8 ms·

Why in the world does Facebook let me do this?

159 points by iamelgringo 16y ago

sajid 16y ago
These people must have their privacy set to 'Everyone'. Facebook's Privacy Guide states that such information may be visible to everyone on the internet.
- alanstorm 16y ago
  I believe you meant to say "These people must have had their privacy set to 'Everyone'.
- zmmmmm 16y ago
  > These people must have their privacy set to 'Everyone' Yep - the way Facebook set it by default for them without them realizing. And then it fails to indicate anywhere in the posting UI that the post is going out to the entire universe unless they explicitly click a lock icon that is an standard internet icon for indicating that your content is already secure.
sjsivak 16y ago
Wait, these are the messages that are sent between two users? Does just one of them need to put their settings on "Everyone" to display both sides of the conversation? Please tell me this is a bug/hack/exploit/mistake/error.
- sajid 16y ago
  These are wall posts.
  - sjsivak 16y ago
    That makes more sense. Wall posts are meant to be public and apparently these people love to over-share. What do the settings need to be in this situation? The recipient needs to have their wall set to "Everyone" and the poster needs to have their wall postings set to "Everyone"?
    - sajid 16y ago
      I would hope so ... I've not tested it though.
CoryMathews 16y ago
Because they couldn't care less about privacy.
0nly1ife 16y ago
Did those people grant your app permission to read their stream? This would be really messed up if they did.
- djb_hackernews 16y ago
  It's public posts, you don't even need an app to make that query.
ErrantX 16y ago
Samre reason Twitter lets you do this: http://twitter.com/#search?q=rectal%20surgery http://twitter.com/#search?q=rectal%20surgery (there is a difference, I guess, in that on Twitter it is "common knowledge" that everything is public by default - whereas on Facebook it is reasonable for an individual to realise how public their data might be on their current privacy settings)
- sajid 16y ago
  At the very least, FB should make a distinction between 'Everyone' and 'Public'. Where the former means everyone on Facebook and the latter means everyone on the internet.
  - ErrantX 16y ago
    I guess, but that point applies to just about every other API as well (including Twitters)
  - ryanwaggoner 16y ago
    In practice, is there really a difference? Facebook has hundreds of millions of users and it's fast and free to sign up, so I'm not sure I see the distinction, other than maybe search engines...
aw3c2 16y ago
Why in the world would you post about your rectal surgery on the internet using your real name or an easily traceable identity if you did not want the internet to know about it. Missing privacy education maybe?
- nfnaaron 16y ago
  Because you think, through no longer valid experience or through misunderstanding, that you're only communicating with your friends. Email is a good example. You carry on a conversation about rectal surgery with email correspondents (maybe your doctor). You may have a vague idea that system administrators or men in the middle may be able to read those emails, but you have the conversation anyway because you assume (with some justification) those are unlikely circumstances. You have just posted about your rectal surgery on the internet (over which email travels). If you were to find your emails publicly searchable you'd be rightly upset. I originally thought my posts on facebook were only visible (using the English definition of visible, not facebook's co-opted definition) to my specific friends. Many people probably still think so, and it's not an unreasonable leap.
  - megablast 16y ago
    Or maybe, after having to go through something like that, privacy is not the first, or last thing on your mind. After surgery, you are happy to hear the good news that things went well, you are on your way to feeling a lot better, and want to share that with everybody.
- kmfrk 16y ago
  The list could be much longer than it is. Facebook has a large reach, and some people just aren’t too bright: http://ryankuder.posterous.com/facebook-users-think-readwrite-web-blog-is-fa http://ryankuder.posterous.com/facebook-users-think-readwrit.... There are many cautionary tales of Facebook users getting into trouble, but, whatever you think of Facebook, there is only so much you can do to prevent people from embarrassing themselves.
iamelgringo 16y ago
Just to clarify. I don't have an app. I don't have anyone's permission to do anything. I'm just messing around with URL's in their search API: http://developers.facebook.com/docs/api http://developers.facebook.com/docs/api This is also what prompted my to try and start a discussion about privacy over here: http://news.ycombinator.com/item?id=1341227 http://news.ycombinator.com/item?id=1341227 From the search api docs: You can search over all public objects in the social graph with https://graph.facebook.com/search https://graph.facebook.com/search. The format is: https://graph.facebook.com/search?q=QUERY&type=OBJECT_TYPE https://graph.facebook.com/search?q=QUERY&type=OBJECT_TY... We support search for the following types of objects: All public posts: https://graph.facebook.com/search?q=watermelon&type=post https://graph.facebook.com/search?q=watermelon&type=post People: https://graph.facebook.com/search?q=mark&type=user https://graph.facebook.com/search?q=mark&type=user Pages: https://graph.facebook.com/search?q=platform&type=page https://graph.facebook.com/search?q=platform&type=page Events: https://graph.facebook.com/search?q=conference&type=event https://graph.facebook.com/search?q=conference&type=even... Groups: https://graph.facebook.com/search?q=programming&type=group https://graph.facebook.com/search?q=programming&type=gro... You can also search an individual user's News Feed, restricted to that user's friends, by adding a q argument to the home connection URL: News Feed: https://graph.facebook.com/me/home?q=facebook https://graph.facebook.com/me/home?q=facebook
- rayvega 16y ago
  It could be related to this: http://searchengineland.com/facebooks-posts-by-everyone-feature-do-people-realize-theyre-sharing-to-the-world-41525 http://searchengineland.com/facebooks-posts-by-everyone-feat...
- bcl 16y ago
  To be clear, this is only searching public posts. Its just that a large number of FB users either don't know, or don't care, what they are now broadcasting to the world.
