6 ms·

Crazy that everyone in here is defending Facebook. - How on earth does Facebook justify giving direct API access to information that users have, in every setti

Crazy that everyone in here is defending Facebook. - How on earth does Facebook justify giving direct API access to information that users have, in every setting possible, marked as private? - How on earth does Facebook justify offering deep API access on users who have literally disabled API access to their data? It's ridiculous, and it's more ridiculous that users here are conflating "basic API access with a sane permissions system to give you control" with "deep API access with no privacy controls whatsoever that openly defy existing privacy controls". It's not acceptable, and frankly, this is EXACTLY why government regulation of data online isn't a possibility, it's an inevitability. Because when the penalty for ignoring the user's selection of "DO NOT MAKE MY DATA AVAILABLE OVER THE API" and "DO NOT MAKE MY DATA AVAILABLE TO FRIENDS OF MY FRIENDS" etc is now billions of dollars in damages and potentially criminal charges for executives, magically, these violations will stop occuring. Until then, everything in this document is either a lie or sufficiently legalese'd that it's worthless, just like the lies that they told to Congress, just like Zuckerberg's lies to E.U. as well. I cannot wait until it is a crime to share private user data against their will. We live in a wild west and the past 10-15 years are proving just how much sheer damage we have caused in society by not criminalizing disrespect of digital privacy.

prepend 8y ago
“How on earth does Facebook justify offering deep API access on users who have literally disabled API access to their data?” Here how it seems really non-crazy to me as a programmer. Let’s say I make phone with a Linux OS. I want to make an app to let users check Facebook on my weird OS. I ask Facebook, they say no. I then build an app to call their API and let users do stuff. All my app does is call the API and show it to the user. In order for the app to function it has to use private data. But the data are not retained or analyzed, just used to operate the app. This is how all 3rd party apps work. The APIs were not for the general public, but only to trusted third parties. The alternative is that only Facebook can build and show apps. So this is pretty much how APIs have worked forever and why you only install apps and log into apps you trust. It would be like complaining that Adobe Reader can read private files from your laptop via Windows/Mac APIs. Of course it can, this is good. It’s bad of Adobe were to misuse the data.
- pmontra 8y ago
  Private means that I (the user of my own FB client) can see my private data. That's obvious. What must not happen is that I can also see data that my friends, or their friends, marked as private. This doesn't happen in the official FB client and must not happen with any API.
  - prepend 8y ago
    And it didn’t happen with FB’s API. Your friends could see their private data. You could see yours. The apps were not able to show your private data to friends and vice versa without breaking their contract with FB. It would be like being concerned because both you friends both use Chrome to access your individual, private bank accounts. Google accesses your private information, with your permission, to display data on your screen. It’s only bad if they misuse that data.
cjhopman 8y ago
You do realize that facebook will share user's private information with any random web browser that the user enters her credentials in, right? Is that "ridiculous"?
- criley2 8y ago
  If a friend of one of my friends, who I am not connected with, can acces my private data despite my settings being clearly limited, with API access disabled, "friends of my friends" settings disabled, as was reported is possible, then yes that is ridiculous. However your reply completely fails to grasp the problem, like so many others. It's not the fact that I type in a user/password and get my data, it's that, I type in my user/password and Facebook authorizes access to as many as 10,000 to 100,000 other accounts data, based on proximity to my account.
  - cjhopman 8y ago
    > your reply completely fails to grasp the problem, like so many others. That's because you're just making up a problem that doesn't exist. The replies are all talking about what is actually happening, not your fantasy world. As the article states: " friends’ information, like photos, was only accessible on devices when people made a decision to share their information with those friends".
    - snowwrestler 8y ago
      I understand why my iPhone needs access to my Facebook friends' info, in order to display it to me. I don't understand why Apple Inc. needs access and permission to download and store my friends' data on Apple Inc. servers. That is what the NY Times reported, and Facebook has not directly denied it here. Edit to be clear: I'm just using Apple as an example company.
      - doctorsher 8y ago
        Unfortunately, the NYT article is vague on how each of the approved device makers were using the data -- they only say "some partners" stored the data. But it doesn't seem like Apple in particular used the API in that capacity. From the article: "An Apple spokesman said the company relied on private access to Facebook data for features that enabled users to post photos to the social network without opening the Facebook app, among other things. Apple said its phones no longer had such access to Facebook as of last September."
methodover 8y ago
> - How on earth does Facebook justify giving direct API access to information that users have, in every setting possible, marked as private? The user logs into Facebook on the device. This log-in action the part of the user is effectively permission to share data with the device. > - How on earth does Facebook justify offering deep API access on users who have literally disabled API access to their data? When the user logs into Facebook on the device, they are giving permission for their data to be transferred via an API to that device. I do not understand your outrage.
- criley2 8y ago
  >The user logs into Facebook on the device. This log-in action the part of the user is effectively permission to share data with the device. As well as the data of 10,000 to 100,000 connected users as both friends and friends of friends have data pulled without any checks by the third party. "When the user logs into Facebook on the device, they are giving permission for their data to be transferred via an API to that device." When the user selects to have their data limited to friends only, and not friends of friends, then additionally disables API access to their data explicitly, no, they are not "giving permission for their data to be transferred via API". They are quite explicitly doing the opposite. My outrage, stated multiple times and oddly invisible to the users here, is that my user/password doesn't authorize the third party to access 10,000 to 100,000 other users private data, and those users personal settings should override any third party data hose utility.

