8 ms·

“So the silence from Facebook over the weekend is.. deafening.”

125 points by vinnyglennon 8y ago

londons_explore 8y ago
I would guess the silence is driven by lawyers and PR folk. We probably won't hear anything until we start getting leaks from the investigations of data protection regulators around the world.
- gavinsblog 8y ago
  It's mainly driven by investigation I'm guessing, with the FBI in tow too.
freeone3000 8y ago
This thread is a little pessimistic. Why would facebook suffer any consequences from this whatsoever? When has a data breach actually affected the company?
- anjc 8y ago
  As I understand it, this wasn't just a simple/typical security breach. The hackers had access to people's accounts and for who knows how long. 50 million people's private conversations and pictures being made public, for example, would be the end of Facebook.
  - pmlnr 8y ago
    you underestimate the nihilistic attitude towards anything facebook vs privacy related. I don't think there is anyone out there who even remotely thinks their doings on FB is private any more, including PMs.
    - unimpressive 8y ago
      I think you underestimate the extent to which people think their PM's aren't a big deal, until they get released and a torrent of sexting, gossip, illicit relationships, bullying, and public scandal washes over society as fallout. "I have nothing to hide" is the mantra of fools and people too domesticated to even imagine the ways that malicious crooks and societal pranksters can have it out for them.
    - anjc 8y ago
      I'd consider myself 'tech savvy' and still expect my conversations on Facebook to remain non-public even in the case of security negligence on my part. If anything private is released through this hack, other than hashed passwords or similar (worst case), I'm absolutely done with Facebook and any similar entity.
  - nfoz 8y ago
    Ironic, because that was the beginning of Facebook. Sort of the whole point was to have public conversations and pictures. Also I think that would be huge and cause some number of people to quit facebook, but I'm confident it wouldn't be the "end".
  - gavinsblog 8y ago
    Which is the simple point I'm making - a worst case scenario here destroys FB's reputation for safely storing your private messages.
- ForHackernews 8y ago
  By "pessimistic" do you mean unrealistically, naively optimistic? (I agree FB will likely suffer face no consequences)
- kartan 8y ago
  > Why would facebook suffer any consequences from this whatsoever? When has a data breach actually affected the company? Facebook is too big. It does not play against its customers or users, but against governments and legislation. Sooner or later legislation is going to catch up with all the potential risks and abuses that Facebooks facilitates. Each misstep takes it closer to an stronger legislation. For all the big tech companies it is better for themselves to slap on their own hand than to let the government do it.
- oliwarner 8y ago
  If they don't disclose in time, or are found to have been able to have prevented the breach, they could face some serious fines in the EU under GDPR. At odds with the Armageddon-like comments in the Twitter thread, this is still to be worked out. It is not a certainty.
anjc 8y ago
Facebook, Whatsapp and Instagram went down globally for hours at the start of August. There was no explanation about this major outage as far as I remember. Does anybody know if it was related to this data breach? If so, why were people only informed of the breach nearly a month later?
- Cursuviam 8y ago
  No, it wasn't. I was interning there at the time and love to regularly check the current issues page. Also, they probably did just learn about the breach day of from the person who was going to livestream deleting Zuckerburg's account.
  - anjc 8y ago
    Thanks. Were people as panicked inside Facebook during the outage, as I was as a user trying to browse meme groups?
    - Cursuviam 8y ago
      More exasperated, I think? If I remember correctly, it wasn't too complex to fix (maybe just a rollback), it just took sometime to push to prod. Mostly my interactions involving the outage were just browsing memes about it in shitposting@
dharmon 8y ago
> By company-ending I mean Facebook would never recover from the consequences of so much user data being dumped online for all to see. It would permanently end the company. Shareholders should be worried. We just don't know how much user data was stolen yet. Exactly. I mean, just look at what happened to Equifax. Oh wait...
- anjc 8y ago
  The general public don't have a clue what Equifax is and don't know about the hack. Your Grandparent's sexting convos being put online might grab the public's attention a little more.
- drewmol 8y ago
  There is an important distiction: Equifax's data is not voluntarily submitted by the data subjects, while most of Facebook's is.
