7 ms·

Response from FB: "Why We Disagree with the NYT" https://newsroom.fb.com/news/2018/06/why-we-disagree-with-the-nyt/ https://newsroom.fb.com/news/2018/06/why-we-

Response from FB: "Why We Disagree with the NYT" https://newsroom.fb.com/news/2018/06/why-we-disagree-with-the-nyt/ https://newsroom.fb.com/news/2018/06/why-we-disagree-with-th...

mlb_hn 8y ago
Agree with FB on this one. The privacy issue with 3rd party developers was that friend data was sent to the 3rd party developer databases. Here, the data just stays on the device. The way the article is titled can make it look like the device makers actually got to make their own database of Facebook users. Edit: I read it again, the article does say "Facebook acknowledged that some partners did store users’ data — including friends’ data — on their own servers," but they don't follow up on that at all, they go back to messing with a BlackBerry. That's the big question.
- jessaustin 8y ago
  Once an app has particular data, there is nothing FB can do to prevent it from uploading that data wherever. It would be difficult for Google or Apple to prevent that, and they control the platform. With enough apps, it is a certainty that this happened.
  - damnyou 8y ago
    Have you heard of the power of legally enforceable contracts? Lots of things aren't technically impossible but are forbidden by the law or by a contract. It's one of the ways modern societies function, check it out!
    - philipwhiuk 8y ago
      Have you heard of the power of contracts that have never actually been to court. It turns out many of them aren't legally enforceable. It's one of the ways modern society is dysfunctional. Check it out: http://www.ycombinator.com/legal/ http://www.ycombinator.com/legal/
    - jessaustin 8y ago
      How many firms have FB sued for breach of this hypothetical contract? Other than "Cambridge Analytica", can you think of one they might sue?
dman 8y ago
"We are not aware of any abuse by these companies." - seems to be carefully worded. They do not make claims that there are no abuses, nor do they elaborate what checks/audits they have in place to detect abuse.
- product50 8y ago
  Yeah - try reading between the lines since FB's response is not in line with your confirmation bias against them.
  - dman 8y ago
    I was trying to read the article critically, but am open to alternate parsings / viewpoints on the article. Would love to hear your thoughts on the subject matter of the article.
- joesb 8y ago
  > They do not make claims that there are no abuses How can any honest people make such claim? It is the same as proving the non-existence of abuses.
  - RyanZAG 8y ago
    I think point of above is more that it's in their interests to make sure they never do any checks, so no doubt they never do any. They could probably catch 99% of abuses by just specifying it in the contract with the 3rd party, but they have't done that.
    - joesb 8y ago
      How do you know that they didn't already catch 99% of the abuses, but it's just that 99% is still zero?
evincarofautumn 8y ago
The NYT article is definitely overblown. It’s popular to hate on Facebook about privacy, and yeah, they’ve made mistakes in the past, but that’s largely because they’re just engineers trying their best to do the right thing. IMO they need more non-engineer types to inform them what “the right thing” actually is, when it doesn’t align with the typical attitude of “Oh, there’s a technical solution to this problem!” > the BlackBerry app had access to all of the reporter’s Facebook friends and, for most of them, returned information such as user ID, birthday, work and education history and whether they were currently online. User ID and birthday are both public information, and people typically share work and education history as public (or at least “networks” thereof, for finding friends). AFAIK online status is the only thing that’s usually friends-only, but perfectly reasonable to share with a device messaging app.
- josefresco 8y ago
  Also from the article: Some device partners can retrieve Facebook users’ relationship status, religion, political leaning and upcoming events, among other data. Are those public?
  - jonhendry18 8y ago
    Also, is it the data belonging to the user of the device and the Facebook account the device is logged into? "Facebook integration on device OS allows viewing user's own profile after logging in to account" doesn't seem that shocking.
- cdubzzz 8y ago
  I generally agree with you that this piece is a bit sensationalistic but... > [...] they’re just engineers trying their best to do the right thing. What makes you say that? Beyond potential abuses of data by third parties (or whatever), I would expect that most FB employees are trying their best to get paid. Whether or not all or any single one of them cares about “the right thing” is mostly unknown to outsiders. I have always assumed, based on FB’s overall business model, that there is a general disregard for any particular interpretation of “the right thing” at least when it comes to the privacy of the platform’s users.
Maarten88 8y ago
What I apprehended from the article is that those API's still exist, and even still work in full. Meaning that today it is still possible to generate an access_token using a client_id extracted from an old blackberry device with a valid facebook account and extract much more data (using the private device API's) than what that user should be allowed to see. Do I understand that correctly? Because that seems like an enormous security breach.
- bluesign 8y ago
  Disagreement lies in there, fb says devices access as much as fb app access, NYT claims otherwise but probably wrong

