Why We Disagree with The New York Times

https://newsroom.fb.com/news/2018/06/why-we-disagree-with-the-nyt/

by sqdbps • 8 years ago

346 302 8 years ago

newsroom.fb.com

It reads like a long defensive argument, "how else did you expect us to make huge sums of money"? It is exactly as tone-deaf and legalese as you would expect. There is no new information here; Facebook says legal contracts actually protect your data so it can't go anywhere, "just trust us", etc.

These partners signed agreements that prevented people’s Facebook information from being used for any other purpose than to recreate Facebook-like experiences.

That sentence does not make any sense. Signed agreements do not prevent your information from being used in other ways. That's insane, literally.

Contrary to claims by the New York Times, friends’ information, like photos, was only accessible on devices when people made a decision to share their information with those friends.

In the past, Facebook Legal has stated that once a Facebook user has signed up, they consent to having psychological experiments performed on them with no further notice or direct consent. Facebook has acted on this and intentionally made hundreds of thousands of people fall into a depression, just to see if they could, and then they bragged about it. The sentence quoted above actually means "friends’ information, like photos, was only accessible [whenever and however we wanted to]" as Facebook considers those people to have already "made a decision to share their information with those friends" when they signed up.

TAForObvReasons• 8 years ago

... and thus begins a new series of regulations designed to pierce the plausible deniability of "terms of service". People complain about GDPR and other regulations, but they are created to close loopholes that were abused by companies like Facebook.

frockington• 8 years ago

There's probably nothing FB wants more than to be regulated into a monopoly

atomic77• 8 years ago

It seems like we're seeing how scalable the mantra of "ask for forgiveness, not permission" really is.

Not Facebook scale, apparently.

JumpCrisscross6• 8 years ago

People complain about GDPR and other regulations, but they are created to close loopholes that were abused by companies like Facebook

I complain about GDPR because it buttressed Facebook's position [1].

[1] https://www.wsj.com/articles/how-europes-new-privacy-rules-f...

_jal• 8 years ago

from being used for any other purpose than to recreate Facebook-like experiences
they consent to having psychological experiments performed on them with no further notice

Sounds like the third parties delivered!

The difference between Facebook and a casino is more about the physical limitations of their storefronts than business models.

patja2• 8 years ago

Similar to how they "prevented" apps from abusing their API through policy, while simultaneously doing nothing with their construction of the API to prevent apps from breaking the policy. Apps are prohibited from filling in content that (by policy) must come only from the user, but oh we're going to give you all the tools and capabilities required to march right on ahead and do what we agreed you wouldn't do. Then proceed to inconsistently and incompletely enforce policy only when complaints are registered.

JorgeGT• 8 years ago

Regulations forbid us from letting you access the filing cabinet but I can tell you, all of us will be out having a beer between 6 and 8 PM. Oh, and the key is under the flowerpot. Wink wink.

knodi• 8 years ago

Sadly what FB is doing is using contracts to defer the blame in-case of legal action. Shitty but standard practice.

dominotw8• 8 years ago

Signed agreements do not prevent your information from being used in other ways.

Why is this, though? How is it different from any other legal agreements?

JumpCrisscross6• 8 years ago

How is it different from any other legal agreements?

Suppose I tell you a secret. You promise only to share it with others who will keep it a secret. You share my secret with Bob. Bob promises he won't share my secret. Bob shares my secret.

You broke your promise. You tried not to break it. But break it you did.

Liquix• 8 years ago

I think the argument is that saying "I promise not to murder someone" does not in any way prevent said party turning around and murdering someone - signing a contract does not prevent these companies from violating the terms of the contract.

_red• 8 years ago

Signed agreements do not prevent your information from being used in other ways. That's insane, literally.

The real insanity is with the users. FB did the most obvious thing. The user-base somehow magically thought they were providing all those free services because they were nice guys.

It was obvious to anyone since the beginning that FB was a clearinghouse for private data trading. How else could the model remotely work?

pas• 8 years ago

You target audiences (segments), and FB gets ad revenue.

The problem is that via apps you get the user info directly. And their friends' info too. That's how Tinder can show how many mutual friends you and the profile you're looking at have. That sounds nice, but as the data left FB's servers, there's no way that users can control what happens with it.

asciimo• 8 years ago

Obvious to some. When consumers receive a valuable service or product for free, with no obvious strings attached, they consume it. I don't think most people would preoccupy themselves with the provider or manufacturer's business model. You are savvy, and that's good. But others deserve consideration and protection.

untog2• 8 years ago

It was obvious to anyone since the beginning that FB was a clearinghouse for private data trading.

I tire of this argument that users should obviously know they are trading their personal information in return for access to a service. They don't know this. It's obvious in a conversation with any (even lightly) tech-illiterate person that nothing about how the modern internet economy works is obvious.

Think back to the emergence of the web as a truly popular medium. There was no Google Analytics, no FB tracking buttons that follow you around on every web site you visit (that one is particularly egregious - FB users are tracked even when they aren't on facebook.com, and we expect users to just know this?), just advertisers buying a banner ad slot from the owner of a web site. Back then social networking was, what, AIM? That was free and they didn't harvest user info for it. The change has been gradual, and the idea that users should have kept up with every development that led us to where we are today is preposterous.

When this has happened in the past the answer has been clear: knowledgable people come together to pass laws that benefit individual citizens who have neither the knowledge nor time to learn.

cafard• 8 years ago

Quite a few people I know signed up with FB when they were in high school. Some may have thought through the business model, I suppose.

naravara6• 8 years ago

It was obvious to anyone since the beginning that FB was a clearinghouse for private data trading. How else could the model remotely work?

This is just hindsight talking. It was hardly obvious from the beginning because it was hardly obvious how big the market for granular private data was going to be.

Facebook, in the beginning, was functionally just a stripped down personal page with a status update feature analogous to AIM. It didn't really ask for any information that you wouldn't have gleaned from a 10 minute conversation with a person and almost everything it got about you had to be volunteered (e.g. favorite music, movies, etc.)

The News Feed didn't get introduced until a few years in and it prompted massive outcry from Facebook users for how invasive it seemed, but even then most people assumed the problem was going to be that it violated some implicit social consensus where people should have to go looking for information about you, not have it sent to them in an notification blast. In other words: "stalking should be hard."

The ad-supported business model at the time didn't rely so heavily on micro-targeting by "revealed preferences," it was assumed they would target based on the declared preferences that you gave them (e.g. favorite movies, music, etc.) The idea that Facebook (or even data analytics as a field) would eventually become sophisticated enough to devour the news media in general and tailor you a bespoke reality based on your implied tendencies and personal weaknesses to manipulate you was, at best, fodder for some speculative cyberpunk fiction in the early days. In fact, Facebook didn't really even make forays into being a news clearinghouse/media aggregator until the mid 2000s when "going viral" became the hot trend in media, which is what ultimately led to the media world putting themselves over a barrel to social media companies by myopically chasing traffic in lieu of building an audience.

mkane848• 8 years ago

Oh no, the people at large don't understand the complicated interactions between law and technology, those fucking idiots, how dare they

bobdole1234• 8 years ago

Facebook doesn't sell data, they ads.

Those ads are targetable by categories determined from private data, but Facebook doesn't give anyone else the data, that's literally why people would purchase ads through their exchange and not through another exchange.

Google has the same model, they don't sell your data, they use your data to match you with advertisers through a fairly opaque interface that lets advertisers reach the categories of people they want to reach, without revealing the data to allowed them to put someone in that category.