  - Redoubts 8y ago
    That sounds worse for Equifax
    - drewmol 8y ago
      Although I don't see this having a huge immediate impact on Facebook, the distinction is that if Equifax neglagently releases your PII there is little fallout as you are not the one providing Equifax with that data and cannot simply stop feeding them data, when Facebook does it their data subjects can choose to stop providing the data by exiting the platform. Facebook needs both the user data, and those same users patronizing their service to maintain the existing revenue stream.
  - tyfon 8y ago
    Equifax is also not under EU (GDPR) jurisdiction afaik.
  - gavinsblog 8y ago
    Precisely.
734786710934 8y ago
This Twitter thread by Alex Stamos (former Facebook CSO) is a good rebut to this: https://twitter.com/alexstamos/status/1046783533220421632 https://twitter.com/alexstamos/status/1046783533220421632. Bottom line: you can do incident response quickly or correctly, but not both.
- rachelbythebay 8y ago
  Don't forget about "neither". That happens too.
intern4tional 8y ago
I've seen several similar threads to this one on Twitter. "Blah happened at Facebook and it is potentially a company ending event." This causes me to almost immediately discredit them, as while serious, this is no where near a company ending event for an organization that is headquartered in the US. Equifax lost the personal data of all Americans and is doing fine. Facebook might get fined a metric ton of money, people in some portions of the world might leave it, but the company will be just fine. You see, there is no where else for those people to go. Presumably they're on Facebook for some reason so they would want to find an alternative and there isn't an alternative that is as easy to use that their friends and family will migrate to. Like many other compromises, this one will be forgotten. There is no wordlist that will come out of it, no public artifact that will exist. People have already forgotten about Adobe, LinkedIn is fading, and this one will eventually join their ranks.
- Iv 8y ago
  I tend to react similarly but this event is the first one that triggered some of my non-tech FB contacts to leave for more geeky alternatives, namely diaspora. The groups of his friends is discussing moving as well. This is anecdotal but I hope several groups are considering the same now...
  - skinnymuch 8y ago
    I’ll give back another anecdote. This did nothing for anyone I know.
    - diminoten 8y ago
      Not only did this not do anything for anyone I know as well, many people I know used complacency language when talking about it; large data breaches seem normalized now, they don't faze the tech-illiterate anymore. The HN bubble sort of gives us a false sense that this is a Big Fucking Deal, but I didn't get the sense that my friends and cared, or even really knew.
      - 8y ago
21 8y ago
The stock is down a measly 1.5%. Nobody gives a fuck. Compare with TSLA Musk SEC investigation which caused a 10% plunge. A misleading tweet is considered much more dangerous by the market than a 50 mil account breach. Investors know there are no real world consequences to a massive breach.
- gavinsblog 8y ago
  We don't know the full extent of the hack yet. As the thread says! It might be not so bad, or it might be awful.
- joering2 8y ago
  From $219 to $160 thats “measly 1.5%” ? Maybe by Sesame Street’s Yellow Bird math standards.
  - dsp1234 8y ago
    The closing price on Thursday was $168.84. The close yesterday was $162.44. That's a 3.8% decline. I'm not sure where you got the $219 price from, but the stock price was nowhere near that before the breach.
    - jamie_ca 8y ago
      $219 is the stock's high price from this summer? The fall from there was totally unrelated.
Patrax 8y ago
Is this person trying to dump FB stock for his own benefit? It makes me very skeptic that he had to tweet 11 times in a very alarmist tone. If his opinion is firm on transitioning from FB to a more private and secure alternative why not just say that in 1 or 2 tweets in a tone endorsing other platforms perhaps in a more positive manner?
strictnein 8y ago
> "And is up there with the biggest (if not the biggest) hacks of all time." In what world is this even remotely the case? OPM, Equifax, etc are far more serious hacks than this. Yahoo's multiple breaches dwarf the Facebook hack. 3 billion vs 50 or 90 million: https://money.cnn.com/2017/10/03/technology/business/yahoo-breach-3-billion-accounts/index.html https://money.cnn.com/2017/10/03/technology/business/yahoo-b...
deleted 8y ago
[deleted]
KaiserPro 8y ago
