7 ms·

This and the discussion here is obnoxiously bad. Facebook gave some device makers special APIs to access authorized data. This is literally no different than a

This and the discussion here is obnoxiously bad. Facebook gave some device makers special APIs to access authorized data. This is literally no different than a web API or scraping facebook HTML, just more streamlined. What you guys seem to be objecting to is that non-facebook code was able to interact with authorized user data. But that is a necessary feature of displaying data of any kind (unless facebook owns the entire software stack). This is a non-story. And HN's facebook derangement syndrome continues.

zaroth 8y ago
This is simply Facebook functionality being integrated into parts of the OS chrome. We trust our devices not to exfiltrate our data every second we are typing on them. Tightly integrating social features into a mobile OS is not third party access unless the device maker in exfiltrating the data for any purpose other than encrypted cloud backup.
philipwhiuk 8y ago
Should that data have been available via a web API or Facebook's HTML though?
- hackinthebochs 8y ago
  >Should that data have been available via a web API or Facebook's HTML though There is no evidence that these APIs provided more data than a user had legitimate access to.
tyrionsrke 8y ago
You're conflating the issue of informed consent with access ubiquity. Simply because the data was gathered in a way not unlike most apps, doesn't make it a non-story. In fact, the lack of informed consent and the very misleading statements to Congress make it a huge story. User data is a commodity, and is worth far more than money. Considering how easily manipulated large portions of the Facebook community can be (e.g. Facebook mood studies, election-year propaganda, etc.), giving access like this to large tech companies - third parties - absolutely needs to be well regulated and come with the informed consent of it's user base. Not to mention that the policies around turning this data over to other parties -- namely law enforcement -- is different between most of these companies. The objection is not non-facebook code accessing facebook data. The objection is that, once again, powerful information is being traded and used as leverage to drive profit, with the intent of the buyer or receiver largely unclear, and the impact yet to be seen.
- bobdole1234 8y ago
  If these people are so easily swayed and manipulated, what exactly is informed consent supposed to cure?
  - tyrionsrke 8y ago
    Informed consent is simply that -- being able to consent without missing a piece of knowledge. It may cure nothing. But the fact remains that Facebook acted (and continues to act) in bad faith to the user. Maybe nothing changes, especially now that users are so deeply attached. Real-time targeted advertising has been around since the early 2000s, but explain to the average tech-illiterate user that their phone can hear when a Tide ad is on television and can serve a Clorox ad in their Instagram feed, and watch how uncomfortable they get. How much of this could be stopped with informed consent.
- deleted 8y ago
  [deleted]
- hackinthebochs 8y ago
  There is no issue of informed consent here. When you upload data, you consent to your allowed friends being able to view that data in whatever manner they see fit. These device specific interfaces to facebook is just an example of this. FB themselves took reasonable steps to ensure the device manufacturers adhered to the consent that users give when adding data to the site (i.e. only use the data in service to displaying it). >The objection is that, once again, powerful information is being traded and used as leverage to drive profit There's no evidence of any of this.
  - tyrionsrke 8y ago
    >There's no evidence of any of this. I disagree. I think Facebook, driven by ad dollars, is attempting to secure as many users as it can. Part of that is to make it as seamless and convenient as possible. Data as currency is a given at this point. Facebook ensures longevity through ease-of-use. Service providers secure further assets, and are in a position to use it.
Latteland 8y ago
No, you are wrong, this is a pretty egregious mistake. They defined device makers as service providers, and then allowed them to do things that even third parties weren't allowed. Yet they claimed they shut that stuff off to third parties (so they lied by omission). "No, we don't allow third parties anymore to do that kind of stuff" (but there's this large group that can do it, but we aren't calling them third parties). This wasn't just another way to get at the data. The NYT article goes into some detail about what they allowed them to do.
- hackinthebochs 8y ago
  >They defined device makers as service providers, and then allowed them to do things that even third parties weren't allowed. Because they're not third parties. Third parties are anyone off the street that meets some minimal requirements. It's like the distinction between third party and second party releases on video game consoles. Second party releases are extensions of the first party publisher because of the special access and extra scrutiny they get. The difference in this case is that this "special access" is apparently no different than what you get from the website through scraping HTML, just in a more convenient manner.
  - KaoruAoiShiho 8y ago
    The user is the second party dude.
    - closeparen 8y ago
      The user doesn’t manipulate the EM spectrum with his mind, but through user agent hardware, firmware, and software. The client stack necessarily has the same access he does.