Kind of like how your Mom will set you up on a blind date based on what she knows about what both parties want, but doesn't disclose all your information because she doesn't want anyone to be upset with her.

sideshowb2• 8 years ago

Facebook has acted on this and intentionally made hundreds of thousands of people fall into a depression, just to see if they could, and then they bragged about it.

That's interesting. Do you have a link to source?

jacobsheehy2• 8 years ago

I was banned from HN some time after I made that post (for something else) and should not be posting any more (sorry mods, I'll stop). This will be my final post.

Here's a news article about it (probably).

https://www.theguardian.com/technology/2014/oct/02/facebook-...

kmonsen2• 8 years ago

https://www.google.com/search?q=facebook+psychological+exper...

fakescience• 8 years ago

Likely referring to this article [1].

However, the claim that they made "hundreds of thousands of people fall into a depression" is pretty exaggerated - FB demonstrated it could influence the mood of users via changes to the algorithm, but the overall effect size was small (Cohen's d = 0.001).

I am very critical of FB and this type of research, but don't know if anyone became depressed over the experiment. It's possible, but wasn't demonstrated.

[1] http://www.pnas.org/content/111/24/8788.full

but0fCourse• 8 years ago

Summer 2014:

https://www.theguardian.com/technology/2014/jun/29/facebook-...

https://www.forbes.com/sites/kashmirhill/2014/06/28/facebook...

https://www.nytimes.com/2014/06/30/technology/facebook-tinke...

https://www.sciencenews.org/blog/scicurious/main-result-face...

https://www.washingtonpost.com/news/monkey-cage/wp/2014/07/0...

RichardCA• 8 years ago

https://www.youtube.com/watch?v=iFTWM7HV2UI

braindongle2• 8 years ago

Facebook has acted on this and intentionally made hundreds of thousands of people fall into a depression, just to see if they could, and then they bragged about it.

No, they did not. They adjusted the proportion of positive emotional expressions and negative emotional expressions in users' news feeds in order to test for an association between that proportion and emotional expressions in users' posts. There are serious problems with what they did, but "intentionally made hundreds of thousands of people fall into a depression" is late-Slashdot style trolling.

http://www.pnas.org/content/pnas/111/24/8788.full.pdf

zzzeek5• 8 years ago

unethical science does not deserve to be wrapped in its journalistic language in an effort to detach it from the harm it caused, it deserves to be called out for what it actually is, in this case intentional psychological manipulation of people's moods without their knowledge or consent.

One does not grasp the true harm caused by unethical experiments by reading only the documented (published or non-published) scientific results. Two extreme examples which I am by no means comparing to that of Facebook, but rather as canonical examples of unethical science, include the Tuskegee experiments and Nazi experimentation. Reading only the published results of these experiments does not convey the horrific harm that actually occurred. The same principle applies to referring towards Facebook's scientific data as an argument that these experiements were not unethical. The scientific results only serve to shroud and conceal the actual activity which occurred in the production of these results.

(edited for clarity)

phs318u• 8 years ago

late-Slashdot style trolling

Off topic but that ^^^ is exactly why, after 20 years, I finally gave up on Slashdot and then stumbled across HN and couldn't be happier. I have, in recent times, gone back for a visit just to see what it's like and... realised my decision to leave Slashdot was made probably 10 years later than it should have been.

oconnor663• 8 years ago

Signed agreements do not prevent your information from being used in other ways. That's insane, literally.

Yes but just two sentences later in the post...

And our partnership and engineering teams approved the Facebook experiences these companies built.

They're saying they inspected these apps. You jumped to "literally insane" so fast there.

PunchTornado• 8 years ago

Nope, you know that once the data leaves your server it is out of your control. These companies could have fooled fb representatives quite easily if they wanted.

adrianmonk2• 8 years ago

Signed agreements do not prevent your information from being used in other ways.

Breach of contract opens you up to civil liability. Having this agreement creates disincentives that wouldn't otherwise exist.

"Prevent" doesn't mean to make something physically impossible or remove the ability to choose. Police can prevent drunken driving by announcing they will have DUI checkpoints on New Year's Eve. It doesn't make it physically impossible to drink and drive, but if people choose not to because they want to avoid the consequences, some drunk driving has been prevented.

kolpa2• 8 years ago

Who is liable to whom when user A use a free service B based on an ambiguous agreement, and that service makes an ambiguous agreement with another service C, and C does something that is arguable a violation of one of those agreements?

How much restitution am I entitled to for an ambiguous violation of an amorphous concept like privacy? And how much is Facebook entitled to from a partner who (might have) violated that agreement, causing non-measurable harm to me?

drb912• 8 years ago

Police can prevent drunken driving by announcing they will have DUI checkpoints on New Year's Eve.

Well, it’s only prevention if it succeeds.... otherwise it’s just a failed attempt.

gist• 8 years ago

how else did you expect us to make huge sums of money

Your tone is as if to imply that nobody but the company benefits from making 'huge sums of money'. There are employees, vendors (selling goods and services), stockholders (retirees?), governments (taxes) and so on. Why the idea that earning money is somehow not the purpose of a company? It is at the core.

s73v3r_3• 8 years ago

But none of us care if they make huge sums of money or not. I fail to see why I should accept them being shitty because "they created shareholder value."

pkghost• 8 years ago

That's insane, literally.

Metaphor is literally dead.

kerng• 8 years ago

This is the same they said about Cambridge Analytica initially... but you can't just blindly trust others (in this case apparently 60 companies got priviliged access). If it's technically possible, then someone will do it. When your data is gone, its gone.

How naive is Facebook really?

dreamcompiler2• 8 years ago

They're not naive at all. When it's not in your business interest to manipulate reality, you manipulate perception.

nemild2• 8 years ago

I think it's a more complex picture. I did my own deep dive after years of reflecting on this:

Inside the Bubble at Facebook

"Management will laud what employees do, show them selective facts that justify their views, and hire/promote those who behave similarly to them. Employees in isolated teams with training in a single function may not realize the broad, unintended effects of their company's work. They'll assume the best of their coworkers that they've developed friendships with from working in the trenches, without inquiring into the larger effects they're having."

https://www.nemil.com/tdf/part1-employees.html

Would love feedback.

supercanuck2• 8 years ago

It seems they don't really disagree but are simply saying, its not as bad as you think. Is there anything factually incorrect in the New York Times reporting?

makomk2• 8 years ago

It's one of those articles that's technically true-ish so long as you redefine words to mean something very different from what people would expect them to, but is written in a way designed to misinform basically everyone who reads it.

For example, when they say "Facebook Gave Device Makers Deep Access to Data on Users and Friends", they mean Facebook let them write software that could be run by their users and give those users access to information their friends had shared. There's nothing technically untrue about this, but it gives a false impression about what information Facebook made available to who. It makes it sound like Facebook gave a big fat chunk of user data to device makers as a bribe to include Facebook on their devices, when in reality we're talking about giving their software the access it needs in order to actually provide access to Facebook in the first place.

I've seen a lot of very confused comments here and on Twitter as a result.

supercanuck2• 8 years ago

I think the point is, data goes into those companies and in some cases gets stored on their servers and from there, who knows what happens.

Facebook makes it sounds like the user is in control.

pishpash2• 8 years ago

It makes it sound like Facebook gave a big fat chunk of user data to device makers as a bribe to include Facebook on their devices, when in reality we're talking about giving their software the access it needs in order to actually provide access to Facebook in the first place.