  - natrius 16y ago
    There's a little lock button under the status box that lets you set your privacy settings for each post. They should expand it to put the actual label of your privacy setting on the button, so people would see "Everyone" on the button when talking about their rectal surgery. I honestly think most people don't mind posting their thoughts for everyone to see (cf. Twitter), but there is definitely a minority that is doing so accidentally, and that's easy to fix.
subwindow 16y ago
The correct question is "Why is the default wall post set to 'Everyone'?" Searching public posts is just fine. I just think that people should be more made aware of who exactly they're broadcasting to.
- axod 16y ago
  Surely if you write on someones wall, then all of their friends can see it. Trying to keep any sort of privacy there seems problematic. It's called a wall for a reason :/
  - jkincaid 16y ago
    This is the same kind of logic Facebook is using to justify their moves to make everything public, and it's flawed. These are different kinds of public. For example, with Facebook fan pages there used to be an option to hide which pages/groups you were a fan of. Now you can't do that — all of these are public. There is now no way to hide them without 'unfanning' them. Yes, before the change if someone started looking through the many thousands (millions?) of fan pages they could have found you listed on one. But now it's just sitting on your profile page.
    - axod 16y ago
      I'm really really bored of this on HN. There's no real evidence that anyone using facebook really minds the changes facebook makes. Changes to their privacy are fairly moot. It's not like they're changing the color of a button, making it harder to play fishville or anything massive like that. Can we get back to moaning about appstore policies now? Or iPad articles?
      - philwelch 16y ago
        One of my philosophy professors posted something like, "I logged into Pandora and it showed me all my Facebook friends and what they were listening to, this is too much, Facebook will have to go on without me" last week. And then he deactivated his account. Facebook users are noticing, the question is how many.
sp332 16y ago
Cool example, but you really shouldn't publish your access token like that.
- ErrantX 16y ago
  <humor> Facebook will be publishing it anyway next week :) </humor>
  - ElbertF 16y ago
    To bad you closed the humor element, otherwise all the comments below yours would have been funny as well.
- iamelgringo 16y ago
  Good call. It's pretty much a throw away account that I'm only using for api access and an advertising trial I did. Thanks, though. :)
noelchurchill 16y ago
It's weird getting a glimpse of people's lives, and the things they share opening with status updates to their friends!
vinhboy 16y ago
I would find this way more interesting if I could narrow this down to just people in my network. Knowing what everyone on the internet is doing is not all that interesting.
- underdown 16y ago
  It's pretty interesting to marketers. Ill bet u could make some highly targeted direct mail campaigns on the cheap now.
- iamelgringo 16y ago
  You can also search an individual user's News Feed, restricted to that user's friends, by adding a q argument to the home connection URL: News Feed: https://graph.facebook.com/me/home?q=facebook https://graph.facebook.com/me/home?q=facebook
crad 16y ago
I thought this was a rather humorous thing to search on: https://graph.facebook.com/search?q=facebook%20privacy https://graph.facebook.com/search?q=facebook%20privacy Mainly people warning about the privacy changes, yet have public status updates.
- TallGuyShort 16y ago
  Nobody's complaining about the existence of public status updates - that's all twitter is. People are complaining about the subtlety of it and the general lack of knowledge about it.
deleted 16y ago
[deleted]
rythie 16y ago
I don't even know why people would tell half of their friends that.
jasonkester 16y ago
{ "error": { "type": "OAuthException", "message": "Error processing access token." } } Is that what everybody else sees?
- treblig 16y ago
  That's what I see.
- natrius 16y ago
  I think the access tokens expire after a while. EDIT: Apparently the access token isn't necessary, but it can break things if it's there. The URL of this submission should be changed to omit the access token parameter. If that still doesn't work, the instructions below will give you a URL with a Facebook-generated access token that will eventually expire as well. 1) Go here: http://developers.facebook.com/docs/api#search http://developers.facebook.com/docs/api#search 2) Click on the link to search all public posts for "watermelon". 3) Alter the URL to say "rectal surgery" instead of "watermelon".
  - eru 16y ago
    Looks like you need to be registered at facebook to make 1) work.
- mikedmiked 16y ago
  His access token has likely temporarily or permanently expired from either [overuse in too short a time period] or [they expire after a set time period]. Before it showed the latest public posts by all people on facebook which included the words "rectal surgery"
- graphene 16y ago
  just remove all the jibberish after "type=post" in the url and you will see message contents.
- codejoust 16y ago
  Just remove everything after the &access_token= part and it'll work. The access token has expired, but it's not even necessary to search for public posts.
kwamenum86 16y ago
This is...undesirable. People don't really understand privacy on the Internet very well to begin with, it isn't that they don't care about it. Facebook had the opportunity to set an example for how to handle privacy but they f'ed it up because they want to be more like Twitter. This is not the way to do it guys.
gilbertl 16y ago
You're searching the public timeline, much like http://www.kurrently.com http://www.kurrently.com
goodside 16y ago
Fixed link: https://graph.facebook.com/search?q=rectal%20surgery&type=post https://graph.facebook.com/search?q=rectal%20surgery&typ...
nfriedly 16y ago
Link that doesn't expire: https://graph.facebook.com/search?q=rectal%20surgery&type=post https://graph.facebook.com/search?q=rectal%20surgery&typ...
rit 16y ago
It used to be that your posts were set to private. So of course everyone still assumes that when they post about their rectal surgery it's a private matter only their friends can see. This is why changing your privacy policies and defaults is obnoxious.