    - thinkling 8y ago
      Yes, so it might be OK for software written by a third party to access FB with the second party's authentication and privileges, when running on the second party's device. But that doesn't make it OK for that data to be stored on the third party's servers or be otherwise available to the third party.
justherefortart 8y ago
Well not to mention the users upload all this info. If people don't want their information shared, don't put it on a publicly accessible website? I've yet to see anything facebook has done that is surprising. They don't charge people for using their servers so making money is clearly going to be from data analysis and marketing to users. If people don't like it, don't use it.
cryptoz 8y ago
> This is literally no different than a web API or scraping facebook HTML, just more streamlined. I see you're using the new definition of literally, the one that means figuratively. In the same sentence you have said it is no different and then said it is vastly different. Your post makes no sense. Even if you were right that the data is 100% hash-compatible, SHA-1 it and get the same data as the API (you're wrong), it being streamlined is a huge difference and makes this news, in fact. You surely agree that an individual person walking up to others on the street and asking a question is different than a team of 10M people doing them same thing, right? But there's "literally no difference", just streamlined? Streamlining something defines patents and makes billions. Streamlining a legal activity can make it illegal. Your post is wrong, you are using logical fallacies and you are then blaming everyone else with harsh language, while it is is you who seems to have, in your own words, some kind of "facebook derangement syndrome". Wow, those are rude words. Flagged.
- hackinthebochs 8y ago
  Did you actually write this many words based on your disagreement of my usage of "literally"?
  - cryptoz 8y ago
    No, I wrote that comment because you are an abrasive member of the community who is writing direct insults to other members, calling them deranged, etc, and doing other things that are against the rules of the site. You are breaking the conversation here. You are distracting. You are lying. You are being abrasive and causing fights. You are calling people names and causing a big scene. You ignored my entire post, and instead chose to post an off-topic question, further distracting and hurting the conversation. That is also against the rules. I'm responding to you so that others are more aware of the damage you are causing. We are not "deranged" people for our thoughts on Facebook. Stop it.
    - dang 8y ago
      Since this is a repeating pattern and asking you many times to stop doing it hasn't apparently worked, I've banned you until we get a commitment from you at hn@ycombinator.com that it won't happen again.
snowwrestler 8y ago
> Facebook gave some device makers special APIs to access authorized data. This is literally no different than a web API or scraping facebook HTML, just more streamlined. If I found out that Google was using Chrome during my authenticated Facebook web sessions to scrape my Facebook data, and my friends' Facebook data, I'd be pretty upset too.
- zaroth 8y ago
  But nothing like that happened here... in the slightest? This was OS chrome integrating Facebook features. An API for Mobile OS UI to integrate Facebook features. How else do you think the OS provides FB functionality... after you enter your credentials into the Settings screen?!
  - denom 8y ago
    Did the OS keep the data or use it in any way beyond what the OS needed for display etc?
  - snowwrestler 8y ago
    I think you need to read a bit more carefully. This was not just API calls, these were data sharing partnerships--i.e. the device companies had access and permission to collect, aggregate, and store customer data in one place, like Cambridge Analytica did. Example quotes (emphasis added by me): > They said its partnerships were governed by contracts that strictly limited use of the data, including any stored on partners’ servers. > Tests by The Times showed that the partners requested and received data in the same way other third parties did. Facebook customer data was collected and stored on servers owned by the device manufacturers. This is not analogous to a browser interacting with the Facebook web application.
alistproducer2 8y ago
This is very different than scraping html. Facebook has obviously been lying about 3ed party data access. This comment is incoherent, at best, and it says a lot about how far the HN community has sunk that it is the top comment. "------ derangement" syndrome is a common phrase used on lots of political blogs that also specialize in nonsensical arguments and don't seem to care that entities in power lie through their teeth.
JumpCrisscross 8y ago
Hackers proclaiming "but it wasn't technically a breach" or "the API worked as intended" is 2018's edition of Great Recession bankers' "the counterparty should have known it was our business to screw them" or "it isn't our job to diligence the mortgages". There is discomfort associated with any paradigm shift. Particularly when our livelihoods are entangled in them. A good way to stick oneself on the wrong side is to brand change as derangement.
seanhunter 8y ago
If the discussion here is bad, you definitely have played a role in making it so. Claiming people who disagree with your point of view are "deranged" is not constructive.

