5 ms·

Zuck's Events (Facebook Privacy Hole Demo)

72 points by yef 16y ago

milkshakes 16y ago
It's worth noting that this information was already available publicly before f8.
- tewks 16y ago
  Set your privacy settings on lockdown and then put your own Id in instead of "4". This is undesirable behavior.
  - milkshakes 16y ago
    I agree. However, this isn't a new development. It's just more in your face now.
    - tewks 16y ago
      Was this true for all users or just "4" prior to f8?
      - milkshakes 16y ago
        With a valid sessionkey, I could get a list of the public events that any user was invited to, as well as the ones they RSVP'd for.
  - smokinn 16y ago
    Are you sure? I'm checking myself and nothing is available other than my profile photo. /[my id]/events data (empty) Maybe his privacy settings aren't as stringent as mine?
    - milkshakes 16y ago
      It only works with publicly listed events
      - ori_b 16y ago
        But you could already look at publicly listed events and find out who was attending. This - in principle - isn't exposing any more information than what was previously there. It just makes it easier to access. Sure, it still sucks. But it's not a major new security breach. All that it exposes is already there.
jpeterson 16y ago
There will eventually be a great turning point on the web when everyone finally understands most of the privacy issues and makes a decision on whether they really want their lives to be private or not. If they go for privacy, Facebook will fizzle out--their business model depends fundamentally on invading privacy. If not, Facebook may just take over the world.
- simon_ 16y ago
  Obviously some people will choose one way and some people the other. And Facebook will continue to serve those that are willing to trade privacy for convenience/connectedness.
  - jpeterson 16y ago
    You're right, that is obvious. I guess what I'm saying is that it will be a very lopsided split.
    - axod 16y ago
      I'm not sure how you can call that. Also I'd dispute your statement "It's business model fundamentally relies on invading your privacy". Without any invasion of privacy, they can probably make a few hundred million a year from random ads. Using your demographics to target ads better at you probably raises that to a few hundred million more. So IMHO, invading your privacy is in no way necessary for Facebook to operate. It just allows them to optimize a little better.
      - Silhouette 16y ago
        I think you're underestimating the difference in revenue potential between targeted and untargeted advertising. The jury is out on whether Facebook actually has a sustainable advertising revenue anyway, but I'd guess that the potential income probably drops by an order of magnitude if you can't target specific demographics.
riffer 16y ago
Whatever you think of Mark Zuckerberg, you have to respect him for this. He knows his information is available through the API, he has chosen to make it publicly available. It is ultimate dogfooding; equivalent to being able to see Eric's and Larry's and Sergey's searches. EDIT: blackswan is right; tamed down the comparison to Google in the last phrase
- CWuestefeld 16y ago
  On the other hand, his celebrity is now giving greater exposure to the activities of his associates -- they're getting dragged in without much of a choice. I don't think that's very noble of him at all.
- blackswan 16y ago
  It's actually like seeing only a small selection of Larry and Sergey's searches - not all of Zuckerberg's content is public. He says so in one of his status updates that is public.
javajones 16y ago
Is there another posting for this? I can't get to the article through the link.
- milkshakes 16y ago
  yup: http://news.ycombinator.com/item?id=1294632 http://news.ycombinator.com/item?id=1294632
JangoSteve 16y ago
This seems to integrate exactly with your existing privacy settings, so I guess there was no real surprise here. Mine were pretty much on lock-down anyway. I found myself, and every single link except my profile picture and my likes showed "data empty".
aroon 16y ago
I'm not sure why people are so offended by what Facebook has done. They've just made the information people made publicly available already easy to parse for computers. Full disclosure: I had no way to prepare for Facebook's new features and I haven't change a single privacy settings since it launched. I just used this site to check what was publicly available for the first time and none of it was a surprise except my events and I don't feel invaded in any way. Feel free to browse around my profile. http://zesty.ca/facebook/#/aroon http://zesty.ca/facebook/#/aroon
- milkshakes 16y ago
  what bothers me is not that people can see what I've rsvp'd to, but that they can see what I've been invited to, but ignored (unless i remove that event, which must be done manually for each event). My friends invite me to a lot of events that I _never_ want to publicly be associated with, but unless I specifically remove this event, the whole world can see it.

