4 ms·

Facebook’s response seems perfectly reasonable to me. - Obviously in order to integrate FB functionality into a Mobile OS UI requires an API to render the data

by zaroth 8y ago

Facebook’s response seems perfectly reasonable to me. - Obviously in order to integrate FB functionality into a Mobile OS UI requires an API to render the data being displayed. - If your phone has a home screen widget which shows friend data, obviously that friend data came from a Facebook API call. - If you type your Facebook username and password into a settings dialog in order to enable that home screen widget to function, that’s pretty obviously consenting to enable the functionality. - There once was a day when we demanded our social media platforms to provide these “open access” APIs to specifically allow for accessing our own social feeds on our own devices. We trust our user agents to render our private information on our devices. Sometimes we even trust our user agents to leverage network services to improve the on-device performance (i.e. Amazon Silk) If and when user agents exfiltrate our personal data off device for data mining purposes (i.e. Chrome Omnibar) it should be disclosed and opt-in. It sounds like Facebook provided an API to device manufacturers to allow them to deeply integrate social features on device. This has historically been considered a Good Thing. It sounds like they put together a legal agreement that required these device manufacturers to take due care in implementing these features to protect user data. Also seems like historically this is what we would call a Good Thing. When you enter your username and password in order to view your Facebook feed — that’s called a “user agent” and that’s something appreciably different than a third party quiz app sucking in friend feed data. However, Chrome Omnibar aside, user agents are not expected to exfiltrate data in any way, and if that occurred, that would indeed be a story I’d like to read, and my ire in that case most certainly wouldn’t be directed against Facebook.

