by someone.

> and serves the purpose of maximizing freedoms in the long run

I can't see how this is the case, at least as long as intellectual property is concerned.

Don’t we have this right for a large portion of the population? GDPR and CCPA both include “the right to be forgotten.” Many companies will honor GDPR delete requests for non-eu users. CCPA includes a programmatic delete option and I’m sure the most common decision will be to allow it for all users not just California users.

> should advocate that users have the right to delegate data-access through APIs to third-parties

Not just third parties, but themselves (aka, write/use your own client for messenger/discord/...). This is the only way to get rid of having to use dozens of clients for various networks (apart from total standardization and federation which isn't happening anytime soon)

Yeah, EU made the same mistake with banking APIs. Banks now have to have API access, but not for end users, just for registered intermediaries. It just pushes the data into hands of more corporations, instead of giving users easy access to their bank.

Pidgin would thrive once again!

This is the last thing these companies will allow because it would destroy their business model. This would allow federation of different competing sites and users could pick the company/interface they like most and still have access to all their friends/pages/connections on FaceTweet.

I love it.

>> Under the bill the companies would be required to maintain an interface to facilitate interoperability.

This would be easily achieved with ActivityPub [0].

>> The bill would require communications platforms with more than 100 million monthly active members [...] to allow its users to easily move, or port, their data to another network...

That's the idea behind Berners-Lee's Solid [1].

I wish legislators were more in touch with open-source technology innovators. I feel the FOSS movement's philosophy and the idea of having collective technologies promoted and funded by the government go hand in hand.

[0] https://activitypub.rocks/

[1] https://solid.inrupt.com/

Solid is not the first effort in this area, but the timing w.r.t. consumer sentiment and legislation, combined with the clout of TimBL, does make it feel like it has a serious shot at success.

(Disclosure: I work at inrupt, the main commercial player supporting Solid, founded by TimBL.)

So, facebook and twitter already have apis for almost all their functions. What's the goal of this legislation?

At least as far as Twitter goes don't they limit some of their APIs like how many users a given set of API keys can use or something like that?

Yeah they severely limit bots and ask for phone numbers and then they 'll ban your number if you use it twice. Who's responsible for that other then the media FUD about russian bots? I really can't blame twitter (and FB) for limiting their platforms here.

Hmm.

That's actually a good question.

Does it outline in this legislation who is responsible if twitter throws open their api's and the company that a user delegated steals the user's data by acting, essentially, as a proxy api for other companies? I would think it's obvious that from the moment you delegate access to your data, Twitter would no longer be responsible. Basically, they should only be responsible for making sure that data is given only to whoever authenticates with the appropriate keys that the user in question authorized. What happens from there should be no longer Twitter's legal problem.

That seems obvious to me, but it's definitely something you would have to check.

Thhis isnt even about theft, but that people give their permission willy nilly to bad actors. Thats not a solvable problem

>Thats not a solvable problem

Well, we're not trying to "solve" the problem. We're just trying to clarify that Twitter has no legal liability for the problem. If you delegate access to your account and someone proxies it; or there are all of a sudden all these GDPR violations flooding in because you gave away access to your contacts' private information when you delegated access to your account; etc etc; that liability should fall on either the user, or the entity to which the user delegated access. It shouldn't really fall on Twitter.

That's all we're talking about here, just making sure that legal and criminal liability is matched with delegated authorization. Because the legal ramifications are what tend to ensure security and privacy.

That’s what platforms already do - yet they are being slandered for not saving their users from themselves.

First, I doubt many people knowingly allowed Cambridge Analytica access to their data.

Second, slandering is not the same as legal liability. If people are slandering you, sue them. But people can't sue you and say FB gave some company access to my data unless FB actually does that without the user's knowledge.

Lastly, under this new system, no one would be saying that FB is legally liable for a user explicitly granting access to a third party. Vast majority of people would lay the blame for that at the foot of the idiot user. Again, we're just trying to verify that the legislation reflects that very common sense view.

I think their API restrictions really started earlier as an effort to push users to their official app.

Granted your points are still very valid / a concern.

Maybe but i noticed them becoming really unworkable since 2016.

To break the Facebook and Twitter monopolies.

By doing something that is already possible, and has not broken their monopoly?

I didn't say it would work. I said this is what the Senators are trying to do. We'll see what the final form of the bill looks like.

So Twitter and Facebook have monopolies? Isn’t that kind of the opposite of a monopoly?

They are different kinds of websites.

and that s why they are "monopolies" - they each dominate a format. It's like saying IRC is a monopoly - which it is, just not owned by a central entity. It's not really going to work with people having 2 facebook-like accounts - they 'll eventually gravitate to one. What will work, is if there are viable , better open source and decentralized alternatives.

So if we granular defined monopoly - HN could be defined as a monopoly.

But the fact that people have LinkedIn, Facebook, Twitter, Reddit, etc accounts does show that people will use more than one service.

How many people are in multiple Slack groups.

Hn and reddit are the same format. And linkedin could easily merge with facebook. But facebook and twitter don’t mix

> How many people are in multiple Slack groups

Aren’t they using a single app?

And you expect legislators to understand that distinction?

if they can't understand the tech, why would they be fit to legislate ?

As if most legislators are elected for their ability to understand technology....

> Hn and reddit are the same format.

No they are not. there are no sub-HNs.

Hn is very similar to r/programming r/starups etc

No, it is just that the word is used differently in common practice.

If "literally" can now include figuratively, then "monopoly" can include oligopoly.

