7 ms·

Say I am running a social network. I want to allow my users to give access to their own damn data to third parties. I want them to be able to use third party ch

Say I am running a social network. I want to allow my users to give access to their own damn data to third parties. I want them to be able to use third party chat UIs. Now, how do I do it in a non-evil way? I am presuming here that everyone agrees that should be possible to make that work. Apparently Facebook did it the wrong way. Why? If the argument is "Users who agreed to this integration did not know what they were doing because the permission dialog was not clear enough", then I have a couple questions: - What was the permission dialog like, really? Does anyone have a source for this? - Why does the New York Times not go into this? I mean, if that is the issue, it seems kind of important? - Reading the latest Times piece, does anyone feel comfortable arguing that the reader will understand what is apparently the issue - the permission dialog was not clear enough? Or is it more likely that the reader is left with the vague notion that Facebook just dumped all user's private messages over to a bunch of other companies?

mistermann 8y ago
To clear it up, we could just refer to the Facebook blog post where they tell the truth, the whole truth, and nothing but the truth on this matter. Is there such a thing?
- miracle2k 8y ago
  The Facebook newsroom posts on this matter go into much more detail than the Times reporting. That said, I don't expect Facebook to tell me the inconvenient truth. But I am paying the New York Times so that they improve my understanding of the situation, not make me feel like I can learn more from Facebook PR.
  - rock_hard 8y ago
    But being a subscription service doesn’t incentive the NYT to improve your understanding of the situation...the only thing it incentivizes them to do is to keep you from unsubscribing which is easier to do by creating outrage than by staying with the truth. See what I did there?
    - rrix2 8y ago
      Did the editor in chief and owners twirl their mustaches like villians after coming up with this plan, too?
    - cranky_coder 8y ago
      You created a straw man characterization of a news organization to further your own cynical world view? Nicely done?
    - ggggtez 8y ago
      >see what I did there? I see what you did: You used a 10 year old meme. Great insight dude. Next you're going to tell me that just because FB sells access to your data at $10 per account/yr, that this somehow doesn't mean that "you are the product".
      - rock_hard 8y ago
        You are a clever critter
deleted 8y ago
[deleted]
stanleydrew 8y ago
These are the right questions. It is disappointing that our top journalists sometimes prefer to fit a story into an existing narrative but narratives capture the public's attention so the incentives get a little weird. Anyway I do sometimes think that it might be good to have an actual screen recording of everything I do online, just so that I could look back and see what a permission dialog looked like for instance. Maybe I will build a Chrome extension for myself.
- ergothus 8y ago
  Perhaps not "recording",but I can see a real case for an extension that: 1) automatically grabbed a screen text (so it snags the text hidden inside a scrollable container, for example) capture (with notification) when you had a page with a button or link with the text "Agree" or "Understand" or "Accept" in it. Capture would be "tagged" with referrer url, current url, and timestamp. Possibly a screenshot of the rendered page as well. 2) Allowed you to manually trigger such a capture. I'd think that would involve reasonable space, and even if I wasn't trying to gather legal evidence, it'd be interesting to see the results after, say, only a month.
- stcredzero 8y ago
  It is disappointing that our top journalists sometimes prefer to fit a story into an existing narrative but narratives capture the public's attention so the incentives get a little weird. 1) It's not "sometimes." It happens many, many times a day. It's basically become the way they do things. 2) "narratives capture the public's attention so the incentives get a little weird" -- So the news is no longer about finding and transmitting the truth. It's about selling narratives? And the more the legacy news industry progresses on its inevitable collapse, the worse it's going to get? Nice.