Well, I assume he's out to sell something. 1) He says you should delete your facebook account. It's too late, the data is already there. Deleting does nothing. 2) "By company-ending I mean Facebook would never recover from the consequences of so much user data being dumped online for all to see" utter conjecture. there are petabytes of data, dumping that online is hard. Exfiltrating unnoticed is hard. 3) "This is potentially so bad that it could be called the Great Facebook Hack of 2018. But again, we don't know how much stuff was stolen. Yet." Again conjecture. This could be called the "great facebook spotted a hack on two account and stopped it before it got bad" This is pointless punditry from someone who literally is nothing to do with facebook, has no contact with people close to the matter, and is just guessing. yes, that much data in someone's hands is bad, but so is google, and the legion of databrokers and ad spinner.
- akerro 8y ago
  >1) He says you should delete your facebook account. It's too late, the data is already there. Deleting does nothing. Prevents being hacked again in the future?
- diminoten 8y ago
  Honestly I'd delete my Facebook if there were anything of value on there, or if I cared about being impersonated on that platform, but neither of those things are true.
  - onemoresoop 8y ago
    Yes but your account can be used maliciously and still impersonate you. Your account can be used to sway elections and so on. I don't feel comfortable with that, but if you do then it's okay.
    - diminoten 8y ago
      My account can't be used to sway elections, Facebook can be used to sway elections. I have no Facebook clout upon which a hacker could build anything of value.
draw_down 8y ago
Counterpoint: almost no one will care and nothing of consequence to FB will result from this.
oliwarner 8y ago
"We don't know anything for certain but I'm double-dog sure you should sell all your shares and delete all your logins." There's even nonsense about GDPR in the comments. This all stinks of shorting... And even if it's not, it's too sensationalist to take seriously without more data.
kochb 8y ago
This is a great example of a link that should be off-topic for HN. There’s not one new material fact in the linked tweet, nor does it make an attempt at fair analysis. It instead consists of hyperbole (“company ending”) and unfounded speculation (“I imagine”). It’s just not a good starting point for serious discussion of the breach.
shujito 8y ago
The amount of attention on that Twitter thread makes me think how much people really care about the issue. Maybe I'm wrong, hoping it gets light later on.
sidcool 8y ago
This thread seems to have developed learned helplessness. This reflects very badly of our confidence in the legal system. Equifax and tobacco industry needs to be punished to feel the brunt of their crimes. But we seem to have accepted the fate.
stevew20 8y ago
Hey, let's boycott Gavin's Blog! His alarmism is so skewing that it is pretty much fake news. Let's make him pay a bit, teach the lesson that you shouldn't post such drivel on HN.
mindcrash 8y ago
Simple. I've done a shit ton of research on Corporate Surveillance in the past and there are a lot of signs of a big discrepancy of what people think what is stored about them in TAO and what is _really_ stored about them in TAO. (For those of you who are not that into Facebook, infrastructure and/or devops: TAO is Facebook's graph database) One of the keywords here is "shadow profiles" or the nodes and edges within the graph which are actually there but you can't directly influence as a user. A good example would be the former colleague of a close family member who never disclosed their place of work and without a current account whom Facebook decided to recommend as a "friend" to another family member who currently has a Facebook account but without an actual past or live connection between the two -- true story, I shit you not. So it's better to stay silent than proof yet again that there is a profound case for GDPR-like regulation - like Brandon Eich recently recommended - in the United States.
newscracker 8y ago
Why is the silence deafening? And what exactly is expected from Facebook? Today it'd say it was 50 million affected, and in a day change it to up to 90 million, and a week later it'll become 130 million, then it'll be 150 million, and then people will stop caring, as they have before, and move on. There are three kinds of people — those who stopped using Facebook a long, long time ago when the very first privacy issues came about; those who will never stop using Facebook unless they're moving to Instagram or another hotness of the day; those who may stop using Facebook after hearing about privacy or security issues. The last category is very, very small. So is the first. The only way to get out of this mess is to have a "new hotness" that's as good as (if not better than) Facebook and is privacy preserving, decentralized, easy to use, etc. We're still a long way away from that.