These two things are not mutually exclusive. They effectively did both, even if the intention is unclear. You must have forgotten how bundled apps on OEM Windows worked.

davidw• 8 years ago

The fact that you can't read messages (without switching to 'desktop mode') on their mobile web app is such horse shit. Yuck.

hackerman12345• 8 years ago

That's what the Messenger app is used for.

parthdesai• 8 years ago

Right, the Messenger app that significantly slows down my phone and decreases it's battery life.

andrew_• 8 years ago

Yes, it's a tactic to get you to install that app so they can mine your calls, texts, and contacts.

jonknee• 8 years ago

Yes, that's part of the horse shit.

saudioger2• 8 years ago

Well no... there's nothing technically stopping them from supporting messages on mobile.

This is what they do on mobile:

* Lie to you about how many messages you have

* Ask you to install an app to see those messages

* Upon installing the app, give them permission to mine your data

newscracker2• 8 years ago

Either that or you can go to the basic version at mbasic.facebook.com for an even poorer (though somewhat better in some senses, like having messages integrated) experience.

kreddor• 8 years ago

Well, it definitely beats having to navigate the desktop version on mobile. Thanks for the link!

zakk2• 8 years ago

mbasic.facebook.com

Thanks!

chinathrow• 8 years ago

For now you can still read and write messages on https://mbasic.facebook.com - fast, pure HTML, no JS.

tr33house• 8 years ago

imposing `messenger` on all of us because they know none of us would use it if we had a choice

d4l3k2• 8 years ago

I just graduated college and pretty much all of my friends and everyone I knew there used Messenger as default for text communication. There's plenty of other alternatives, but that's what people seem to prefer. It's a pretty decent app and in my opinion way better than the old built in FB messaging.

I'd prefer to use Signal and my family uses it to communicate but it's definitely not as nice as Messenger.

zajd• 8 years ago

"Because we're paid to" - FB PR team

djhworld• 8 years ago

All these partnerships were built on a common interest — the desire for people to be able to use Facebook whatever their device or operating system.

Facebooks best interest, not 'common interest'

mkirklions3• 8 years ago

Building on FB is completely different than data-mining FB.

methodover2• 8 years ago

No, the user's interest. Users were logging into these devices, presumably. They wanted to access their Facebook account on them, Facebook and the device manufacturer figured out how to do it. It sounds like everything is working as intended, there.

newscracker2• 8 years ago

Security related issues need some time to investigate and to produce a proper report. This post seems like a knee jerk reaction. Actually, while this sounds like more PR fluff in a poor attempt to stem more scrutiny, I'm confident that there will be more reports from other sources providing a stronger case against Facebook's claim on this topic. This post makes it clear that Facebook is clueless if there are any weaknesses or breaches (despite shutting down 22 partnerships).

bobbyi_settv• 8 years ago

I didn't read/ watch the testimony before Congress. Did they flatly claim that "we no longer share private information with third parties"? Because if so, this post seems to confirm that that was a lie, even they give (arguably) good justifications here for why they share private information with some third parties.

Rjevski• 8 years ago

Oh I am so sad, Facebook is “victim” of lies and poor reporting, let me get my tiny violin.

Facebook lies every possible time, it’s built into their perverse business model. Even if the article was actually wrong, it’s only fair that they get a taste of their own medicine every once in a while.

AdmiralAsshat• 8 years ago

"We Disagree": the last refuge of a company's defense when they have absolutely nothing else to counter or rebuke their opponent's argument.

chiefalchemist3• 8 years ago

Perhaps Zuck isn't as bright as we all think? This reply is far too tech-heavy, and jargon-littered to be taken seriously as a reply to something as mainstream as the NYT.

Their PR problems aren't rooted in SV, yet that's who this is targeted to. It doesn't make (good brand) sense.

JumpCrisscross6• 8 years ago

Their PR problems aren't rooted in SV

Silicon Valley is the last place I'm consistently hearing full-throated defenses of Facebook. It makes sense to keep one's base in order.

chiefalchemist3• 8 years ago

That might be sure. But it's still not their bigger / biggest PR problem.

mathinpens2• 8 years ago

the only jargon in this is API?

seanalltogether• 8 years ago

The limited responses so far in this thread only reinforce many companies decisions to pull support for public apis. How many years have developers been complaining that twitter and facebook have been restricting access to apis for 3rd parties, but now all of a sudden they're evil for ever offering apis to begin with?

vorpalhex2• 8 years ago

There's nothing wrong with offering a public API. There's everything wrong with offering a secret, non-public API where you give a third party I didn't consent to full access to all of my data.

See how that's a bit different? One of them is offering public information (say, stock quotes), publicly. One of them is offering private information (my sexual orientation and date of birth) to tons of third parties I didn't consent to having that information shared with.

esrauch2• 8 years ago

Surely it is only giving blackberry the information if you type in your login credentials on a blackberry right?

I don't see how the situation is actually different now: if you run the official Facebook app on your Galaxh phone then Samsung could scrape and exfiltrate the data anytime it wants. It is Samsung's fault if they do it not Facebook's.

burkaman• 8 years ago

It's hard to believe you're asking this question in good faith. I'm sure you understand there's more to it than "APIs are good" or "APIs are bad", obviously the purpose of the API matters. If Twitter offered a public API for information that users hadn't realized they'd made public, that would be bad. When they pull support for an API for information everyone intended to be public and searchable, that is also bad.

patja2• 8 years ago

Offering an API is great. Just don't expect developers to voluntarily restrain their use of the API according to some words you put on a web page. Maybe most will do so, but a significant portion will growth-hack their way right past whatever policy they agreed to. If you don't want someone to do something with your API, you better make it impossible to accomplish using said API.

The problem is in offering an API that makes abuse trivially simple and putting all of your faith in the "click agree" model of expecting developers to (a) understand and (b) actually comply with your policy. Particularly when many of the developers in question are non-native English speakers, or even if they are native speakers and don't bother to read the policy carefully.

billysielu• 8 years ago

Funny they don't like fake news when it's about them.

zakk2• 8 years ago

It seems to me that the NYT allegations are not exactly fake news...

saudioger2• 8 years ago

Their argument here is basically like being accused of murder and using "since murder is illegal, we did not murder someone" as a defense.

dbg31415• 8 years ago

In every situation, people from Facebook would probably be better off if they didn’t talk.

This article is really just skeezy. Reads like “we were just doing all the stuff you accused us of, but it’s ok because we are huge creeps too.” It’s so cringe-worthy.

mkirklions3• 8 years ago

FBs reputation reminds me of AOL....

blueprint• 8 years ago

It’s hard to remember now but back then there were no app stores.

Bunch of nonsense. Of course there were.

mike00632• 8 years ago

What they should have said was, "Remember when our official app was garbage and you needed to rely on 3rd party apps to have a passable mobile FB experience?"

coding123• 8 years ago

Yep - I recall that the first iOS version that pre-integrated FB I recall specifically writing an email to a friend of mine that worked at Apple to blast Apple for including it - when there was a perfectly viable option for them to use the app-store. They didn't reply to that email, but we remained friends. That was about 8 years ago.

miracle2k4• 8 years ago

The New York Times should be ashamed of itself. Facebook let companies like Apple integrate with their platform.