zaroth 8y ago

This is simply Facebook functionality being integrated into parts of the OS chrome. We trust our devices not to exfiltrate our data every second we are typing on them. Tightly integrating social features into a mobile OS is not third party access unless the device maker in exfiltrating the data for any purpose other than encrypted cloud backup.

philipwhiuk 8y ago

Should that data have been available via a web API or Facebook's HTML though?

hackinthebochs 8y ago
>Should that data have been available via a web API or Facebook's HTML though There is no evidence that these APIs provided more data than a user had legitimate access to.

tyrionsrke 8y ago

You're conflating the issue of informed consent with access ubiquity. Simply because the data was gathered in a way not unlike most apps, doesn't make it a non-story. In fact, the lack of informed consent and the very misleading statements to Congress make it a huge story. User data is a commodity, and is worth far more than money. Considering how easily manipulated large portions of the Facebook community can be (e.g. Facebook mood studies, election-year propaganda, etc.), giving access like this to large tech companies - third parties - absolutely needs to be well regulated and come with the informed consent of it's user base. Not to mention that the policies around turning this data over to other parties -- namely law enforcement -- is different between most of these companies. The objection is not non-facebook code accessing facebook data. The objection is that, once again, powerful information is being traded and used as leverage to drive profit, with the intent of the buyer or receiver largely unclear, and the impact yet to be seen.

bobdole1234 8y ago
If these people are so easily swayed and manipulated, what exactly is informed consent supposed to cure?
- tyrionsrke 8y ago
  Informed consent is simply that -- being able to consent without missing a piece of knowledge. It may cure nothing. But the fact remains that Facebook acted (and continues to act) in bad faith to the user. Maybe nothing changes, especially now that users are so deeply attached. Real-time targeted advertising has been around since the early 2000s, but explain to the average tech-illiterate user that their phone can hear when a Tide ad is on television and can serve a Clorox ad in their Instagram feed, and watch how uncomfortable they get. How much of this could be stopped with informed consent.
deleted 8y ago
[deleted]
hackinthebochs 8y ago
There is no issue of informed consent here. When you upload data, you consent to your allowed friends being able to view that data in whatever manner they see fit. These device specific interfaces to facebook is just an example of this. FB themselves took reasonable steps to ensure the device manufacturers adhered to the consent that users give when adding data to the site (i.e. only use the data in service to displaying it). >The objection is that, once again, powerful information is being traded and used as leverage to drive profit There's no evidence of any of this.
- tyrionsrke 8y ago
  >There's no evidence of any of this. I disagree. I think Facebook, driven by ad dollars, is attempting to secure as many users as it can. Part of that is to make it as seamless and convenient as possible. Data as currency is a given at this point. Facebook ensures longevity through ease-of-use. Service providers secure further assets, and are in a position to use it.

Latteland 8y ago

No, you are wrong, this is a pretty egregious mistake. They defined device makers as service providers, and then allowed them to do things that even third parties weren't allowed. Yet they claimed they shut that stuff off to third parties (so they lied by omission). "No, we don't allow third parties anymore to do that kind of stuff" (but there's this large group that can do it, but we aren't calling them third parties). This wasn't just another way to get at the data. The NYT article goes into some detail about what they allowed them to do.

hackinthebochs 8y ago
>They defined device makers as service providers, and then allowed them to do things that even third parties weren't allowed. Because they're not third parties. Third parties are anyone off the street that meets some minimal requirements. It's like the distinction between third party and second party releases on video game consoles. Second party releases are extensions of the first party publisher because of the special access and extra scrutiny they get. The difference in this case is that this "special access" is apparently no different than what you get from the website through scraping HTML, just in a more convenient manner.
- KaoruAoiShiho 8y ago
  The user is the second party dude.
  - closeparen 8y ago
    The user doesn’t manipulate the EM spectrum with his mind, but through user agent hardware, firmware, and software. The client stack necessarily has the same access he does.
  - thinkling 8y ago
    Yes, so it might be OK for software written by a third party to access FB with the second party's authentication and privileges, when running on the second party's device. But that doesn't make it OK for that data to be stored on the third party's servers or be otherwise available to the third party.

