7 ms·
Of note here, which has always been true, but worth remembering: Facebook can change the visibility of your posts however it likes, whenever it likes. The only
by compiler-guy 8y ago
Of note here, which has always been true, but worth remembering: Facebook can change the visibility of your posts however it likes, whenever it likes. The only thing stopping them is their own ethics. (And possibly a big fine in Europe, but that will be cold comfort to anyone whose personal info is exposed thus.)
Not that it _did_, but it certainly could, and will do so if it thinks it has good enough reason.
- bertil 8y agoNo: Facebook can change the algo that picks the default setting of the visibility of your future posts. Software changes are rather easy at Facebook (although that particular tool would surely have a ton of people monitoring it, including quantitative social scientists who don’t monitor a lot of pages). Changing the graph (stored information) is pretty much impossible without a lot of checks. That distinction is key to understand control at Facebook.
- compiler-guy 8y agoFacebook changed the visibility of the already-posted posts that had the bad default, without regard to user intent. All they did was decide to do it. Sure they have internal controls so a rogue engineer can't do it. But if Facebook, as a company, decides it wants to mess with your settings, it can, and it does. This event is an existence proof of that.
- bertil 8y agoTo reverse the visibility to private, you mean? I can’t start to imagine how they would do that, but “it took five days” points at a very kludgey hack.
- pdpi 8y ago> To reverse the visibility to private, you mean? And also making private anything you legitimately wanted made public, because they couldn't tell the difference.
- amatecha 8y agoThe privacy setting on a given FB post is most likely a list of which "friend groups" within your account can see the post, and modifying that value in the database would change how the post appears. Whatever you choose is just a different parameter that gets stored on that post and can trivially be modified on FB's side in the future. FB could make every post you've ever made show up as public, and update your profile to be completely public as well. It's completely technically possible, though not too likely to happen. Regarding the other point - the fact it took them 5 days to revert the privacy status on weeks' worth of posts of some ~14million users just points to them being thorough and _not_ doing it in a hacky manner. A hackish solution could have been done in an hour or two, most likely.
- bertil 8y agoSorry, I should have been clearer: I used to work there. Knowing how the information is stored and protected, I can’t imagine how one would do it.
- EnFinlay 8y ago> UPDATE posts SET public = true; 584,203,510,091,521 records updated
- SmellyGeekBoy 8y agoI broke out in a cold sweat just reading that.
- pritambaral 8y agoI think you were trying to distinguish 'Facebook' (the company / management at / powerful rogue agents in / whatever) and 'SWEs at Facebook', without actually calling them different things. Those are very different things, and your parent was rightly referring to the former.
- ry_ry 8y agoIn fairness, that's pretty much a given for any web app. Whatever user groups they create are only ever going to be an artificial construct - it's all just lists of stuff
- gkya 8y agoCan E2E encryption not help? It works with WhatsApp or Signal groups, no?
- willvarfar 8y agoBut the app writer, os vendor or dev who wrote a library the app uses can defeat the e2e encryption because they are at the end.
- Grollicus 8y agoThe difference being, this needs malicious intent whereas accidentally configuring visibility defaults wrong or accidentally running `update foo set visibility='all'` are just a single small mistake.
- jboy55 8y agoGoogle 'could' open up all their gmail account's inboxes to an unrestricted public read-only rest api and shut down their normal email interface. They 'could' do this tomorrow. So everyone could see everyone else's email inbox. Yahoo could do that and include even all the emails their users 'deleted'. At one time, back in the 'olden days, everyone operated on the net as if this was a very real possibility.
- ry_ry 8y agoExactly. I work for one of the large ecommerce tech companies - we have some great devs and run a pretty efficient cdci pipeline, stuff ships fast. There are multiple layers of unit testing, automated testing, manual testing and peer review in place to prevent this sort of thing. Despite that, I can totally see how it wouldn't take much for a changeset in one area of the site that affected the default option in a drop-down in another to creep under the radar.
- cpmouter 8y agoHN moderators can edit or remove this post I'm currently writing. What's your point?
- chipperyman573 8y agoHN mods can edit others' comments? Can someone else confirm this? I can't think of a valid use-case for this.
- Aaronn 8y agoYou are failing to see the point. Any website could theoretically do anything they wanted to their own website.
- cpmouter 8y agoReddit does not allow mods or admins to modify comments from the website UI, but that didn't stop the admin from modifying comments by editing the database directly.
- compiler-guy 8y agoYou are anonymous here, and your post contains no personal information, and none of your real life friends and acquaintances will see any information you intended to keep private. With facebook, you are not anonymous, many of your posts would contain private information, and many of them could be pushed to people you didn't want to share with. I don't know what threat models you find compelling. But the damage HN could do to someone with the info they have from an account holder is an order or two of magnitude less than the damage facebook could do.
- TeMPOraL 8y agoIt all boils down to: you're storing data in someone else's database. At this point, technically, they could do whatever they want with it. All that stops them from doing so is their ethics, the law, and the desire to keep their business.
- tannhaeuser 8y agoI wouldn't count on EU here. Public, state-owned EU broadcasters still naively and indefensibly maintain Facebook presences as the only way to get in touch. I mean, these are supposed to be press professionals, yet they still don't seem to understand the name of the game.
- ZgjimDida 8y ago> And possibly a big fine in Europe You made me curious. For what exactly could Facebook be fined, and how much would that fine be?
- proaralyst 8y agoThis might fall under the GDPR, at which point they'd get between 2 and 4% of their annual turnover in fines.