4 ms·

The limited responses so far in this thread only reinforce many companies decisions to pull support for public apis. How many years have developers been complai

The limited responses so far in this thread only reinforce many companies decisions to pull support for public apis. How many years have developers been complaining that twitter and facebook have been restricting access to apis for 3rd parties, but now all of a sudden they're evil for ever offering apis to begin with?

deleted 8y ago
[deleted]
vorpalhex 8y ago
There's nothing wrong with offering a public API. There's everything wrong with offering a secret, non-public API where you give a third party I didn't consent to full access to all of my data. See how that's a bit different? One of them is offering public information (say, stock quotes), publicly. One of them is offering private information (my sexual orientation and date of birth) to tons of third parties I didn't consent to having that information shared with.
- esrauch 8y ago
  Surely it is only giving blackberry the information if you type in your login credentials on a blackberry right? I don't see how the situation is actually different now: if you run the official Facebook app on your Galaxh phone then Samsung could scrape and exfiltrate the data anytime it wants. It is Samsung's fault if they do it not Facebook's.
  - jakelazaroff 8y ago
    According to the New York Times article [1] the third parties were able to obtain information about you if a friend signs in on their phone, no consent from you required: > Facebook’s view that the device makers are not outsiders lets the partners go even further, The Times found: They can obtain data about a user’s Facebook friends, even those who have denied Facebook permission to share information with any third parties. [1] https://www.nytimes.com/interactive/2018/06/03/technology/facebook-device-partners-users-friends-data.html https://www.nytimes.com/interactive/2018/06/03/technology/fa...
    - md224 8y ago
      Not siding with FB here, but their response appears to address this: > Contrary to claims by the New York Times, friends’ information, like photos, was only accessible on devices when people made a decision to share their information with those friends. Maybe the confusion is that FB isn't treating these integrations as "third parties" since they're supposed to be pseudo-official FB apps? Edit: Thinking about it further, this is the crux of the matter, isn't it? Whether or not an FB-approved "mobile experience" counts as an official FB app or a third-party app?
      - deleted 8y ago
        [deleted]
      - manquer 8y ago
        Sharing with friends is not the same as with data mining third party apps such friends install
    - ameister14 8y ago
      Of course they can, though. Are you surprised that to see data on your phone (such as images/text your friends share with you and nobody else), your phone needs to be able to pull that data from the Facebook database? How else is it supposed to work? If your phone saved it or your provider saved the data in a server somewhere without your permission and used it for other purposes, that's a pretty big deal. As it is, this should only be a shock if you have no idea how the modern internet works.
    - miracle2k 8y ago
      I log into the Facebook app on my Blackberry. I can see my friend's data in the same way I could as if I used the Facebook website. The only difference is that the app on the phone has been coded by Blackberry, and the JavaScript code in my browser has been coded by Facebook, except of course for the banner part that my ISP injected, or all the JavaScript code that third parties injected, and who are thus functionally equivalent to the code written by Blackberry. In this scenario, no third party had access to anyones data, right?
    - 8y ago
  - vorpalhex 8y ago
    If Samsung secretly runs a keylogger on all their phones and then steals your data that way, that's a Samsung problem and you should be angry. That is not what happened here. Facebook officially blessed other platforms, allowed them to say you were signing into Facebook, and then allowed those platforms to have access not only to your data, but your friends exhaustive data. Facebook was aware of this, explicitly allowed this, and their only safeguard was vaguely worded policies with their partners. Even if the partners haven't stolen any data or broken their policies, Facebook intentionally and knowingly gave my data to a third party without my consent. Presumably now all 66 of these device partners have my full data, and I did not sign in on their device or otherwise authorize it.
    - prepend 8y ago
      “and then allowed those platforms to have access not only to your data, but your friends exhaustive data.” Only for purposes of allowing the user to interact with Facebook. The platforms themselves couldn’t use the data for anything other than supporting user actions. This is perfectly reasonable and is why APIs exist. The issue, which has not been repeated, would be if those platforms retained data without user consent and used the data for other purposes. That would violate the contract they signed with Facebook and be bad for use privacy. To a non technology person, these two very different things sound similar (Facebook let Microsoft access use data). But this is meaningless without more context.
    - esrauch 8y ago
      Facebook officially sends arbitrary friends data through the Android/Samung APIs in the normal course of operating the official FB app. It likely also locally caches a lot of data in a format and on-device storage that Samsung could arbitrarily access. The only thing stopping Samsung from stealing all of your friends data is legal and social, not technical. Is there any evidence that the API was actually used to arbitrarily request and exfiltrate other users profiles? If not, this is strictly only "Facebook allowed other developers to write Facebook apps": there is no way that could possible work without offering an API with this level off access to the app.
  - btilly 8y ago
    No, it is giving Blackberry the information if any friend of mine offers THEIR login credentials. I friended my cousin because she is my cousin. I didn't think about what kind of device she uses. I certainly didn't intend for her to hand my personal information over to a company that I don't know.
burkaman 8y ago
It's hard to believe you're asking this question in good faith. I'm sure you understand there's more to it than "APIs are good" or "APIs are bad", obviously the purpose of the API matters. If Twitter offered a public API for information that users hadn't realized they'd made public, that would be bad. When they pull support for an API for information everyone intended to be public and searchable, that is also bad.
patja 8y ago
Offering an API is great. Just don't expect developers to voluntarily restrain their use of the API according to some words you put on a web page. Maybe most will do so, but a significant portion will growth-hack their way right past whatever policy they agreed to. If you don't want someone to do something with your API, you better make it impossible to accomplish using said API. The problem is in offering an API that makes abuse trivially simple and putting all of your faith in the "click agree" model of expecting developers to (a) understand and (b) actually comply with your policy. Particularly when many of the developers in question are non-native English speakers, or even if they are native speakers and don't bother to read the policy carefully.