To do so, these companies sent the same sequence of bytes from your mobile phone to the Facebook server, as the Facebook app does, or as any person can do. I can write my own Facebook app today, and there is nothing that Facebook can do about it, except sue me.

THAT IS A GOOD THING. LITERALLY FIVE MINUTES AGO THE COMMUNITY WAS FIGHTING IN THE COURTS FOR PACKAGES SENT OVER THE INTERNET TO NOT BE CRIMINALIZED.

Remember the whole thing about violating the terms of services of a company which forbids scraping making you a criminal hacker?

The only thing Facebook said to Apple is: Let's make a deal, we will not sue you, you put our logo into your phone, also we promise not to break your app.

No data was given to anyone! This is literally my iPhone/Samsung/Blackberry running an app that gives ME access to MY Facebook data.

It doesn't even go to Blackberry's server! The nerve of people to pretend as if the data ON MY PHONE is someone in the hands of a third party, as if my phone really belongs to the manufacturer. Again, we used to be fighting for the idea that these devices should belong be unlocked, should be under our control. Now you guys pretend that data my phone downloads from Facebook is somehow a violation because I decided to use an app that someone else wrote.

There is no possible universe in which that is bad. Think about the ramifications of these new ethics that people suggest here.

detaro2• 8 years ago

The NYT article says that Facebook told them that some partners stored that data on their servers. I note that this Facebook rebuttal does not refute that point in regard to the device partners. (Which could be a possible confusion or misleading quote in the NYT article, conflating all partners with the device integration partners, so I'd like it to be clarified somehow)

miracle2k4• 8 years ago

Sure. I still think that is fair enough, in particular since there are actual contracts involved here.

However, as you say, it is not clear at all. If that is the problem, the New York Times should write an article about that, not 5000 words of all kinds of insinuations, with the goal, it would seem, to generate the maximum amount of confusion, least amount of education, and thus the most amount of outrage.

cm2012• 8 years ago

Developer communities which pride themselves on their reason would rather not look at paltry things like details when a company they don't like is being criticized.

Djvacto• 8 years ago

Forgive what may be a not-fully-informed question/opinion, but isn't the issue that 3rd parties were able to see private information? Not public information?

Like you send the same sequence of bytes that they do, but the difference is that it should be different depending on who is sending the bytes, no?

miracle2k4• 8 years ago

The app that was written by Apple, or by Blackberry, had to ask you for your password first (or possible use a different kind of authentication were you had to allow access). Without that, they could not send the "right bytes", and thus, the Facebook server would not send back any private information.

In other words, it worked exactly like the Facebook app written by Facebook itself.

stealthefocus• 8 years ago

The one thing I really miss since leaving fb in March, are the groups. Things like playing in local sports pickup games are easier because everyone has fb so the groups were more active. I now use my wife's account for this, but I really wish another option had some traction, then I could leave fb forever.

mkirklions3• 8 years ago

I dont think there is anything wrong with using FB for things you want.

I dont scroll anymore. I check it for events and messages.

Thats it.

Do that 1-2 times a month, all my facebook needs are met.

oprah20183• 8 years ago

I don't even read anyone else's posts. I just post pictures of my amazing life. I use it like a diary. Or a time-series multimedia database.

456hdsaq234g• 8 years ago

Yes, but by having a facebook account, all their needs (your entire life) are met too. 1-2 times a month to read random junk from your friends for a lifetime of surveillance capitalism. Good trade off, no?

mlthoughts20182• 8 years ago

Even if a feature like this adds limited value, it's good to think about whether you can just live without it completely in order to leave Facebook.

For example, consider how the groups feature was abused to prey on people seeking addiction support -- and how even in the midst of such abuse, Facebook lauded some of the organizations in attempts to improve its reputation by highlighting what good it can do.

< https://www.theverge.com/2018/5/21/17370066/facebook-addicti... >

Basically every feature of Facebook that adds a tiny bit of value to a random person's life is actually just some deeply engineered data-harvesting dark pattern that opens up huge other groups to targeted harm.

I see a lot of comments of the spirit, "I would leave Facebook except ..." with some reason like it's the only way to see family photos, it's the only way to participate in online groups, etc.

Just delete it and leave. Share photos some other way. Find groups some other way. The population-scale downsides are just so serious and severe in the case of Facebook that people shouldn't be making the choice to stay on the platform anymore based on narrow-scope, small scale upsides that it offers for them in limited settings.

The huge, up-front, unlimited scale harms it facilitates are reaching a point where they need to be a daily civic concern for everybody.

arthurofbabylon• 8 years ago

In this FB response, they seem not to disagree with any of what the NYTimes had to say. This is called justification, not disagreement.

AzzieElbab2• 8 years ago

Your real data has already been mishandled by anyone from banks to healthcare providers to governments. This mass hysteria about FB is just silly nuisance constantly getting blown out of proportions by turf wars between FB and traditional media Oh and this particular case FB is calling the nyt fake news

theyinwhy• 8 years ago

With all that inside knowledge you probably should blow the whistle.

AzzieElbab2• 8 years ago

whistle whistle

zaroth• 8 years ago

Facebook’s response seems perfectly reasonable to me.

- Obviously in order to integrate FB functionality into a Mobile OS UI requires an API to render the data being displayed.

- If your phone has a home screen widget which shows friend data, obviously that friend data came from a Facebook API call.

- If you type your Facebook username and password into a settings dialog in order to enable that home screen widget to function, that’s pretty obviously consenting to enable the functionality.

- There once was a day when we demanded our social media platforms to provide these “open access” APIs to specifically allow for accessing our own social feeds on our own devices.

We trust our user agents to render our private information on our devices. Sometimes we even trust our user agents to leverage network services to improve the on-device performance (i.e. Amazon Silk)

If and when user agents exfiltrate our personal data off device for data mining purposes (i.e. Chrome Omnibar) it should be disclosed and opt-in.

It sounds like Facebook provided an API to device manufacturers to allow them to deeply integrate social features on device. This has historically been considered a Good Thing. It sounds like they put together a legal agreement that required these device manufacturers to take due care in implementing these features to protect user data. Also seems like historically this is what we would call a Good Thing.

When you enter your username and password in order to view your Facebook feed — that’s called a “user agent” and that’s something appreciably different than a third party quiz app sucking in friend feed data.

However, Chrome Omnibar aside, user agents are not expected to exfiltrate data in any way, and if that occurred, that would indeed be a story I’d like to read, and my ire in that case most certainly wouldn’t be directed against Facebook.

kmonsen2• 8 years ago

Device manufacturers can also of course trivially bypass any way facebook tries to hide this data from them as well if they really want to. They control the OS and it's implementation, nothing can be hidden if they really badly want to get it.

bastawhiz• 8 years ago

Your phone manufacturer can also theoretically just watch your phone's display output over VNC if they had that kind of control over your device. If you believe your device's manufacturer is deliberately working to actively steal data from third party apps on your phone, perhaps you should consider a different phone.

Eridrus• 8 years ago

When you enter your username and password in order to view your Facebook feed — that’s called a “user agent” and that’s something appreciably different than a third party quiz app sucking in friend feed data.

I think we're trying to make this different in hindsight, but APIs for this sort of thing are the replacement for "please give my app your Facebook password". I hope everyone remembers how Facebook used to ask users for their GMail password and how Mint (still) asks users for their banking passwords.

And if what you are doing is "giving an app access to my account", then letting them see everything you see is a pretty natural API.