125 points by vinnyglennon 8y ago

I would guess the silence is driven by lawyers and PR folk. We probably won't hear anything until we start getting leaks from the investigations of data protection regulators around the world.

gavinsblog 8y ago
It's mainly driven by investigation I'm guessing, with the FBI in tow too.

freeone3000 8y ago

This thread is a little pessimistic. Why would facebook suffer any consequences from this whatsoever? When has a data breach actually affected the company?

anjc 8y ago
As I understand it, this wasn't just a simple/typical security breach. The hackers had access to people's accounts and for who knows how long. 50 million people's private conversations and pictures being made public, for example, would be the end of Facebook.
- pmlnr 8y ago
  you underestimate the nihilistic attitude towards anything facebook vs privacy related. I don't think there is anyone out there who even remotely thinks their doings on FB is private any more, including PMs.
  - unimpressive 8y ago
    I think you underestimate the extent to which people think their PM's aren't a big deal, until they get released and a torrent of sexting, gossip, illicit relationships, bullying, and public scandal washes over society as fallout. "I have nothing to hide" is the mantra of fools and people too domesticated to even imagine the ways that malicious crooks and societal pranksters can have it out for them.
  - anjc 8y ago
    I'd consider myself 'tech savvy' and still expect my conversations on Facebook to remain non-public even in the case of security negligence on my part. If anything private is released through this hack, other than hashed passwords or similar (worst case), I'm absolutely done with Facebook and any similar entity.
- nfoz 8y ago
  Ironic, because that was the beginning of Facebook. Sort of the whole point was to have public conversations and pictures. Also I think that would be huge and cause some number of people to quit facebook, but I'm confident it wouldn't be the "end".
- gavinsblog 8y ago
  Which is the simple point I'm making - a worst case scenario here destroys FB's reputation for safely storing your private messages.
ForHackernews 8y ago
By "pessimistic" do you mean unrealistically, naively optimistic? (I agree FB will likely suffer face no consequences)
kartan 8y ago
> Why would facebook suffer any consequences from this whatsoever? When has a data breach actually affected the company? Facebook is too big. It does not play against its customers or users, but against governments and legislation. Sooner or later legislation is going to catch up with all the potential risks and abuses that Facebooks facilitates. Each misstep takes it closer to an stronger legislation. For all the big tech companies it is better for themselves to slap on their own hand than to let the government do it.
oliwarner 8y ago
If they don't disclose in time, or are found to have been able to have prevented the breach, they could face some serious fines in the EU under GDPR. At odds with the Armageddon-like comments in the Twitter thread, this is still to be worked out. It is not a certainty.

anjc 8y ago

Facebook, Whatsapp and Instagram went down globally for hours at the start of August. There was no explanation about this major outage as far as I remember. Does anybody know if it was related to this data breach? If so, why were people only informed of the breach nearly a month later?

Cursuviam 8y ago
No, it wasn't. I was interning there at the time and love to regularly check the current issues page. Also, they probably did just learn about the breach day of from the person who was going to livestream deleting Zuckerburg's account.
- anjc 8y ago
  Thanks. Were people as panicked inside Facebook during the outage, as I was as a user trying to browse meme groups?
  - Cursuviam 8y ago
    More exasperated, I think? If I remember correctly, it wasn't too complex to fix (maybe just a rollback), it just took sometime to push to prod. Mostly my interactions involving the outage were just browsing memes about it in shitposting@

dharmon 8y ago

> By company-ending I mean Facebook would never recover from the consequences of so much user data being dumped online for all to see. It would permanently end the company. Shareholders should be worried. We just don't know how much user data was stolen yet. Exactly. I mean, just look at what happened to Equifax. Oh wait...

anjc 8y ago
The general public don't have a clue what Equifax is and don't know about the hack. Your Grandparent's sexting convos being put online might grab the public's attention a little more.
drewmol 8y ago
There is an important distiction: Equifax's data is not voluntarily submitted by the data subjects, while most of Facebook's is.
- Redoubts 8y ago
  That sounds worse for Equifax
  - drewmol 8y ago
    Although I don't see this having a huge immediate impact on Facebook, the distinction is that if Equifax neglagently releases your PII there is little fallout as you are not the one providing Equifax with that data and cannot simply stop feeding them data, when Facebook does it their data subjects can choose to stop providing the data by exiting the platform. Facebook needs both the user data, and those same users patronizing their service to maintain the existing revenue stream.
- tyfon 8y ago
  Equifax is also not under EU (GDPR) jurisdiction afaik.
- gavinsblog 8y ago
  Precisely.