kmonsen 8y ago
Device manufacturers can also of course trivially bypass any way facebook tries to hide this data from them as well if they really want to. They control the OS and it's implementation, nothing can be hidden if they really badly want to get it.
- bastawhiz 8y ago
  Your phone manufacturer can also theoretically just watch your phone's display output over VNC if they had that kind of control over your device. If you believe your device's manufacturer is deliberately working to actively steal data from third party apps on your phone, perhaps you should consider a different phone.
Eridrus 8y ago
> When you enter your username and password in order to view your Facebook feed — that’s called a “user agent” and that’s something appreciably different than a third party quiz app sucking in friend feed data. I think we're trying to make this different in hindsight, but APIs for this sort of thing are the replacement for "please give my app your Facebook password". I hope everyone remembers how Facebook used to ask users for their GMail password and how Mint (still) asks users for their banking passwords. And if what you are doing is "giving an app access to my account", then letting them see everything you see is a pretty natural API. I think over time we have realised that users want more fine-grained permissions so they don't have to make such difficult decisions of whether they "trust" an app, but I know that as a developer and user I get pretty annoyed when other software cannot interact with an app for me because the API is too limiting.
- dmix 8y ago
  Exactly, this seems to be coming from people who don't fully understand or appreciate the history or social/technical/economic environment from which it came about. Then they are retroactively applying our relatively recently evolved demands for fine grained control of data. This type of thing in journalism really concerns me with the recent moral panic against 'fake news' and the attempts to create systems which define it. When what is 'true' or factual or not is so often subtle and easily spun/twisted. Which is ironic in this context because Facebook and NYTimes are both leading players championing these efforts.
- basseq 8y ago
  > Mint (still) asks users for their banking passwords. In defense of Mint, most banks are severely behind the curve when it comes to authentication, and there would be no way to provide that service otherwise. Where the financial institution has a better API, Mint happily supports it. (Interactive Brokers, IIRC, is an example of this.)
adrianmonk 8y ago
> There once was a day when we demanded our social media platforms to provide these “open access” APIs And we still demand them for other types of apps. If I have a Mac or iPhone, I can connect the Apple-supplied Mail app to Gmail with IMAP or POP or whatever it uses. If I have Windows with Outlook, I can connect it to whatever mail server too. And this software gets access to all the content of my emails, which is private data. Likewise, on a smartphone, I can install a third-party app to access Hacker News or Reddit. Because both of them have an open API. (In fact, for a long time there wasn't an official Reddit mobile app, and they encouraged you to go third party.)
- davegauer 8y ago
  It occurs to me that in addition to the usual list of permissions for apps, perhaps we should also be presented with a whitelist of domains the app is allowed to communicate with.
michaelmrose 8y ago
My email client has full access to the contents of my email but the author of said client has none. Although my client has credentials these are stored locally and like my email never communicated to the creator of my client. If the device makers applications merely fetched data on behalf of users and displayed it on their machine it would be no more of a problem than my email client. In the first place it looks the apis provided access to data the users had opted not to share in the second place the times article seems to state that partners partook of that data themselves rather than merely acting as a client example "Facebook acknowledged that some partners did store users’ data — including friends’ data — on their own servers. A Facebook official said that regardless of where the data was kept, it was governed by strict agreements between the companies." Before deciding if facebook's response was reasonable did you even bother reading the times article?
- makomk 8y ago
  The APIs provided access to data that had been shared with the person who was logged into the device, but not with random Facebook apps like Farmville. The New York Times' argument is essentially that the flag which stopped Cambridge Analytica and Zynga getting access to your data should also have stopped your actual friends from viewing it except through installing Facebook's official app. It's hard to see any way in which making users choose between sharing their info with every dodgy quiz their friends use and forcing their friends to install the Facebook app and let it get its tendrils into their devices in order to interact with them would've been good for privacy, but this is exactly what the NYT is insisting Facebook should've done.
- mic47 8y ago
  > "Facebook acknowledged that some partners did store users’ data — including friends’ data — on their own servers." This statement from the article is meaningless, as many legit things might mean "third party storing data" as: 1.) Storing and editing contact imports, if user wants. This is technically friends data, but it's my contact list. 2.) Proxy-ing and caching: we are talking about shitty phones mostly before android and ios were mainstream, so "store on their servers" could be as simple as an artefact of implementation of non-html facebook client app on that shitty phone. Example of such artefacts: custom notifications channels, caching, downscaling of images. I think that blackberry did proxy all of their communications through their servers (not 100% sure), so if Facebook was available, they probably also had to store something on their servers. The journalist didn't even attempted to distinguish between "my device is calling this api" and "company is doing requests" and resort to conflating those two and ambiguous "some partners did store users". This is example of journalist trying to create a story instead of getting to truth. If they would dig deeper, and try to figure out which companies stored data, what type of data (was it contact import, caching, or did they download full graph?), and what was purpose, it would be valuable article.
candiodari 8y ago
Yeah the problem that keeps, and keeps and keeps coming back is that cloud based software gives too much control to the software authors. Because that's where the ground of your argument sits: because of server-side "rendering" the data must be sent to the servers of the software author, in this case Huawei but doubtless many others, instead of to the device that actually displays the information. ... and that's exactly why everybody's doing cloud based software. Because it allows them to abuse this. And once they've got the customer by the ... they ask money for that. Cloud based software is how the author of a todo-list app can hold users' data hostage more effectively, more detrimetentally to the customer than Microsoft's monopoly that was blown up in the cause of justice.

by zaroth 8y ago

kmonsen 8y ago

Device manufacturers can also of course trivially bypass any way facebook tries to hide this data from them as well if they really want to. They control the OS and it's implementation, nothing can be hidden if they really badly want to get it.

bastawhiz 8y ago
Your phone manufacturer can also theoretically just watch your phone's display output over VNC if they had that kind of control over your device. If you believe your device's manufacturer is deliberately working to actively steal data from third party apps on your phone, perhaps you should consider a different phone.

Eridrus 8y ago

> When you enter your username and password in order to view your Facebook feed — that’s called a “user agent” and that’s something appreciably different than a third party quiz app sucking in friend feed data. I think we're trying to make this different in hindsight, but APIs for this sort of thing are the replacement for "please give my app your Facebook password". I hope everyone remembers how Facebook used to ask users for their GMail password and how Mint (still) asks users for their banking passwords. And if what you are doing is "giving an app access to my account", then letting them see everything you see is a pretty natural API. I think over time we have realised that users want more fine-grained permissions so they don't have to make such difficult decisions of whether they "trust" an app, but I know that as a developer and user I get pretty annoyed when other software cannot interact with an app for me because the API is too limiting.