I think over time we have realised that users want more fine-grained permissions so they don't have to make such difficult decisions of whether they "trust" an app, but I know that as a developer and user I get pretty annoyed when other software cannot interact with an app for me because the API is too limiting.

dmix• 8 years ago

Exactly, this seems to be coming from people who don't fully understand or appreciate the history or social/technical/economic environment from which it came about. Then they are retroactively applying our relatively recently evolved demands for fine grained control of data.

This type of thing in journalism really concerns me with the recent moral panic against 'fake news' and the attempts to create systems which define it. When what is 'true' or factual or not is so often subtle and easily spun/twisted. Which is ironic in this context because Facebook and NYTimes are both leading players championing these efforts.

basseq• 8 years ago

Mint (still) asks users for their banking passwords.

In defense of Mint, most banks are severely behind the curve when it comes to authentication, and there would be no way to provide that service otherwise.

Where the financial institution has a better API, Mint happily supports it. (Interactive Brokers, IIRC, is an example of this.)

adrianmonk2• 8 years ago

There once was a day when we demanded our social media platforms to provide these “open access” APIs

And we still demand them for other types of apps.

If I have a Mac or iPhone, I can connect the Apple-supplied Mail app to Gmail with IMAP or POP or whatever it uses. If I have Windows with Outlook, I can connect it to whatever mail server too. And this software gets access to all the content of my emails, which is private data.

Likewise, on a smartphone, I can install a third-party app to access Hacker News or Reddit. Because both of them have an open API. (In fact, for a long time there wasn't an official Reddit mobile app, and they encouraged you to go third party.)

davegauer• 8 years ago

It occurs to me that in addition to the usual list of permissions for apps, perhaps we should also be presented with a whitelist of domains the app is allowed to communicate with.

michaelmrose• 8 years ago

My email client has full access to the contents of my email but the author of said client has none. Although my client has credentials these are stored locally and like my email never communicated to the creator of my client.

If the device makers applications merely fetched data on behalf of users and displayed it on their machine it would be no more of a problem than my email client.

In the first place it looks the apis provided access to data the users had opted not to share in the second place the times article seems to state that partners partook of that data themselves rather than merely acting as a client example

"Facebook acknowledged that some partners did store users’ data — including friends’ data — on their own servers. A Facebook official said that regardless of where the data was kept, it was governed by strict agreements between the companies."

Before deciding if facebook's response was reasonable did you even bother reading the times article?

makomk2• 8 years ago

The APIs provided access to data that had been shared with the person who was logged into the device, but not with random Facebook apps like Farmville. The New York Times' argument is essentially that the flag which stopped Cambridge Analytica and Zynga getting access to your data should also have stopped your actual friends from viewing it except through installing Facebook's official app.

It's hard to see any way in which making users choose between sharing their info with every dodgy quiz their friends use and forcing their friends to install the Facebook app and let it get its tendrils into their devices in order to interact with them would've been good for privacy, but this is exactly what the NYT is insisting Facebook should've done.

mic47• 8 years ago

"Facebook acknowledged that some partners did store users’ data — including friends’ data — on their own servers."

This statement from the article is meaningless, as many legit things might mean "third party storing data" as: 1.) Storing and editing contact imports, if user wants. This is technically friends data, but it's my contact list. 2.) Proxy-ing and caching: we are talking about shitty phones mostly before android and ios were mainstream, so "store on their servers" could be as simple as an artefact of implementation of non-html facebook client app on that shitty phone. Example of such artefacts: custom notifications channels, caching, downscaling of images. I think that blackberry did proxy all of their communications through their servers (not 100% sure), so if Facebook was available, they probably also had to store something on their servers.

The journalist didn't even attempted to distinguish between "my device is calling this api" and "company is doing requests" and resort to conflating those two and ambiguous "some partners did store users". This is example of journalist trying to create a story instead of getting to truth. If they would dig deeper, and try to figure out which companies stored data, what type of data (was it contact import, caching, or did they download full graph?), and what was purpose, it would be valuable article.

candiodari• 8 years ago

Yeah the problem that keeps, and keeps and keeps coming back is that cloud based software gives too much control to the software authors.

Because that's where the ground of your argument sits: because of server-side "rendering" the data must be sent to the servers of the software author, in this case Huawei but doubtless many others, instead of to the device that actually displays the information.

... and that's exactly why everybody's doing cloud based software. Because it allows them to abuse this. And once they've got the customer by the ... they ask money for that.

Cloud based software is how the author of a todo-list app can hold users' data hostage more effectively, more detrimetentally to the customer than Microsoft's monopoly that was blown up in the cause of justice.

spankalee2• 8 years ago

I'm no huge Facebook fan - hardly use it these days, but...

These apps are just alternative Facebook clients. Don't we _want_ a system where you can use different clients to access your own data?

If the problem is not trusting the client, well, that'll be a problem for any such system, even some utopian fully open, distributed and federated social network - until you build an open source client yourself.

gengkev• 8 years ago

I think the problem is Facebook's lack of transparency here. As a user, suppose I have some information that I've marked as "not available to third-party apps". Then I might be surprised to find out that Blackberry's servers have access to that data via a secret API, even if it is to implement a "Facebook experience".

cjhopman10• 8 years ago

Would you also be surprised to find out that Mozilla (Firefox), Google (Chrome), Samsung (Android Browser), Microsoft, etc. all have access to that data?

pmontra2• 8 years ago

It seems that FB gave to those clients an API to access more data than the user allowed. The Blackberry used by the Times got data about the friends of the journalist even if those friends didn't consent to that.

One thing is allowing the official FB client to see those data (FB has those data anyway), another thing is to let third parties see them and possibly store them on their servers and not only on our devices.

This is different from email and email clients. First, the expectations are different: if I send you an email I expect that you can forward it to your friends or anybody else unless I explicitly ask you not to. Second, local clients don't send mail to their authors, same for address books. Third, we know that Google and others can see most of our mails anyway, because most people use only webmail and messages are stored on the servers of those companies.

Finally, FB didn't tell us about this API and what it can do. It's this secrecy that's hurting them IMHO. Sure, I concede that they couldn't foresee the current climate around their company when they made the choice not to advertise it, or we wouldn't be in this situation now. But we're here also because of chain of bad choices from their side.

My suggestion for a social network of the future is to have a single API, used also by the official client. The servers must not trust any client, which is the usual thing we do in web development, and give all them the same level of access. It's up to the user to decide if they want to use the official client or one of any third party.

Sacho2• 8 years ago

I'm not sure this is a fair reading.

The Blackberry used by the Times got data about the friends of the journalist even if those friends didn't consent to that.

They did consent to that - by becoming your friends! Are you saying that every time you open your friends' Facebook pages, a notification should be sent to those friends requiring consent?

I think perhaps you meant something else - the Blackberry got data about the friends even though the user did not consent to that:

The Hub also requested — and received — data that Facebook’s policy appears to prohibit. Since 2015, Facebook has said that apps can request only the names of friends using the same app. But the BlackBerry app had access to all of the reporter’s Facebook friends and, for most of them, returned information such as user ID, birthday, work and education history and whether they were currently online.

This is also questionable. Would you say that Chrome requests and receives prohibited data, when you use it to browse your friends list? We are talking about the distinction between client(full access) and third-party app(limited access). The cases described in the NYT article seem to be clients.

Further on your point:

This is different from email and email clients. First, the expectations are different: if I send you an email I expect that you can forward it to your friends or anybody else unless I explicitly ask you not to.

