Hacker News Reader

Comment by dane-pgp | Hacker News Reader

The EU really need to look at the nexus between competition law and data protection regulations. There is already Article 20 of the GDPR[0] which enshrines a "Right to data portability", including a requirement for data to be automatically transmitted from one provider to another, in some cases.

It seems to me that mandating federation between social network platforms, using proven open standards, falls within (or very close to) the requirements that such a law already puts onto large data controllers, which should make it an uncontroversial remedy for the EU anti-trust authorities to demand.

[0] https://gdpr-info.eu/art-20-gdpr/

View on HN

What you're essentially asking for is the ability of someone to create an account on a service that isn't Facebook, but still be added as a friend by someone on Facebook, view content only available to their friends, share content with Facebook users, send and receive DMs etc.

That has the potential to be extremely effective. Anyone using a service solely for the network effect could switch to another one, which could be a large fraction of the users and reintroduce meaningful competition.

The biggest problem is protocol complexity. If Facebook adds some kind of timeline feature or anything like that, do they have to add it to the protocol other providers interface with Facebook using? If so, they can stamp out competition by adding so much complexity to the protocol that challengers can't keep up with it. If not, they can add features that challengers can't interface with. And expecting technologically-sideways regulators to arbitrate that sort of thing is a big ask.

Isn't this what happened with Microsoft network protocols, court ordered them to be made public?

Does it benefit Facebook in any way to have protocol features that can’t be interface with? Why wouldn’t that result in non-consumption?

Sounds like a fun project.

>Why wouldn’t that result in non-consumption?

Because FB consumption happens 99% on their own webpage and mobile client.

I think some sort of framework to take your social graph and personal data with you and messaging as a baseline would already be a strong thing.

That's really the biggest issue when it comes to switching services, keeping your contacts and primary communication intact.

Without interoperability and universal identity, social graph doesn’t help.

Universal identity, you can maybe solve with email. But there are problems like requiring using real name, multiple accounts etc

Interoperability between messengers will be limited to maybe text and images. Even on this there are huge problems, imagine snapchat vs fb.

Cell service providers had to do it. It wasn't that long ago in the US when you couldn't take your cell phone number to a different provider.

Facebook, et al, could provide restricted APIs that let another authorized service gain access to your information via your user identifier. I imagine they provide partial access for favored partners already.

Cell service is a commodity, though. They effectively act as dumb pipes for sound and data, and although they would like very much to not be that anymore, that is the reason they have customers. Also, there aren't many value-adds to be had at the protocol level. Everything else was already fairly standardized, so adding the number porting stuff on top of that was comparatively easy.

What we're talking about here is pure software interop. There is no standard, and any standard that would be devised would become a quickly-outdated albatross around the neck of the developers. Imagine writing code to interface with someone else's crap API, except now you're required to do it by law, and any new feature you come up with has to be either shoehorned into it, or more likely, go through a long and bureaucratic approval process, or even more likely, simply never shipped.

Now pretend instead of Facebook, it's your instance of Mastodon that you want to hack on. HN doesn't have the requisite font face options for the magnitude of NO F'ING WAY that is my reaction to getting the government this deep into the nuts and bolts.

Only solution is a commodity identity and data provider. But it would never happen. Moderation, cost, legal issues are impossible to handle.

I am confident that an interface standard could be developed to allow some level of identity portability. Supporting such an interface would be rolled into the myriad other compliance requirements that tech service providers have to deal with these days. (A natural part of being in a maturing consumer facing industry.)

Cellphone carriers argued that number portability was too hard or too expensive.

"But cell phone companies argue counter that the idea of portability should be scrapped because customers aren’t demanding it. They argue that implementing portability, which involves retooling the software of each carrier’s computerized call-routing system, would be expensive and technically complicated.

“The cost to be able to move numbers from one carrier to the other is significant, and it would be significant for the customer too,” said John Scott, deputy general counsel for Verizon Wireless. “Our argument is that it’s not necessary to promote competition.”

Carriers Aim to Kill Number Portability - 2002

https://www.latimes.com/archives/la-xpm-2002-jan-16-fi-cell1...

They did, but that's a pretty obvious pretext because anything that makes it easier for their customers to switch carriers is bad for business.

This is materially different.

Federating my data with 20 different companies sounds like a privacy disaster.

Doesn't Facebook sell your data to over 20 different companies and governments already?

No.

Yea, probably many more.

No.

And we pass the burden of proof along like a hot-potato...

https://en.wikipedia.org/wiki/Facebook%E2%80%93Cambridge_Ana...

https://www.cbsnews.com/news/facebook-gave-some-companies-pr...

https://www.azcentral.com/story/news/politics/fact-check/201...

> But some researchers dispute that ad-targeting is any different than selling data.

> "As a data scientist, I am shocked that anyone continues to believe this claim," wrote Michael Kosinski, assistant professor at Stanford University's Graduate School of Business, in a New York Times opinion piece. "Every time you click on a Facebook ad, Facebook sells data on you to that advertiser."

> "This is such a basic property of online targeted advertising that it would be impossible to avoid, even if Facebook somehow wanted to."

A superficial analysis would say that there is a balance between the two dynamics of "Don't put all your eggs in one basket" and "A chain is only as strong as its weakest link".

A slightly deeper analysis would ask first "What are the incentive structures in a system where people can seamlessly migrate from one provider to another?".

We have already seen that Facebook, as a monopolistic provider, is too big to fail, and it can keep paying the meagre fines for its non-compliance with the rules, while lobbying and threatening[0] and exploiting its election-influencing power to ensure the regulations don't significantly limit its assault on users' privacy.

It's not hard to imagine that if 20 different companies were competing for users, they might act in ways that better protect users' privacy. In fact the competitive pressure on them would be twofold, since not only could users move to different providers, but users could also refuse to connect to a friend on a network whose policies they do not trust.

[0] https://www.theguardian.com/technology/2020/sep/22/facebook-...

I think this measure worked very well for the mobile network customers.

Article 20 portability is always initiated by the user who owns the data. Federation between social network platforms is very different, because it means swapping personal data not initiated by the user - when a friend loads my profile page, my node sends my personal data to her node. In fact, I'd argue that's simply a GDPR violation unless all of the federated nodes have mutually verified each others' compliance.

If federated nodes have to mutually verify each others' compliance, then every email server in the EU is breaking the law.

Presumably the reason email servers can operate legally is that the sender of each email is deemed to be the data controller or is otherwise giving explicit consent to their private data being sent to each recipient's mail provider.

Social networking is roughly equivalent to the sending of emails BCCed to everyone in your address book. In the case of something like Twitter-style microblogging, the GDPR is even less relevant since the user is deliberately trying to make information publicly available.

I think the sender of each email is definitely giving explicit consent. When I type out "To: foo@example.com", I'm directing my email provider to send my email to the example.com server. That's fundamentally different than the Facebook model, where some information is public and anyone at all can request it, even if they're not in my address book.

I agree that you could probably make Facebook with no public pages work, or something like Twitter where there's minimal public information in the first place.

Reply on news.ycombinator.com