dmix 8y ago
Exactly, this seems to be coming from people who don't fully understand or appreciate the history or social/technical/economic environment from which it came about. Then they are retroactively applying our relatively recently evolved demands for fine grained control of data. This type of thing in journalism really concerns me with the recent moral panic against 'fake news' and the attempts to create systems which define it. When what is 'true' or factual or not is so often subtle and easily spun/twisted. Which is ironic in this context because Facebook and NYTimes are both leading players championing these efforts.
basseq 8y ago
> Mint (still) asks users for their banking passwords. In defense of Mint, most banks are severely behind the curve when it comes to authentication, and there would be no way to provide that service otherwise. Where the financial institution has a better API, Mint happily supports it. (Interactive Brokers, IIRC, is an example of this.)

adrianmonk 8y ago

> There once was a day when we demanded our social media platforms to provide these “open access” APIs And we still demand them for other types of apps. If I have a Mac or iPhone, I can connect the Apple-supplied Mail app to Gmail with IMAP or POP or whatever it uses. If I have Windows with Outlook, I can connect it to whatever mail server too. And this software gets access to all the content of my emails, which is private data. Likewise, on a smartphone, I can install a third-party app to access Hacker News or Reddit. Because both of them have an open API. (In fact, for a long time there wasn't an official Reddit mobile app, and they encouraged you to go third party.)

davegauer 8y ago
It occurs to me that in addition to the usual list of permissions for apps, perhaps we should also be presented with a whitelist of domains the app is allowed to communicate with.

michaelmrose 8y ago

My email client has full access to the contents of my email but the author of said client has none. Although my client has credentials these are stored locally and like my email never communicated to the creator of my client. If the device makers applications merely fetched data on behalf of users and displayed it on their machine it would be no more of a problem than my email client. In the first place it looks the apis provided access to data the users had opted not to share in the second place the times article seems to state that partners partook of that data themselves rather than merely acting as a client example "Facebook acknowledged that some partners did store users’ data — including friends’ data — on their own servers. A Facebook official said that regardless of where the data was kept, it was governed by strict agreements between the companies." Before deciding if facebook's response was reasonable did you even bother reading the times article?

makomk 8y ago
The APIs provided access to data that had been shared with the person who was logged into the device, but not with random Facebook apps like Farmville. The New York Times' argument is essentially that the flag which stopped Cambridge Analytica and Zynga getting access to your data should also have stopped your actual friends from viewing it except through installing Facebook's official app. It's hard to see any way in which making users choose between sharing their info with every dodgy quiz their friends use and forcing their friends to install the Facebook app and let it get its tendrils into their devices in order to interact with them would've been good for privacy, but this is exactly what the NYT is insisting Facebook should've done.
mic47 8y ago
> "Facebook acknowledged that some partners did store users’ data — including friends’ data — on their own servers." This statement from the article is meaningless, as many legit things might mean "third party storing data" as: 1.) Storing and editing contact imports, if user wants. This is technically friends data, but it's my contact list. 2.) Proxy-ing and caching: we are talking about shitty phones mostly before android and ios were mainstream, so "store on their servers" could be as simple as an artefact of implementation of non-html facebook client app on that shitty phone. Example of such artefacts: custom notifications channels, caching, downscaling of images. I think that blackberry did proxy all of their communications through their servers (not 100% sure), so if Facebook was available, they probably also had to store something on their servers. The journalist didn't even attempted to distinguish between "my device is calling this api" and "company is doing requests" and resort to conflating those two and ambiguous "some partners did store users". This is example of journalist trying to create a story instead of getting to truth. If they would dig deeper, and try to figure out which companies stored data, what type of data (was it contact import, caching, or did they download full graph?), and what was purpose, it would be valuable article.

candiodari 8y ago

Yeah the problem that keeps, and keeps and keeps coming back is that cloud based software gives too much control to the software authors. Because that's where the ground of your argument sits: because of server-side "rendering" the data must be sent to the servers of the software author, in this case Huawei but doubtless many others, instead of to the device that actually displays the information. ... and that's exactly why everybody's doing cloud based software. Because it allows them to abuse this. And once they've got the customer by the ... they ask money for that. Cloud based software is how the author of a todo-list app can hold users' data hostage more effectively, more detrimetentally to the customer than Microsoft's monopoly that was blown up in the cause of justice.