prepend 8y ago

“How on earth does Facebook justify offering deep API access on users who have literally disabled API access to their data?” Here how it seems really non-crazy to me as a programmer. Let’s say I make phone with a Linux OS. I want to make an app to let users check Facebook on my weird OS. I ask Facebook, they say no. I then build an app to call their API and let users do stuff. All my app does is call the API and show it to the user. In order for the app to function it has to use private data. But the data are not retained or analyzed, just used to operate the app. This is how all 3rd party apps work. The APIs were not for the general public, but only to trusted third parties. The alternative is that only Facebook can build and show apps. So this is pretty much how APIs have worked forever and why you only install apps and log into apps you trust. It would be like complaining that Adobe Reader can read private files from your laptop via Windows/Mac APIs. Of course it can, this is good. It’s bad of Adobe were to misuse the data.

pmontra 8y ago
Private means that I (the user of my own FB client) can see my private data. That's obvious. What must not happen is that I can also see data that my friends, or their friends, marked as private. This doesn't happen in the official FB client and must not happen with any API.
- prepend 8y ago
  And it didn’t happen with FB’s API. Your friends could see their private data. You could see yours. The apps were not able to show your private data to friends and vice versa without breaking their contract with FB. It would be like being concerned because both you friends both use Chrome to access your individual, private bank accounts. Google accesses your private information, with your permission, to display data on your screen. It’s only bad if they misuse that data.

cjhopman 8y ago

You do realize that facebook will share user's private information with any random web browser that the user enters her credentials in, right? Is that "ridiculous"?

criley2 8y ago
If a friend of one of my friends, who I am not connected with, can acces my private data despite my settings being clearly limited, with API access disabled, "friends of my friends" settings disabled, as was reported is possible, then yes that is ridiculous. However your reply completely fails to grasp the problem, like so many others. It's not the fact that I type in a user/password and get my data, it's that, I type in my user/password and Facebook authorizes access to as many as 10,000 to 100,000 other accounts data, based on proximity to my account.
- cjhopman 8y ago
  > your reply completely fails to grasp the problem, like so many others. That's because you're just making up a problem that doesn't exist. The replies are all talking about what is actually happening, not your fantasy world. As the article states: " friends’ information, like photos, was only accessible on devices when people made a decision to share their information with those friends".
  - snowwrestler 8y ago
    I understand why my iPhone needs access to my Facebook friends' info, in order to display it to me. I don't understand why Apple Inc. needs access and permission to download and store my friends' data on Apple Inc. servers. That is what the NY Times reported, and Facebook has not directly denied it here. Edit to be clear: I'm just using Apple as an example company.
    - doctorsher 8y ago
      Unfortunately, the NYT article is vague on how each of the approved device makers were using the data -- they only say "some partners" stored the data. But it doesn't seem like Apple in particular used the API in that capacity. From the article: "An Apple spokesman said the company relied on private access to Facebook data for features that enabled users to post photos to the social network without opening the Facebook app, among other things. Apple said its phones no longer had such access to Facebook as of last September."

methodover 8y ago

> - How on earth does Facebook justify giving direct API access to information that users have, in every setting possible, marked as private? The user logs into Facebook on the device. This log-in action the part of the user is effectively permission to share data with the device. > - How on earth does Facebook justify offering deep API access on users who have literally disabled API access to their data? When the user logs into Facebook on the device, they are giving permission for their data to be transferred via an API to that device. I do not understand your outrage.

criley2 8y ago
>The user logs into Facebook on the device. This log-in action the part of the user is effectively permission to share data with the device. As well as the data of 10,000 to 100,000 connected users as both friends and friends of friends have data pulled without any checks by the third party. "When the user logs into Facebook on the device, they are giving permission for their data to be transferred via an API to that device." When the user selects to have their data limited to friends only, and not friends of friends, then additionally disables API access to their data explicitly, no, they are not "giving permission for their data to be transferred via API". They are quite explicitly doing the opposite. My outrage, stated multiple times and oddly invisible to the users here, is that my user/password doesn't authorize the third party to access 10,000 to 100,000 other users private data, and those users personal settings should override any third party data hose utility.