You seem to be making an argument against your claim here. The parallel would be, if I accept your friend request, I expect that you can see my data and use it(i.e. by browsing your friends list on the Facebook site, or the Blackberry client).

Second, local clients don't send mail to their authors, same for address books.

Perhaps, but doesn't that hinge on the definition of "local clients"? For example, my Outlook definitely shares information with a cloud server. Was "The Hub" an unknown/unexpected feature of the Blackberry client?

Third, we know that Google and others can see most of our mails anyway, because most people use only webmail and messages are stored on the servers of those companies.

Are device manufacturers not included in those "others"?

The email client parallel with Google is even more in Facebook's favour. For example, is Mozilla stealing data about my friends when I use Thunderbird to access my gmail account? What if I explicitly ask it to store my emails in a "hub" of sorts, so I could sync them between PCs?

Finally, FB didn't tell us about this API and what it can do.

I think this is the strongest point, but it's important to note that we are judging Facebook's old decisions by our new increased focus on privacy and user-focused control. As one user gave an example, we used to give our passwords to sites back in the day, so they could integrate with other services(actually, this still happens in some apps..)

My suggestion for a social network of the future is to have a single API, used also by the official client. The servers must not trust any client, which is the usual thing we do in web development, and give all them the same level of access. It's up to the user to decide if they want to use the official client or one of any third party.

But isn't this literally what is happening here? The "secret" API does not have access to any data the "official" one(used by the site) doesn't(at least, the NYT does not present any evidence to that effect). You also seem to access it by giving your credentials to the "third party client", i.e. no "special access".

mlb_hn2• 8 years ago

Facebook's making the distinction between allowing a device to offer Facebook-like services (which require Facebook functionality) and third-party apps that suck up all your friend data.

On the one hand, Facebook's got a point, that if you want to be able to use Facebook on a device without going through the Facebook app or the website the device needs to be able to authenticate onto some sort of API.

On the other hand, the NYT article makes the claim that the makers of the devices got access to the Facebook data, writing "Facebook acknowledged that some partners did store users’ data — including friends’ data — on their own servers". However, Facebook never followed up on that in their article, just pointing out that if you are logged into Facebook on a BlackBerry that the BlackBerry can make the same requests you could if you were logged into Facebook through the web browser.

The question that matters which neither side addresses well is how much of that data makes it to device maker servers (for a while, the NYT homepage was claiming 'dozens' but they removed that and it doesn't appear to be substantiated in the article).

There are related worries with the device having access to the Facebook data itself, but at that point you need to start worrying about malicious activity by device makers in general. E.g. will my phone start sending my web history back to its maker as well? my bank account numbers?

arcbyte3• 8 years ago

The fact that "data made it to device maker servers" is a stupid, meaningless point. Of course it hit their servers. And it should hit their servers. It's idiots who don't know what they're writing about causing hysteria among idiot's who don't know what they're reading in order to sell advertising dollars.

And the whole time they're pointing at facebook as the corrupt ones.

mlb_hn2• 8 years ago

I'm not sure it's meaningless. It seems to me that there is a distinction between [device manufacturer X is building their own copy of Facebook's graph by acquiring friend data] vs [device manufacturer X allows a user to login to Facebook and access friend data on their device without having to use the web browser].

rando4442• 8 years ago

I can see no reasonable need for device manufacturers to have your facebook data (and that of your friends) stored on their servers.

Care to elaborate on why this data should be allowed to leave the phone? (and be allowed to be collected regardless of user's privacy settings)

ptero• 8 years ago

These partners signed agreements that prevented people’s Facebook information from being used for any other purpose than to recreate Facebook-like experiences.

That is a big door and a pretty open use case. I am not buying into "and this is actually good for the users" story.

To me, FB must clearly choose how to handle this: (A) "we made a mistake, sorry; we will fix it" or (B) "this is working as designed; if you do not like it, go away". They could probably justify either case both internally and externally (better ethics vs better revenue), but trying to stand in the middle as they have often done in the past will likely backfire. Buy more popcorn. My 2c.

bluesign• 8 years ago

NYT says: ‘Some device makers could retrieve personal information even from users’ friends who believed they had barred any sharing, The New York Times found.’

FB says: ‘Contrary to claims by the New York Times, friends’ information, like photos, was only accessible on devices when people made a decision to share their information with those friends.’

This is the only disagreement as I can see.

mlthoughts20182• 8 years ago

It seems like a huge issue though. And we need to know in what precise way did Facebook enforce this with third-parties and verify compliance. If they just put it as a line in a comtract, but left the ability to circumvent this open in the device integrated API, and then never did due diligence compliance checks, then Facebook’s defense is entirely disingenuous and it’s reasonable to view them as culpable.

romwell• 8 years ago

Well, this is a huge difference.

If FB is correct here, then the whole thing is a non-issue. Some API giving access to the data otherwise available through a web browser is a good thing.

On the other hand, if an API provides access to information that isn't accessible through a web browser (and doesn't show in the official FB app), then it's reasonable to loudly complain.

rando4442• 8 years ago

NYT said relationship status, religion, political leaning and upcoming events, among other data were shared.

FB saying "we didn't share photos" is trying to say "well, we didn't give away everything"

captainmuon• 8 years ago

Incredible, they are using the current controversy to represent their locking down of the API in a good light. Facebook didn't restrict their API because they were privacy-conscious. They restricted it so you could not build experiences they did not want:

- You cannot sync your address book contacts with facebook in order to get profile pictures (you used to be able to do this)

- You cannot write an alternative Facebook client (with a better timeline, no ads, ...)

- You cannot write a complete bridge to another social network (e.g. implement Federation)

- You cannot build a P2P (serverless) application over Facebook. E.g. a chat, or something to send a file to a friend on Facebook, or to initiate a TeamViewer-like session.

All of these are either explicity forbidden by policy, or have been closed by specific changed to their API.

To be honest, I don't care too much that people were able to scrape data I put up voluntarily. The German Facebook clone was called StudiVZ - Student's Directory. This sounds a lot like a telephone book, and that was the mindset and expectation I had when signing up to Facebook. Create and curate a profile for friends and friends-of-friends to see, and I didn't care much if others saw anything, because it was irrelevant to them. I mostly cared about meeting people - being found, and finding other people. In this light, I'm more concerned about data freedom than data protection. While the latter is important of course, it's unfortunate that the former is always forgotten.

jbeckham2• 8 years ago

I had a Windows phone that used these API's. When Windows Phone 7 came out, Facebook didn't create the Facebook App for that OS, Microsoft did. It looked like what you expected Facebook to have built and it worked like the Facebook App that other platforms had. The whole purpose of the API agreement with Microsoft was to guarantee that the Facebook App they wrote would still work years down the road. Microsoft did not have access to my data. They were allowed to write an app that allowed ME to access my data.

The NY Times article makes it sound like Microsoft was allowed access to my data. They were not. They were allowed to create an app that had access to an API so I could access my data from the Windows Phone device.

detaro2• 8 years ago

The NYT article says that Facebook told them that some partners stored that data on their servers. Do you have a good citation that this does not refer to these device integrations, given you so strongly claim it doesn't? (It's very well possible that it's a misleading quote by the NYT, or a misunderstanding, but I don't see a clear answer in any of what we know) That's from my perspective the critical point here.

jbeckham2• 8 years ago

No I do not. I do know that the Windows Phone version communicated directly with Facebook due to network traces I had done back then. It did not use an intermediary. I could see some devices using an intermediary, especially for under powered and "dumb" phones where they may have made a simplified web app that would be usable on their platforms where as the actual Facebook web app would not have been. Think flip phones that had Facebook integration.