Twitter's API is notoriously bad for 3rd party apps.[0] In order to use the standard API, you need to register for a developer account, which requires manual approval and which Twitter can deny for any reason.[1]

Facebook has a history of outright suing 3rd party apps.[2]

If I can log into Twitter, I should also be able to update my account with an HTTP request. That's it. I shouldn't need to sign an agreement, or tell them why I'm programmatically accessing my account, or dig into a settings page. I should be able to grant an OAUTH permission to anyone that gives them access to that API, and Facebook shouldn't be able to sue that person just because they got around an IP block. That should just be part of my account.

I don't know if this legislation guarantees that (the article doesn't link to the text of the bill). Most tech legislation is bad, so there's a good chance it doesn't. But the principle remains.

[0]: https://www.theverge.com/2018/8/16/17699626/twitter-third-pa...

[1]: https://developer.twitter.com/en/docs/basics/developer-porta...

[2]: https://www.eff.org/cases/facebook-v-power-ventures

i wonder what caused them to limit their platforms so much.

wanting to own all ads placed against user content

wanting to lock users in and make it harder to leave for another service and still maintain a presence (which is also a constant ad for that other service) by cross-posting

wanting to make it harder to see the stuff you're following people for without ads inserted every few posts

It s still possible to leave but nobody leaves. Surely they benefit from some extra safeguards, but i don't think either are worried that users will take their data elsewhere. Usually when a new platform emerges, it 's a new format (e.g. tiktok).

I 'm pretty sure their response was in order to avoid bad PR during the Analytica scandal period.

A mixture of bad tech legislation, concerns over Russian interference, and good old-fashioned anti-competitive tendencies.

Having itself supplanted MySpace, Facebook is in a good position to see how easy data-exports can help competitors supplant a dominant company.

3rd-party clients are also a good way to remove ads and tracking, which is obviously not in Twitter or Facebook's best financial interest.

Yet they still provide with tools to export all data . So i don't think the migration of users is a major concern for them.

I 'm personally all in favor of making the APIs open and unlimited again, but within a month you 'll have journalists nagging again

Export tools happened after GDPR.

they existed long before gdpr, e.g.:

https://www.askdavetaylor.com/export-data-facebook/

This fight is much older than that. If you want to get sad, read this: https://en.wikipedia.org/wiki/FriendFeed

As I understand it for Twitter in particular, third-party apps were limiting the reach of their business-related tactics that users hated. Namely, none of those apps implemented any kind of invasive advertising, tracking, and recommendations – which made those apps much better from the UX standpoint than the official ones.

> Facebook already has a data export feature.

No it doesn't. It doesn't have the phone numbers or email addresses for the vast majority of people, even the ones who have their email address and phone number in their profile.

That's not your data - it's theirs (the respective persons)

No it's not. If someone gives you their physical business card, would you expect to lose access to it if you move houses? Once they give you their contact info, you should have a copy of it forever. Otherwise it's completely useless.

Isn't that an argument Facebook could make too, that it's not your data now that you've given it to them?

No. Because that's the same argument FB could make.

No. Your data remains your data, even if you allow someone else to look at it. You should be able to allow others to look at it, or even delete it after having allowed others to look at it. Now in practice, you can't. I get that. But that doesn't mean that it's not your data.

Certainly your contact info is your data. I shouldn't be able to give a girl's contact info to some other guy without her consent. One, that's douchey. Two, it's not my data, so doing so violates her privacy.

> Your data remains your data, even if you allow someone else to look at it. You should be able to allow others to look at it, or even delete it after having allowed others to look at it.

So you would argue that it's fine that Apple was deleting people's email the other day, because it's not really their data?

I don't know what you're talking about.

But for an answer's sake, no, Apple should not be able to delete an email I wrote. But that's the entire point of what I just said. I should be the final arbiter of my data. Me putting my data on an Apple Mac does not make the data Apple's. It's still my data. I should be able to show it to other people, or delete it whenever I like.

Apple should not be able to show it to other people.

Apple should not be able to delete it whenever they like.

But again, that's what I said in the first place.

>Your data remains your data, even if you allow someone else to look at it. You should be able to allow others to look at it, or even delete it after having allowed others to look at it.

So I really don't get your question at all?

Facebook lets you export "your data" which they define as data that you input into Facebook. They don't define it as data that you can see. Likewise companies usually don't let you export what their machine learning AIs have inferred about you. So they're using loopholes to make data portability less useful.

Facebook's argument that this data actually belongs to the friends and not the profile that's being exported, while convenient for Facebook, has to be acknowledged as a reasonable point of view on this matter.

Their argument doesn't hold up under the slightest amount of scrutiny. You can go to your friends' pages and manually extract their email or other contact information. If it's visible to you, its because your friend made a decision to make that information visible. They designed the data export tool that way knowing that the main thing someone trying to leave Facebook wants is contact information for their friends that they may only know how to reach on Facebook.

so if a person puts a number on a page, that also means they want everyone scraping it? that's not a very privacy-friendly perspective.

If I put my number or email on my page, and I adjust the privacy settings to "only friends", I understand I am making that information available to my friends. They are free to copy that information by hand, or by copy-pasting, into their own address book. I have explicitly made it available to them. Facebook includes information about your friends, such as their birthdays, in your data export. Their decision to not include off-Facebook contact information is a business decision designed to make leaving Facebook harder. It has nothing to do with privacy.

You have to somewhat assume a hostile actor here. Have you worked with fb's API before? They _technically_ have one, but frequently make breaking changes. They could easily justify this for such a legally-demanded API, as they do the same thing internally and already have that practice . What would prevent them from making it very difficult to maintain such a service?

Is that different from the API access Facebook already makes available to apps?