159 points by iamelgringo 16y ago

sajid 16y ago

These people must have their privacy set to 'Everyone'. Facebook's Privacy Guide states that such information may be visible to everyone on the internet.

alanstorm 16y ago
I believe you meant to say "These people must have had their privacy set to 'Everyone'.
zmmmmm 16y ago
> These people must have their privacy set to 'Everyone' Yep - the way Facebook set it by default for them without them realizing. And then it fails to indicate anywhere in the posting UI that the post is going out to the entire universe unless they explicitly click a lock icon that is an standard internet icon for indicating that your content is already secure.

sjsivak 16y ago

Wait, these are the messages that are sent between two users? Does just one of them need to put their settings on "Everyone" to display both sides of the conversation? Please tell me this is a bug/hack/exploit/mistake/error.

sajid 16y ago
These are wall posts.
- sjsivak 16y ago
  That makes more sense. Wall posts are meant to be public and apparently these people love to over-share. What do the settings need to be in this situation? The recipient needs to have their wall set to "Everyone" and the poster needs to have their wall postings set to "Everyone"?
  - sajid 16y ago
    I would hope so ... I've not tested it though.

CoryMathews 16y ago

Because they couldn't care less about privacy.

0nly1ife 16y ago

Did those people grant your app permission to read their stream? This would be really messed up if they did.

djb_hackernews 16y ago
It's public posts, you don't even need an app to make that query.

ErrantX 16y ago

Samre reason Twitter lets you do this: http://twitter.com/#search?q=rectal%20surgery http://twitter.com/#search?q=rectal%20surgery (there is a difference, I guess, in that on Twitter it is "common knowledge" that everything is public by default - whereas on Facebook it is reasonable for an individual to realise how public their data might be on their current privacy settings)

sajid 16y ago
At the very least, FB should make a distinction between 'Everyone' and 'Public'. Where the former means everyone on Facebook and the latter means everyone on the internet.
- ErrantX 16y ago
  I guess, but that point applies to just about every other API as well (including Twitters)
- ryanwaggoner 16y ago
  In practice, is there really a difference? Facebook has hundreds of millions of users and it's fast and free to sign up, so I'm not sure I see the distinction, other than maybe search engines...