I don't know if that happened or not, but the way this article reads is very misleading and several of the vendors that they listed did not actually have access to the data.

d4l3k2• 8 years ago

It sounded like a number of devices provided contact syncing with Facebook as well as the ability to backup your contacts and data to the device manufacturer servers. Now, they might have been storing other data that they shouldn't have, but backing up synced FB contacts by itself seems pretty tame.

I personally setup FB to do contact syncing with my Google contacts so I could get the FB profile pictures for all of my contacts. Does that count as Google improperly using FB user data? I don't think so.

albertgoeswoof3• 8 years ago

Surely that applies to every API in existence, for example, on the HTTP API I'm using right now to post this comment, I know that Mozilla stores some of my data on their servers (through FF Sync), and HN know that's possible, but it's not up to HN to ensure Mozilla aren't taking that data and selling it elsewhere.

cjhopman10• 8 years ago

If you sign in to facebook in Opera mini, opera will store your facebook data on their servers. How much does that upset you?

laken• 8 years ago

On Windows Phone 7, Facebook integrated with the Contacts app, so your Facebook friends would be added to your contacts, and their images would be added to their contacts if they didn't have one set. That's probably what it is, as that would then sync with your Outlook account for those contacts

textmode• 8 years ago

The author does not provide a link to the NYT article to which this is a response. Maybe it was just an oversight.

https://www.nytimes.com/interactive/2018/06/03/technology/fa...

md2242• 8 years ago

Correct me if I'm wrong, but my impression is that this all comes down to one basic question:

Does a Facebook-approved "mobile experience" count as an official FB app or a third-party app? It seems to me that the FB post is trying to frame it as the former, and everyone who's upset is trying to frame it as the latter.

Is that what this entire disagreement is about? Because if it is, maybe it would help if we just focused on that question.

pishpash2• 8 years ago

Did you consent to anything that Facebook approves when you consented to using Facebook? Did you consent to the transitive property?

How does Facebook approving of some obvious third party make the third party not a third party? Approval and third party status are orthogonal.

mathinpens2• 8 years ago

writing this was a mistake. this is clearly a deceptive pr spin fluff that is entirely non-responsive to the specific concerns raised in the new york times article.

bbzealot• 8 years ago

A bit off-topic, but it bugs me how the picture in the article shows a Blackberry Bold running the BB10 OS, which never supported such device. I wonder why they showed a (probably) photoshopped device instead of a real one.

phlo• 8 years ago

In this specific instance, the Times article might be overblown.

They specifically mention that they were able to use BlackBerry Hub with a reporter's account to query Facebook data. The article never states whether BB Hub connects to Facebook directly, or whether it receives data from a BlackBerry-operated service.

The latter case is clearly user-hostile. If BlackBerry (the company) can read user data and Facebook claims not to allow 3rd-party access, then that is bad, and it should be treated as a breach of the user's trust.

The former case is more complex. As a user, I care a great deal that I can access Facebook using my choice of browser, whether that's Chrome, Firefox or Edge. I shouldn't be limited to the top three either. Some users may prefer a browser that works with their screen readers, others may prefer the built-in browser in their smart TV, and others yet might prefer a unified messaging app, like BB Hub.

The distinction between what happens locally or in the cloud is often unclear, and it's not getting any better. Chrome on Android wants to accelerate mobile connections by routing them through a compressing proxy. I can get an extra-secure version of chrome from authentic8 to protect against malware, with the caveat that it runs in their datacenter.

I feel that the tech industry in general, and Facebook in particular are struggling to tell users what happens with their data. Sometimes it's because things actually are complicated, and sometimes just to hide obvious overreach. The obvious blowback: complaints, strict regulation and mistrust. As the people who build and run systems, we should strive to do better. Regain the trust lost by past mistakes, and get back to the point where one could realistically apply hanlon's razor to reports of user surveillance.

mcguire4• 8 years ago

"Contrary to claims by the New York Times, friends’ information, like photos, was only accessible on devices when people made a decision to share their information with those friends."

Hasn't FB had a history of assuming the decision was positive if the user didn't opt out, through a difficult procedure?

fixermark• 8 years ago

It is, of course, useful to remember that "These partners signed agreements that prevented people’s Facebook information from being used for any other purpose" was ostensibly the back-stop against the mass-harvesting undertaken by Cambridge Analytica, also.

paradroid• 8 years ago

People don't read terms of service. In using your phone who knows what you agreed to let your phone company do with your FB data.

albertgoeswoof3• 8 years ago

I unexpectedly agree with FB here.

If NYT are correct then we can kiss goodbye to APIs that are used by any services that are not explicitly written and signed by the service provider. In the extreme that means you won't be able to log in to facebook on the web, only via a facebook app, because there's no guarantee that a 3rd party web browser isn't stealing data. That goes for any and every service dealing with personal data, and we pretty much lose the open web.

I want to protect user's data as much as anyone, but if a user deliberately installs a 3rd party app and enters their credentials into it, then they are consenting to that having access to their data under that app's privacy policy/terms. This should be obvious to all users, especially where GDPR advice has been implemented.

alangpierce• 8 years ago

In the extreme that means you won't be able to log in to facebook on the web, only via a facebook app

Taking that even further, if you really want to avoid the need to trust anyone, you'd need to run an operating system created by Facebook running on hardware created by Facebook. Otherwise, the OS and hardware vendors of course have access to your personal data. I guess it's all a spectrum, and certain hardware/software vendors you just need to trust (or at least assign blame to them, not Facebook, if they maliciously steal your data).

MAGZine• 8 years ago

That goes for any and every service dealing with personal data, and we pretty much lose the open web.

Some might argue that centralized walled-gardens like Facebook are actually a risk to "the open web," rather than contributors by allowing access to some data via an API.

amaccuish• 8 years ago

I wouldn't be worried about BlackBerry, it's Samsung. I will never use their phones again with their fingers over every part of the Android pie.

criley23• 8 years ago

Crazy that everyone in here is defending Facebook.

- How on earth does Facebook justify giving direct API access to information that users have, in every setting possible, marked as private?

- How on earth does Facebook justify offering deep API access on users who have literally disabled API access to their data?

It's ridiculous, and it's more ridiculous that users here are conflating "basic API access with a sane permissions system to give you control" with "deep API access with no privacy controls whatsoever that openly defy existing privacy controls".

It's not acceptable, and frankly, this is EXACTLY why government regulation of data online isn't a possibility, it's an inevitability. Because when the penalty for ignoring the user's selection of "DO NOT MAKE MY DATA AVAILABLE OVER THE API" and "DO NOT MAKE MY DATA AVAILABLE TO FRIENDS OF MY FRIENDS" etc is now billions of dollars in damages and potentially criminal charges for executives, magically, these violations will stop occuring.

Until then, everything in this document is either a lie or sufficiently legalese'd that it's worthless, just like the lies that they told to Congress, just like Zuckerberg's lies to E.U. as well.

I cannot wait until it is a crime to share private user data against their will. We live in a wild west and the past 10-15 years are proving just how much sheer damage we have caused in society by not criminalizing disrespect of digital privacy.

prepend3• 8 years ago

“How on earth does Facebook justify offering deep API access on users who have literally disabled API access to their data?”