  - stanleydrew 8y ago
    1) We can debate the frequency of this all we want (though I don't think it's useful). In my opinion the top (note this is an important qualifier) journalists are not lazy on purpose and in general are trying to deliver accurate information. You may disagree and that's fine. Also technology reporting is particularly difficult when you yourself are not a technologist, but that's a separate issue. 2) I'm not sure what point you are trying to make here. I didn't say that news isn't about finding the truth. But when describing complex systems and situations there is always going to be judgement applied in the distillation process. So for instance, you could say "Facebook provided private message data to some application partners" or you could say "Facebook's users inadvertently agreed to share private message data with application partners." Both are true.
ameister14 8y ago
The only permission dialogue I have seen was the spotify one from a few years back on Stack Overflow. I have also seen Facebook exec emails about obfuscating permission dialogues in order to get more permissions, though. It seems to have been pretty accepted practice.
AndyEth 8y ago
There are some useful screen shots for Spotify and Netflix here: https://newsroom.fb.com/news/2018/12/facebooks-messaging-partnerships/ https://newsroom.fb.com/news/2018/12/facebooks-messaging-par.... Not the permission dialog but the integration UIs from the user perspective.
ssivark 8y ago
> Now, how do I do it in a non-evil way? I am presuming here that everyone agrees that should be possible to make that work [...] Apparently Facebook did it the wrong way. Why? I really like Steve Jobs' comments on how to operate, with regards to questions of user privacy: https://www.youtube.com/watch?v=39iKLwlUqBo https://www.youtube.com/watch?v=39iKLwlUqBo (3 minutes) While I'm not convinced about the need for devices to be locked down, the rest of his response should be the gold standard in my opinion.
samstave 8y ago
>does anyone feel comfortable arguing that the reader will understand what is apparently the issue - the permission dialog was not clear enough? There were leaked emails in which FB was discussing how to ACTIVELY ensure the updates for their app specifically obfuscated the fact that they were preventing the users from understanding what they were agreeing to, as it was bad PR, and Zuck authorizing with "yup do it"
- logicallee 8y ago
  You know, I didn't read the memo but if it's by an expert at how to finagle consent from people without them realizing what you're doing, I'm having a real hard time holding zuck accountable for what "yup do it" authorizes (if this makes any sense.) -- I mean that the person could have finagled the "yup do it" without Zuck realizing the extent of what he just authorized. Note I'm just basing this on what you just wrote - if it was a really clear memo titled "How to trick users into 'consenting' to 'let' us sell their contact lists, messages, and all other data without actually making them realize they've done this" then I take it back.
- mpolichette 8y ago
  I'm not on Zuck's side, and I'm not explicitly saying you're wrong, but this feels like a mix up of the response from Zuckerberg to blocking the Twitter API. If you have a source for him saying "Yup do it" to an attempt at confusing their users on an agreement... that would be a big news story.
  - samstave 8y ago
    I'm looking for the actual emails - basically the discussion was about how to get a feature passively opted into by the user without letting the user know they were allowing that specific permission - and they discussed how to achieve this and then zuck approved the action. https://www.cjr.org/the_media_today/british-parliament-facebook-emails.php https://www.cjr.org/the_media_today/british-parliament-faceb... https://www.mercurynews.com/2018/12/06/facebook-knew-collection-of-android-call-data-was-high-risk-pr-wise-emails-show/ https://www.mercurynews.com/2018/12/06/facebook-knew-collect... https://twitter.com/EFF/status/1071446556946001925 https://twitter.com/EFF/status/1071446556946001925
ergothus 8y ago
> Apparently Facebook did it the wrong way. Why? Do you honestly think that Facebook was trying to allow users to make the decision in an informed way? I suspect most people instead think Facebook was trying to get some way of SAYING that the users agreed while maximizing the odds that the users would be surprised to discover the implications. That'd be my answer as to "why". I could be wrong, but I can't think of an occurrence where FB seemed to be acting in their (non-advertising, non-paying) users' interests. Yet FB will claim otherwise. And that disconnect is what people are finding "wrong".