Response from FB: "Why We Disagree with the NYT" https://newsroom.fb.com/news/2018/06/why-we-disagree-with-the-nyt/ https://newsroom.fb.com/news/2018/06/why-we-disagree-with-th...

mlb_hn 8y ago

Agree with FB on this one. The privacy issue with 3rd party developers was that friend data was sent to the 3rd party developer databases. Here, the data just stays on the device. The way the article is titled can make it look like the device makers actually got to make their own database of Facebook users. Edit: I read it again, the article does say "Facebook acknowledged that some partners did store users’ data — including friends’ data — on their own servers," but they don't follow up on that at all, they go back to messing with a BlackBerry. That's the big question.

jessaustin 8y ago
Once an app has particular data, there is nothing FB can do to prevent it from uploading that data wherever. It would be difficult for Google or Apple to prevent that, and they control the platform. With enough apps, it is a certainty that this happened.
- damnyou 8y ago
  Have you heard of the power of legally enforceable contracts? Lots of things aren't technically impossible but are forbidden by the law or by a contract. It's one of the ways modern societies function, check it out!
  - philipwhiuk 8y ago
    Have you heard of the power of contracts that have never actually been to court. It turns out many of them aren't legally enforceable. It's one of the ways modern society is dysfunctional. Check it out: http://www.ycombinator.com/legal/ http://www.ycombinator.com/legal/
  - jessaustin 8y ago
    How many firms have FB sued for breach of this hypothetical contract? Other than "Cambridge Analytica", can you think of one they might sue?

dman 8y ago

"We are not aware of any abuse by these companies." - seems to be carefully worded. They do not make claims that there are no abuses, nor do they elaborate what checks/audits they have in place to detect abuse.

product50 8y ago
Yeah - try reading between the lines since FB's response is not in line with your confirmation bias against them.
- dman 8y ago
  I was trying to read the article critically, but am open to alternate parsings / viewpoints on the article. Would love to hear your thoughts on the subject matter of the article.
joesb 8y ago
> They do not make claims that there are no abuses How can any honest people make such claim? It is the same as proving the non-existence of abuses.
- RyanZAG 8y ago
  I think point of above is more that it's in their interests to make sure they never do any checks, so no doubt they never do any. They could probably catch 99% of abuses by just specifying it in the contract with the 3rd party, but they have't done that.
  - joesb 8y ago
    How do you know that they didn't already catch 99% of the abuses, but it's just that 99% is still zero?

evincarofautumn 8y ago

The NYT article is definitely overblown. It’s popular to hate on Facebook about privacy, and yeah, they’ve made mistakes in the past, but that’s largely because they’re just engineers trying their best to do the right thing. IMO they need more non-engineer types to inform them what “the right thing” actually is, when it doesn’t align with the typical attitude of “Oh, there’s a technical solution to this problem!” > the BlackBerry app had access to all of the reporter’s Facebook friends and, for most of them, returned information such as user ID, birthday, work and education history and whether they were currently online. User ID and birthday are both public information, and people typically share work and education history as public (or at least “networks” thereof, for finding friends). AFAIK online status is the only thing that’s usually friends-only, but perfectly reasonable to share with a device messaging app.

josefresco 8y ago
Also from the article: Some device partners can retrieve Facebook users’ relationship status, religion, political leaning and upcoming events, among other data. Are those public?
- jonhendry18 8y ago
  Also, is it the data belonging to the user of the device and the Facebook account the device is logged into? "Facebook integration on device OS allows viewing user's own profile after logging in to account" doesn't seem that shocking.
cdubzzz 8y ago
I generally agree with you that this piece is a bit sensationalistic but... > [...] they’re just engineers trying their best to do the right thing. What makes you say that? Beyond potential abuses of data by third parties (or whatever), I would expect that most FB employees are trying their best to get paid. Whether or not all or any single one of them cares about “the right thing” is mostly unknown to outsiders. I have always assumed, based on FB’s overall business model, that there is a general disregard for any particular interpretation of “the right thing” at least when it comes to the privacy of the platform’s users.

Maarten88 8y ago

What I apprehended from the article is that those API's still exist, and even still work in full. Meaning that today it is still possible to generate an access_token using a client_id extracted from an old blackberry device with a valid facebook account and extract much more data (using the private device API's) than what that user should be allowed to see. Do I understand that correctly? Because that seems like an enormous security breach.

bluesign 8y ago
Disagreement lies in there, fb says devices access as much as fb app access, NYT claims otherwise but probably wrong