aw3c2 16y ago

Why in the world would you post about your rectal surgery on the internet using your real name or an easily traceable identity if you did not want the internet to know about it. Missing privacy education maybe?

nfnaaron 16y ago
Because you think, through no longer valid experience or through misunderstanding, that you're only communicating with your friends. Email is a good example. You carry on a conversation about rectal surgery with email correspondents (maybe your doctor). You may have a vague idea that system administrators or men in the middle may be able to read those emails, but you have the conversation anyway because you assume (with some justification) those are unlikely circumstances. You have just posted about your rectal surgery on the internet (over which email travels). If you were to find your emails publicly searchable you'd be rightly upset. I originally thought my posts on facebook were only visible (using the English definition of visible, not facebook's co-opted definition) to my specific friends. Many people probably still think so, and it's not an unreasonable leap.
- megablast 16y ago
  Or maybe, after having to go through something like that, privacy is not the first, or last thing on your mind. After surgery, you are happy to hear the good news that things went well, you are on your way to feeling a lot better, and want to share that with everybody.
kmfrk 16y ago
The list could be much longer than it is. Facebook has a large reach, and some people just aren’t too bright: http://ryankuder.posterous.com/facebook-users-think-readwrite-web-blog-is-fa http://ryankuder.posterous.com/facebook-users-think-readwrit.... There are many cautionary tales of Facebook users getting into trouble, but, whatever you think of Facebook, there is only so much you can do to prevent people from embarrassing themselves.

iamelgringo 16y ago

Just to clarify. I don't have an app. I don't have anyone's permission to do anything. I'm just messing around with URL's in their search API: http://developers.facebook.com/docs/api http://developers.facebook.com/docs/api This is also what prompted my to try and start a discussion about privacy over here: http://news.ycombinator.com/item?id=1341227 http://news.ycombinator.com/item?id=1341227 From the search api docs: You can search over all public objects in the social graph with https://graph.facebook.com/search https://graph.facebook.com/search. The format is: https://graph.facebook.com/search?q=QUERY&type=OBJECT_TYPE https://graph.facebook.com/search?q=QUERY&type=OBJECT_TY... We support search for the following types of objects: All public posts: https://graph.facebook.com/search?q=watermelon&type=post https://graph.facebook.com/search?q=watermelon&type=post People: https://graph.facebook.com/search?q=mark&type=user https://graph.facebook.com/search?q=mark&type=user Pages: https://graph.facebook.com/search?q=platform&type=page https://graph.facebook.com/search?q=platform&type=page Events: https://graph.facebook.com/search?q=conference&type=event https://graph.facebook.com/search?q=conference&type=even... Groups: https://graph.facebook.com/search?q=programming&type=group https://graph.facebook.com/search?q=programming&type=gro... You can also search an individual user's News Feed, restricted to that user's friends, by adding a q argument to the home connection URL: News Feed: https://graph.facebook.com/me/home?q=facebook https://graph.facebook.com/me/home?q=facebook

rayvega 16y ago
It could be related to this: http://searchengineland.com/facebooks-posts-by-everyone-feature-do-people-realize-theyre-sharing-to-the-world-41525 http://searchengineland.com/facebooks-posts-by-everyone-feat...
bcl 16y ago
To be clear, this is only searching public posts. Its just that a large number of FB users either don't know, or don't care, what they are now broadcasting to the world.
- natrius 16y ago
  There's a little lock button under the status box that lets you set your privacy settings for each post. They should expand it to put the actual label of your privacy setting on the button, so people would see "Everyone" on the button when talking about their rectal surgery. I honestly think most people don't mind posting their thoughts for everyone to see (cf. Twitter), but there is definitely a minority that is doing so accidentally, and that's easy to fix.

subwindow 16y ago

The correct question is "Why is the default wall post set to 'Everyone'?" Searching public posts is just fine. I just think that people should be more made aware of who exactly they're broadcasting to.