72 points by yef 16y ago

milkshakes 16y ago

It's worth noting that this information was already available publicly before f8.

tewks 16y ago
Set your privacy settings on lockdown and then put your own Id in instead of "4". This is undesirable behavior.
- milkshakes 16y ago
  I agree. However, this isn't a new development. It's just more in your face now.
  - tewks 16y ago
    Was this true for all users or just "4" prior to f8?
    - milkshakes 16y ago
      With a valid sessionkey, I could get a list of the public events that any user was invited to, as well as the ones they RSVP'd for.
- smokinn 16y ago
  Are you sure? I'm checking myself and nothing is available other than my profile photo. /[my id]/events data (empty) Maybe his privacy settings aren't as stringent as mine?
  - milkshakes 16y ago
    It only works with publicly listed events
    - ori_b 16y ago
      But you could already look at publicly listed events and find out who was attending. This - in principle - isn't exposing any more information than what was previously there. It just makes it easier to access. Sure, it still sucks. But it's not a major new security breach. All that it exposes is already there.

jpeterson 16y ago

There will eventually be a great turning point on the web when everyone finally understands most of the privacy issues and makes a decision on whether they really want their lives to be private or not. If they go for privacy, Facebook will fizzle out--their business model depends fundamentally on invading privacy. If not, Facebook may just take over the world.

simon_ 16y ago
Obviously some people will choose one way and some people the other. And Facebook will continue to serve those that are willing to trade privacy for convenience/connectedness.
- jpeterson 16y ago
  You're right, that is obvious. I guess what I'm saying is that it will be a very lopsided split.
  - axod 16y ago
    I'm not sure how you can call that. Also I'd dispute your statement "It's business model fundamentally relies on invading your privacy". Without any invasion of privacy, they can probably make a few hundred million a year from random ads. Using your demographics to target ads better at you probably raises that to a few hundred million more. So IMHO, invading your privacy is in no way necessary for Facebook to operate. It just allows them to optimize a little better.
    - Silhouette 16y ago
      I think you're underestimating the difference in revenue potential between targeted and untargeted advertising. The jury is out on whether Facebook actually has a sustainable advertising revenue anyway, but I'd guess that the potential income probably drops by an order of magnitude if you can't target specific demographics.

riffer 16y ago

Whatever you think of Mark Zuckerberg, you have to respect him for this. He knows his information is available through the API, he has chosen to make it publicly available. It is ultimate dogfooding; equivalent to being able to see Eric's and Larry's and Sergey's searches. EDIT: blackswan is right; tamed down the comparison to Google in the last phrase

CWuestefeld 16y ago
On the other hand, his celebrity is now giving greater exposure to the activities of his associates -- they're getting dragged in without much of a choice. I don't think that's very noble of him at all.
blackswan 16y ago
It's actually like seeing only a small selection of Larry and Sergey's searches - not all of Zuckerberg's content is public. He says so in one of his status updates that is public.

javajones 16y ago

Is there another posting for this? I can't get to the article through the link.

milkshakes 16y ago
yup: http://news.ycombinator.com/item?id=1294632 http://news.ycombinator.com/item?id=1294632

JangoSteve 16y ago

This seems to integrate exactly with your existing privacy settings, so I guess there was no real surprise here. Mine were pretty much on lock-down anyway. I found myself, and every single link except my profile picture and my likes showed "data empty".

aroon 16y ago

I'm not sure why people are so offended by what Facebook has done. They've just made the information people made publicly available already easy to parse for computers. Full disclosure: I had no way to prepare for Facebook's new features and I haven't change a single privacy settings since it launched. I just used this site to check what was publicly available for the first time and none of it was a surprise except my events and I don't feel invaded in any way. Feel free to browse around my profile. http://zesty.ca/facebook/#/aroon http://zesty.ca/facebook/#/aroon

milkshakes 16y ago
what bothers me is not that people can see what I've rsvp'd to, but that they can see what I've been invited to, but ignored (unless i remove that event, which must be done manually for each event). My friends invite me to a lot of events that I _never_ want to publicly be associated with, but unless I specifically remove this event, the whole world can see it.