deleted 8y ago

[deleted]

vorpalhex 8y ago

There's nothing wrong with offering a public API. There's everything wrong with offering a secret, non-public API where you give a third party I didn't consent to full access to all of my data. See how that's a bit different? One of them is offering public information (say, stock quotes), publicly. One of them is offering private information (my sexual orientation and date of birth) to tons of third parties I didn't consent to having that information shared with.

esrauch 8y ago
Surely it is only giving blackberry the information if you type in your login credentials on a blackberry right? I don't see how the situation is actually different now: if you run the official Facebook app on your Galaxh phone then Samsung could scrape and exfiltrate the data anytime it wants. It is Samsung's fault if they do it not Facebook's.
- jakelazaroff 8y ago
  According to the New York Times article [1] the third parties were able to obtain information about you if a friend signs in on their phone, no consent from you required: > Facebook’s view that the device makers are not outsiders lets the partners go even further, The Times found: They can obtain data about a user’s Facebook friends, even those who have denied Facebook permission to share information with any third parties. [1] https://www.nytimes.com/interactive/2018/06/03/technology/facebook-device-partners-users-friends-data.html https://www.nytimes.com/interactive/2018/06/03/technology/fa...
  - md224 8y ago
    Not siding with FB here, but their response appears to address this: > Contrary to claims by the New York Times, friends’ information, like photos, was only accessible on devices when people made a decision to share their information with those friends. Maybe the confusion is that FB isn't treating these integrations as "third parties" since they're supposed to be pseudo-official FB apps? Edit: Thinking about it further, this is the crux of the matter, isn't it? Whether or not an FB-approved "mobile experience" counts as an official FB app or a third-party app?
    - deleted 8y ago
      [deleted]
    - manquer 8y ago
      Sharing with friends is not the same as with data mining third party apps such friends install
  - ameister14 8y ago
    Of course they can, though. Are you surprised that to see data on your phone (such as images/text your friends share with you and nobody else), your phone needs to be able to pull that data from the Facebook database? How else is it supposed to work? If your phone saved it or your provider saved the data in a server somewhere without your permission and used it for other purposes, that's a pretty big deal. As it is, this should only be a shock if you have no idea how the modern internet works.
  - miracle2k 8y ago
    I log into the Facebook app on my Blackberry. I can see my friend's data in the same way I could as if I used the Facebook website. The only difference is that the app on the phone has been coded by Blackberry, and the JavaScript code in my browser has been coded by Facebook, except of course for the banner part that my ISP injected, or all the JavaScript code that third parties injected, and who are thus functionally equivalent to the code written by Blackberry. In this scenario, no third party had access to anyones data, right?
  - 8y ago
- vorpalhex 8y ago
  If Samsung secretly runs a keylogger on all their phones and then steals your data that way, that's a Samsung problem and you should be angry. That is not what happened here. Facebook officially blessed other platforms, allowed them to say you were signing into Facebook, and then allowed those platforms to have access not only to your data, but your friends exhaustive data. Facebook was aware of this, explicitly allowed this, and their only safeguard was vaguely worded policies with their partners. Even if the partners haven't stolen any data or broken their policies, Facebook intentionally and knowingly gave my data to a third party without my consent. Presumably now all 66 of these device partners have my full data, and I did not sign in on their device or otherwise authorize it.
  - prepend 8y ago
    “and then allowed those platforms to have access not only to your data, but your friends exhaustive data.” Only for purposes of allowing the user to interact with Facebook. The platforms themselves couldn’t use the data for anything other than supporting user actions. This is perfectly reasonable and is why APIs exist. The issue, which has not been repeated, would be if those platforms retained data without user consent and used the data for other purposes. That would violate the contract they signed with Facebook and be bad for use privacy. To a non technology person, these two very different things sound similar (Facebook let Microsoft access use data). But this is meaningless without more context.
  - esrauch 8y ago
    Facebook officially sends arbitrary friends data through the Android/Samung APIs in the normal course of operating the official FB app. It likely also locally caches a lot of data in a format and on-device storage that Samsung could arbitrarily access. The only thing stopping Samsung from stealing all of your friends data is legal and social, not technical. Is there any evidence that the API was actually used to arbitrarily request and exfiltrate other users profiles? If not, this is strictly only "Facebook allowed other developers to write Facebook apps": there is no way that could possible work without offering an API with this level off access to the app.
- btilly 8y ago
  No, it is giving Blackberry the information if any friend of mine offers THEIR login credentials. I friended my cousin because she is my cousin. I didn't think about what kind of device she uses. I certainly didn't intend for her to hand my personal information over to a company that I don't know.

burkaman 8y ago

It's hard to believe you're asking this question in good faith. I'm sure you understand there's more to it than "APIs are good" or "APIs are bad", obviously the purpose of the API matters. If Twitter offered a public API for information that users hadn't realized they'd made public, that would be bad. When they pull support for an API for information everyone intended to be public and searchable, that is also bad.

patja 8y ago

Offering an API is great. Just don't expect developers to voluntarily restrain their use of the API according to some words you put on a web page. Maybe most will do so, but a significant portion will growth-hack their way right past whatever policy they agreed to. If you don't want someone to do something with your API, you better make it impossible to accomplish using said API. The problem is in offering an API that makes abuse trivially simple and putting all of your faith in the "click agree" model of expecting developers to (a) understand and (b) actually comply with your policy. Particularly when many of the developers in question are non-native English speakers, or even if they are native speakers and don't bother to read the policy carefully.