axod 16y ago
Surely if you write on someones wall, then all of their friends can see it. Trying to keep any sort of privacy there seems problematic. It's called a wall for a reason :/
- jkincaid 16y ago
  This is the same kind of logic Facebook is using to justify their moves to make everything public, and it's flawed. These are different kinds of public. For example, with Facebook fan pages there used to be an option to hide which pages/groups you were a fan of. Now you can't do that — all of these are public. There is now no way to hide them without 'unfanning' them. Yes, before the change if someone started looking through the many thousands (millions?) of fan pages they could have found you listed on one. But now it's just sitting on your profile page.
  - axod 16y ago
    I'm really really bored of this on HN. There's no real evidence that anyone using facebook really minds the changes facebook makes. Changes to their privacy are fairly moot. It's not like they're changing the color of a button, making it harder to play fishville or anything massive like that. Can we get back to moaning about appstore policies now? Or iPad articles?
    - philwelch 16y ago
      One of my philosophy professors posted something like, "I logged into Pandora and it showed me all my Facebook friends and what they were listening to, this is too much, Facebook will have to go on without me" last week. And then he deactivated his account. Facebook users are noticing, the question is how many.

sp332 16y ago

Cool example, but you really shouldn't publish your access token like that.

ErrantX 16y ago
<humor> Facebook will be publishing it anyway next week :) </humor>
- ElbertF 16y ago
  To bad you closed the humor element, otherwise all the comments below yours would have been funny as well.
iamelgringo 16y ago
Good call. It's pretty much a throw away account that I'm only using for api access and an advertising trial I did. Thanks, though. :)

noelchurchill 16y ago

It's weird getting a glimpse of people's lives, and the things they share opening with status updates to their friends!

vinhboy 16y ago

I would find this way more interesting if I could narrow this down to just people in my network. Knowing what everyone on the internet is doing is not all that interesting.

underdown 16y ago
It's pretty interesting to marketers. Ill bet u could make some highly targeted direct mail campaigns on the cheap now.
iamelgringo 16y ago
You can also search an individual user's News Feed, restricted to that user's friends, by adding a q argument to the home connection URL: News Feed: https://graph.facebook.com/me/home?q=facebook https://graph.facebook.com/me/home?q=facebook

crad 16y ago

I thought this was a rather humorous thing to search on: https://graph.facebook.com/search?q=facebook%20privacy https://graph.facebook.com/search?q=facebook%20privacy Mainly people warning about the privacy changes, yet have public status updates.

TallGuyShort 16y ago
Nobody's complaining about the existence of public status updates - that's all twitter is. People are complaining about the subtlety of it and the general lack of knowledge about it.

deleted 16y ago

[deleted]

rythie 16y ago

I don't even know why people would tell half of their friends that.

jasonkester 16y ago

{ "error": { "type": "OAuthException", "message": "Error processing access token." } } Is that what everybody else sees?

treblig 16y ago
That's what I see.
natrius 16y ago
I think the access tokens expire after a while. EDIT: Apparently the access token isn't necessary, but it can break things if it's there. The URL of this submission should be changed to omit the access token parameter. If that still doesn't work, the instructions below will give you a URL with a Facebook-generated access token that will eventually expire as well. 1) Go here: http://developers.facebook.com/docs/api#search http://developers.facebook.com/docs/api#search 2) Click on the link to search all public posts for "watermelon". 3) Alter the URL to say "rectal surgery" instead of "watermelon".
- eru 16y ago
  Looks like you need to be registered at facebook to make 1) work.
mikedmiked 16y ago
His access token has likely temporarily or permanently expired from either [overuse in too short a time period] or [they expire after a set time period]. Before it showed the latest public posts by all people on facebook which included the words "rectal surgery"
graphene 16y ago
just remove all the jibberish after "type=post" in the url and you will see message contents.
codejoust 16y ago
Just remove everything after the &access_token= part and it'll work. The access token has expired, but it's not even necessary to search for public posts.

kwamenum86 16y ago

This is...undesirable. People don't really understand privacy on the Internet very well to begin with, it isn't that they don't care about it. Facebook had the opportunity to set an example for how to handle privacy but they f'ed it up because they want to be more like Twitter. This is not the way to do it guys.

gilbertl 16y ago

You're searching the public timeline, much like http://www.kurrently.com http://www.kurrently.com

goodside 16y ago

Fixed link: https://graph.facebook.com/search?q=rectal%20surgery&type=post https://graph.facebook.com/search?q=rectal%20surgery&typ...

nfriedly 16y ago

Link that doesn't expire: https://graph.facebook.com/search?q=rectal%20surgery&type=post https://graph.facebook.com/search?q=rectal%20surgery&typ...

rit 16y ago

It used to be that your posts were set to private. So of course everyone still assumes that when they post about their rectal surgery it's a private matter only their friends can see. This is why changing your privacy policies and defaults is obnoxious.