734786710934 8y ago

This Twitter thread by Alex Stamos (former Facebook CSO) is a good rebut to this: https://twitter.com/alexstamos/status/1046783533220421632 https://twitter.com/alexstamos/status/1046783533220421632. Bottom line: you can do incident response quickly or correctly, but not both.

rachelbythebay 8y ago
Don't forget about "neither". That happens too.

intern4tional 8y ago

I've seen several similar threads to this one on Twitter. "Blah happened at Facebook and it is potentially a company ending event." This causes me to almost immediately discredit them, as while serious, this is no where near a company ending event for an organization that is headquartered in the US. Equifax lost the personal data of all Americans and is doing fine. Facebook might get fined a metric ton of money, people in some portions of the world might leave it, but the company will be just fine. You see, there is no where else for those people to go. Presumably they're on Facebook for some reason so they would want to find an alternative and there isn't an alternative that is as easy to use that their friends and family will migrate to. Like many other compromises, this one will be forgotten. There is no wordlist that will come out of it, no public artifact that will exist. People have already forgotten about Adobe, LinkedIn is fading, and this one will eventually join their ranks.

Iv 8y ago
I tend to react similarly but this event is the first one that triggered some of my non-tech FB contacts to leave for more geeky alternatives, namely diaspora. The groups of his friends is discussing moving as well. This is anecdotal but I hope several groups are considering the same now...
- skinnymuch 8y ago
  I’ll give back another anecdote. This did nothing for anyone I know.
  - diminoten 8y ago
    Not only did this not do anything for anyone I know as well, many people I know used complacency language when talking about it; large data breaches seem normalized now, they don't faze the tech-illiterate anymore. The HN bubble sort of gives us a false sense that this is a Big Fucking Deal, but I didn't get the sense that my friends and cared, or even really knew.
    - 8y ago

21 8y ago

The stock is down a measly 1.5%. Nobody gives a fuck. Compare with TSLA Musk SEC investigation which caused a 10% plunge. A misleading tweet is considered much more dangerous by the market than a 50 mil account breach. Investors know there are no real world consequences to a massive breach.

gavinsblog 8y ago
We don't know the full extent of the hack yet. As the thread says! It might be not so bad, or it might be awful.
joering2 8y ago
From $219 to $160 thats “measly 1.5%” ? Maybe by Sesame Street’s Yellow Bird math standards.
- dsp1234 8y ago
  The closing price on Thursday was $168.84. The close yesterday was $162.44. That's a 3.8% decline. I'm not sure where you got the $219 price from, but the stock price was nowhere near that before the breach.
  - jamie_ca 8y ago
    $219 is the stock's high price from this summer? The fall from there was totally unrelated.

Patrax 8y ago

Is this person trying to dump FB stock for his own benefit? It makes me very skeptic that he had to tweet 11 times in a very alarmist tone. If his opinion is firm on transitioning from FB to a more private and secure alternative why not just say that in 1 or 2 tweets in a tone endorsing other platforms perhaps in a more positive manner?

strictnein 8y ago

> "And is up there with the biggest (if not the biggest) hacks of all time." In what world is this even remotely the case? OPM, Equifax, etc are far more serious hacks than this. Yahoo's multiple breaches dwarf the Facebook hack. 3 billion vs 50 or 90 million: https://money.cnn.com/2017/10/03/technology/business/yahoo-breach-3-billion-accounts/index.html https://money.cnn.com/2017/10/03/technology/business/yahoo-b...

deleted 8y ago

[deleted]