Here how it seems really non-crazy to me as a programmer. Let’s say I make phone with a Linux OS. I want to make an app to let users check Facebook on my weird OS. I ask Facebook, they say no. I then build an app to call their API and let users do stuff.

All my app does is call the API and show it to the user. In order for the app to function it has to use private data. But the data are not retained or analyzed, just used to operate the app.

This is how all 3rd party apps work. The APIs were not for the general public, but only to trusted third parties. The alternative is that only Facebook can build and show apps.

So this is pretty much how APIs have worked forever and why you only install apps and log into apps you trust.

It would be like complaining that Adobe Reader can read private files from your laptop via Windows/Mac APIs. Of course it can, this is good. It’s bad of Adobe were to misuse the data.

pmontra2• 8 years ago

Private means that I (the user of my own FB client) can see my private data. That's obvious. What must not happen is that I can also see data that my friends, or their friends, marked as private. This doesn't happen in the official FB client and must not happen with any API.

cjhopman10• 8 years ago

You do realize that facebook will share user's private information with any random web browser that the user enters her credentials in, right? Is that "ridiculous"?

criley23• 8 years ago

If a friend of one of my friends, who I am not connected with, can acces my private data despite my settings being clearly limited, with API access disabled, "friends of my friends" settings disabled, as was reported is possible, then yes that is ridiculous.

However your reply completely fails to grasp the problem, like so many others. It's not the fact that I type in a user/password and get my data, it's that, I type in my user/password and Facebook authorizes access to as many as 10,000 to 100,000 other accounts data, based on proximity to my account.

methodover2• 8 years ago

- How on earth does Facebook justify giving direct API access to information that users have, in every setting possible, marked as private?

The user logs into Facebook on the device. This log-in action the part of the user is effectively permission to share data with the device.

- How on earth does Facebook justify offering deep API access on users who have literally disabled API access to their data?

When the user logs into Facebook on the device, they are giving permission for their data to be transferred via an API to that device.

I do not understand your outrage.

criley23• 8 years ago

The user logs into Facebook on the device. This log-in action the part of the user is effectively permission to share data with the device.

As well as the data of 10,000 to 100,000 connected users as both friends and friends of friends have data pulled without any checks by the third party.

"When the user logs into Facebook on the device, they are giving permission for their data to be transferred via an API to that device."

When the user selects to have their data limited to friends only, and not friends of friends, then additionally disables API access to their data explicitly, no, they are not "giving permission for their data to be transferred via API".

They are quite explicitly doing the opposite.

My outrage, stated multiple times and oddly invisible to the users here, is that my user/password doesn't authorize the third party to access 10,000 to 100,000 other users private data, and those users personal settings should override any third party data hose utility.

whytaka• 8 years ago

So will Facebook take legal action against these companies who violated their service agreement?

niuzeta• 8 years ago

This is the article that this article responds on: https://www.nytimes.com/interactive/2018/06/03/technology/fa...

julien_c• 8 years ago

This should be the top comment.

bo1024• 8 years ago

This is a really interesting moment and is worth some introspection.

On one hand, Facebook is clearly correct: If FB makes an API, and a user gives an application (written by a third party and run on a fourth party's device) their username and password, then FB cannot be blamed for the application using the username, password, and API to retrieve private data. Indeed, that's the point.

On the other hand, appearances make it look like Facebook is hiding some things: why is this not a public API? What trust are you putting in these third parties, what are you giving them that not everyone would be trusted with?

But most of all, people are waking up to the vulnerability of their private data. They are realizing that some things they've been taking for granted for years are dangerously insecure. So we have users, such as reporters, suddenly realizing that their device has access to all the data you view on it. Any third party app you give your FB uname/pwd to has access to everything on your Facebook, and the only limitation is whatever their terms of service are. (So does any software that app runs on top of.) Coming to this realization, we see backlash not always correctly directed. It would make at least as much sense to call out those third parties rather than FB, and ask them to prove they do nothing nefarious with this trust.

Is it too optimistic to hope this will stir mainstream interest in free and open source software?

agentPrefect• 8 years ago

As a non-user of Facebook, I completely take their side with all of this.

1) If people don't want to read the fine print, whose fault is that? 2) How have we gotten to a point where we are abdicating our choice voluntary, and then acting begrudgingly toward the new owners when they misuse it?

I must apologize for my cynicism here, but we've been going around this mountain for a very long time now (circa 2013 IINM?). I'm getting tired of hearing how people are feeling violated due to their own actions.

duxup• 8 years ago

These partners signed agreements that prevented people’s Facebook information from being used for any other purpose than to recreate Facebook-like experiences.

Two people you don't know made a deal about how to use your information without telling you. There is no reason to think they are going to keep that deal, no reason to think anyone is actually checking up on your information, and no reason to think either of them cares... and no way to know if anyone actually keeps the deal... and probabbly no recourse even if you did know someone broke the deal.

GuardianCaveman• 8 years ago

It seems like a lot of Facebook employees are commenting on this thread. I wonder if they have tools to influence the public argument similar to the Russians.

diogenescynic• 8 years ago

Who in their right mind would trust Facebook over the New York Times? Try again Facebook. I’m kind of glad they are doing this, I think it will speed up their decline in the end.

Jaruzel• 8 years ago

This took a lot of time — and Facebook was not able to get to everyone.

Spoken like the true Anti-Privacy Overlords they are. :(

vqng• 8 years ago

lol where are these people back then when Facebook released the APIs? I bet even if they were asked to give consent, they would not be able to foresee what's happening today.

mushro_Om• 8 years ago

I feel the response is similar to Apple's antenna-gate. Using competitors along to prove their point. Could have communicated better. Good that they took steps couple of months ago to close their legacy APIs. That's the only key takeaway from the post.

oculusthrift• 8 years ago

Imagine if this same thing happened with Microsoft and imagike people’s reactions.

arh68• 8 years ago

A lot of people are missing the point, debating whether this was reasonable or not.

Mark got away with telling Congress ~"we don't share with third parties" and now they're saying Blackberry's not a third party.

If it's all okay, why didn't Mark come clean? and tell his Congressmen? He had a chance to explain this arguably-harmless behavior, but he chose to sidestep it. Why? Did he not understand the question?

It's fine that this data-sharing is maybe reasonable. It's not fine that Mark withheld this from Senators. This is exactly what they were asking about, and given the chance to explain, he chooses silence. He gets to avoid the public debate while the techies argue amongst themselves.

Sacho2• 8 years ago

It seems like Mark would always have to answer 'yes' to that question, since accessing Facebook via the web means you share your data with Google(Chrome), Mozilla(Firefox), Microsoft(IE), etc..

(Also any OS/kernel manufacturers who get access to your data through your usage of the OS or TCP/IP stack).

Facebook is sharing your data with Blackberry in the same manner.

I don't even see a consent difference, since you need to explicitly consent to sharing your data by entering your Facebook user/password into the Blackberry UI app. Similar to how you write your user and password into Chrome, thus "sharing your data" with Google. It also doesn't seem like there's any evidence that the UI apps were intended to secretly collect and store data(Was "The Hub" an unknown feature?)

I don't believe the evidence presented here invalidates Mark's answer. His answer would have been meaningless if he had taken the definition of "third party" put forward in the NYT.

ddtaylor• 8 years ago

I don't have high expectations for a company that says they take privacy seriously while constantly invading it and playing dumb.

Why We Disagree with The New York Times

Related Stories