- bilbo0s 8y ago
  Just Devil's Advocate here, but you're essentially saying that people affirmatively agreed to something that they didn't understand in a contract of adhesion. I mean, that's kind of a tough thing to hang our hats on if the idea is to take Facebook down. From congress the best you could hope for there is for companies to be required to use "more clear" language when writing up consumer agreements in the future. Which would be a nightmare requirement in and of itself, so it would likely never happen.
  - ergothus 8y ago
    > that's kind of a tough thing to hang our hats on if the idea is to take Facebook down I'm not taking a position on "taking Facebook down" - I'm arguing that legal isn't the same as moral/ethical, and it's entirely correct to label an activity as "wrong" and to be upset by it without that activity being illegal (In fact, I'd argue there's great value in having such legal-but-not-moral areas as long as they aren't too vast). I'm not well-versed enough in the legalities to SAY if the behavior is legal, but I feel well qualified to say when something feels deceptive and wrong. Outside of the general issue of legal vs moral: While I agree with you about the legal requirements of agreements, I'm also okay with saying there is such thing as bad faith in entering an agreement, and a reasonableness standard about what people are actually agreeing to seems legit - the alternative grants all the power to people who can afford the time and lawyers for every agreement. Whether such standards would have any impact on this situation is way beyond my knowledge level to be certain (i.e. I'm not saying that's the solution to this particular problem, it's just a related thought)
ALittleLight 8y ago
If someone is always late to everything, and then one day they really do have a flat tire and are late for good reason, and you doubt them when they say they have a flat, and that person asks "What am I supposed to do to make you believe me when I have a good reason?" The answer, though it may seem unfair in this particular instance, is to not always be late to everything else. If you have a pattern of abuse even legitimate behavior may appear as abuse. The solution is to not engage in a pattern of abuse.
- hnauz 8y ago
  It's good that you say that and that so many people are upvoting you. It means that any kind of debate around this is not possible because most people here are just out there to badmouth Facebook as much as they can. I like it when people are honest.
- skybrian 8y ago
  While this happens, is it a good thing? Or should try to avoid logical fallacies? If you want an accurate understanding of what's going on in the world, then you should probably believe that people who are habitually late do sometimes also get flat tires. If they say they had a flat, the logical conclusion isn't blind trust or being sure they're lying, but mild skepticism.
  - elefanten 8y ago
    GP's scenario poses that the late person asks in exasperation what they need to do to be believed -- there's no logical fallacy in telling them why perceptions are stacked against them. Or in your framing, why it's skepticism instead of presumptive trust. Yes, the goal should be for both parties to reach a correct understanding: not at fault this time, but often is. Facebook, to some, appears to be only loudly arguing about the specific injustices they feel, without giving up much ground on their habitual mistakes.
    - harlanji 8y ago
      I can empathize with FB leadership, not condone of course. 5 years in SF consumer ad tech turned me into a shell of a person who was coming to accept that reality is created by certain peoples’ wills, so the only lie was deviating from the company message. “Air tight” stories and containment seemed like the M.O. and with 5 figure severance packages and more, I have a hard time seeing many people being the first to be vocal. Everyone wants that money, and most will lie hard for it. Not saying I went full shill, but memories of that time are interesting to reflect on. Surreal, disidentified. I think my soul is growing back, thankfully.
jiveturkey 8y ago
your comment is 100% true, if somewhat pedantic. i think we can use a dose of common sense to understand that what FB did was ... let's say not in the interest of users. so really, the problem is not that fb is being unfairly taken to task. the problem here is the NYT reporting isn't a deep investigative enough piece for your taste. it's more of a drive-by "oh boy, what did FB do now" click attractor.
Quanttek 8y ago
From the politico article: > Facebook also regarded these partners as extensions of itself because they committed to abide by its privacy guidelines, according to the Times report, and therefore the company felt it did not need users' permission before sharing their data.