KaiserPro 8y ago

Well, I assume he's out to sell something. 1) He says you should delete your facebook account. It's too late, the data is already there. Deleting does nothing. 2) "By company-ending I mean Facebook would never recover from the consequences of so much user data being dumped online for all to see" utter conjecture. there are petabytes of data, dumping that online is hard. Exfiltrating unnoticed is hard. 3) "This is potentially so bad that it could be called the Great Facebook Hack of 2018. But again, we don't know how much stuff was stolen. Yet." Again conjecture. This could be called the "great facebook spotted a hack on two account and stopped it before it got bad" This is pointless punditry from someone who literally is nothing to do with facebook, has no contact with people close to the matter, and is just guessing. yes, that much data in someone's hands is bad, but so is google, and the legion of databrokers and ad spinner.

akerro 8y ago
>1) He says you should delete your facebook account. It's too late, the data is already there. Deleting does nothing. Prevents being hacked again in the future?
diminoten 8y ago
Honestly I'd delete my Facebook if there were anything of value on there, or if I cared about being impersonated on that platform, but neither of those things are true.
- onemoresoop 8y ago
  Yes but your account can be used maliciously and still impersonate you. Your account can be used to sway elections and so on. I don't feel comfortable with that, but if you do then it's okay.
  - diminoten 8y ago
    My account can't be used to sway elections, Facebook can be used to sway elections. I have no Facebook clout upon which a hacker could build anything of value.

draw_down 8y ago

Counterpoint: almost no one will care and nothing of consequence to FB will result from this.

oliwarner 8y ago

"We don't know anything for certain but I'm double-dog sure you should sell all your shares and delete all your logins." There's even nonsense about GDPR in the comments. This all stinks of shorting... And even if it's not, it's too sensationalist to take seriously without more data.

kochb 8y ago

This is a great example of a link that should be off-topic for HN. There’s not one new material fact in the linked tweet, nor does it make an attempt at fair analysis. It instead consists of hyperbole (“company ending”) and unfounded speculation (“I imagine”). It’s just not a good starting point for serious discussion of the breach.

shujito 8y ago

The amount of attention on that Twitter thread makes me think how much people really care about the issue. Maybe I'm wrong, hoping it gets light later on.

sidcool 8y ago

This thread seems to have developed learned helplessness. This reflects very badly of our confidence in the legal system. Equifax and tobacco industry needs to be punished to feel the brunt of their crimes. But we seem to have accepted the fate.

stevew20 8y ago

Hey, let's boycott Gavin's Blog! His alarmism is so skewing that it is pretty much fake news. Let's make him pay a bit, teach the lesson that you shouldn't post such drivel on HN.

mindcrash 8y ago

Simple. I've done a shit ton of research on Corporate Surveillance in the past and there are a lot of signs of a big discrepancy of what people think what is stored about them in TAO and what is _really_ stored about them in TAO. (For those of you who are not that into Facebook, infrastructure and/or devops: TAO is Facebook's graph database) One of the keywords here is "shadow profiles" or the nodes and edges within the graph which are actually there but you can't directly influence as a user. A good example would be the former colleague of a close family member who never disclosed their place of work and without a current account whom Facebook decided to recommend as a "friend" to another family member who currently has a Facebook account but without an actual past or live connection between the two -- true story, I shit you not. So it's better to stay silent than proof yet again that there is a profound case for GDPR-like regulation - like Brandon Eich recently recommended - in the United States.

newscracker 8y ago

Why is the silence deafening? And what exactly is expected from Facebook? Today it'd say it was 50 million affected, and in a day change it to up to 90 million, and a week later it'll become 130 million, then it'll be 150 million, and then people will stop caring, as they have before, and move on. There are three kinds of people — those who stopped using Facebook a long, long time ago when the very first privacy issues came about; those who will never stop using Facebook unless they're moving to Instagram or another hotness of the day; those who may stop using Facebook after hearing about privacy or security issues. The last category is very, very small. So is the first. The only way to get out of this mess is to have a "new hotness" that's as good as (if not better than) Facebook and is privacy preserving, decentralized, easy to use, etc. We're still a long way away from that.