justherefortart 8y ago

Well not to mention the users upload all this info. If people don't want their information shared, don't put it on a publicly accessible website? I've yet to see anything facebook has done that is surprising. They don't charge people for using their servers so making money is clearly going to be from data analysis and marketing to users. If people don't like it, don't use it.

cryptoz 8y ago

> This is literally no different than a web API or scraping facebook HTML, just more streamlined. I see you're using the new definition of literally, the one that means figuratively. In the same sentence you have said it is no different and then said it is vastly different. Your post makes no sense. Even if you were right that the data is 100% hash-compatible, SHA-1 it and get the same data as the API (you're wrong), it being streamlined is a huge difference and makes this news, in fact. You surely agree that an individual person walking up to others on the street and asking a question is different than a team of 10M people doing them same thing, right? But there's "literally no difference", just streamlined? Streamlining something defines patents and makes billions. Streamlining a legal activity can make it illegal. Your post is wrong, you are using logical fallacies and you are then blaming everyone else with harsh language, while it is is you who seems to have, in your own words, some kind of "facebook derangement syndrome". Wow, those are rude words. Flagged.

hackinthebochs 8y ago
Did you actually write this many words based on your disagreement of my usage of "literally"?
- cryptoz 8y ago
  No, I wrote that comment because you are an abrasive member of the community who is writing direct insults to other members, calling them deranged, etc, and doing other things that are against the rules of the site. You are breaking the conversation here. You are distracting. You are lying. You are being abrasive and causing fights. You are calling people names and causing a big scene. You ignored my entire post, and instead chose to post an off-topic question, further distracting and hurting the conversation. That is also against the rules. I'm responding to you so that others are more aware of the damage you are causing. We are not "deranged" people for our thoughts on Facebook. Stop it.
  - dang 8y ago
    Since this is a repeating pattern and asking you many times to stop doing it hasn't apparently worked, I've banned you until we get a commitment from you at hn@ycombinator.com that it won't happen again.

snowwrestler 8y ago

> Facebook gave some device makers special APIs to access authorized data. This is literally no different than a web API or scraping facebook HTML, just more streamlined. If I found out that Google was using Chrome during my authenticated Facebook web sessions to scrape my Facebook data, and my friends' Facebook data, I'd be pretty upset too.

zaroth 8y ago
But nothing like that happened here... in the slightest? This was OS chrome integrating Facebook features. An API for Mobile OS UI to integrate Facebook features. How else do you think the OS provides FB functionality... after you enter your credentials into the Settings screen?!
- denom 8y ago
  Did the OS keep the data or use it in any way beyond what the OS needed for display etc?
- snowwrestler 8y ago
  I think you need to read a bit more carefully. This was not just API calls, these were data sharing partnerships--i.e. the device companies had access and permission to collect, aggregate, and store customer data in one place, like Cambridge Analytica did. Example quotes (emphasis added by me): > They said its partnerships were governed by contracts that strictly limited use of the data, including any stored on partners’ servers. > Tests by The Times showed that the partners requested and received data in the same way other third parties did. Facebook customer data was collected and stored on servers owned by the device manufacturers. This is not analogous to a browser interacting with the Facebook web application.

alistproducer2 8y ago

This is very different than scraping html. Facebook has obviously been lying about 3ed party data access. This comment is incoherent, at best, and it says a lot about how far the HN community has sunk that it is the top comment. "------ derangement" syndrome is a common phrase used on lots of political blogs that also specialize in nonsensical arguments and don't seem to care that entities in power lie through their teeth.

JumpCrisscross 8y ago

Hackers proclaiming "but it wasn't technically a breach" or "the API worked as intended" is 2018's edition of Great Recession bankers' "the counterparty should have known it was our business to screw them" or "it isn't our job to diligence the mortgages". There is discomfort associated with any paradigm shift. Particularly when our livelihoods are entangled in them. A good way to stick oneself on the wrong side is to brand change as derangement.

seanhunter 8y ago

If the discussion here is bad, you definitely have played a role in making it so. Claiming people who disagree with your point of view are "deranged" is not constructive.