- miracle2k 8y ago
  So what is being claimed here, then? That user did not see a permission dialog? That the permission dialog did not mention the full details? Is it too much to ask from our journalists that they go into this level of detail?
stcredzero 8y ago
Say I am running a social network. I want to allow my users to give access to their own damn data to third parties. I want them to be able to use third party chat UIs. This is precisely why I keep pounding on the idea that "Trusted Execution" technologies need to be turned around 180 degrees. It's intimately tied tot he idea of privacy. It's horrible when governments and big companies have "privacy" but use their power to strip individuals of it. Likewise, it's a public good for individuals to have privacy, and for governments and big companies to be transparent. Likewise, it's horrible when big companies turn "Trusted Execution" against individuals -- this is DRM. However, it would be a tremendous good if the voting public got some laws passed requiring big companies to subject themselves to Trusted Execution technologies when handling customer data. Doing this would give individuals the keys to control their own personal information.
- jameslevy 8y ago
  This is also an area that is of great interest to me. I've been saying for the last couple years that the only way out of this mess is for "Can't be evil" to replace "Don't be evil".
JumpCrisscross 8y ago
> I am presuming here that everyone agrees that should be possible to make that work But not on precisely how. I think what we’ve identified, nationally, is a need to legislate standards around digital privacy and information monopolies. Your confusion is reasonable. We, as a nation, never had these conversations. Democracy is, at the end of the day, a reactive system.
birksherty 8y ago
By stating the result of data sharing directly. e.g. if they are sharing the data with a bank, then state clearly that the bank can deny you loan based on what you're doing on that social media. They know this, but will not say. Silicon valley tends to hide or obfuscate as much as possible without being illegal.
thomk 8y ago
An easy way to solve this is to have a permanent data explorer that shows you your own FB data, but through the lens of each entity you've shared it with, and a one click opt out. Maybe a list of entities, and when you click on one, you see what they would see. If you care, you opt out. If you don't, you do not opt out. Either way, it makes it hard to plead ignorance or vagueness of permission dialog text.
seanhunter 8y ago
> What was the permission dialog like, really? Does anyone have a source for this? There have been studies on Facebook's permission dialog and its lack of usability, and it's hard to escape the conclusion that it was deliberately designed to make it hard for users to understand. It has been improved several times over the years. For example http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.183.2159 http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.183.... (from 2010) which discusses how permissions dialogs are not designed in a way that allows users to easily understand permissions (using Facebook as one example) https://dl.acm.org/citation.cfm?id=2078843 https://dl.acm.org/citation.cfm?id=2078843 (from 2011) which found that Facebook users were unaware of the extent of 3rd party apps' data access even after viewing the permissions screen. https://www.ftc.gov/news-events/blogs/techftc/2015/05/usability-transparency-considerations-permission-based-access https://www.ftc.gov/news-events/blogs/techftc/2015/05/usabil... discusses usability concerns around permissions dialog boxes in general so it's been on peoples' radar for a while as an issue.
snowwrestler 8y ago
> Say I am running a social network. I want to allow my users to give access to their own damn data to third parties. You don't. There is no safe way to do this, but more to the point, this is not something that your users want to actually do. If people want to give their data to a "third party" they can just go directly to that party and give it their data. Your permission or participation is not required. If you'd like to try it, start a social network and then start serving big dialogue boxes that say "Would you like to give all your personal data to a third party? Click here to get started." Note that Facebook worked very hard to do the exact opposite of serving that kind of clear dialogue. > I want them to be able to use third party chat UIs. Why? If you are running a chat system, why not just build the UI you want your chat system to have? This doesn't even make sense to me. I think maybe what you mean is that you want your users to be able to interact with 3rd party services through your chat UI? In which case the answer is to build an API for that which properly handles data and privacy. "Let this 3rd party do everything with a user account that a user can do" is a shitty, lazy and/or deliberately permissive way to deliver that feature. Note that Apple and Whatsapp, among others, provide 3rd party chat integrations without letting the 3rd parties read every message in the user's archive.
- miracle2k 8y ago
  Sure there is. Of course people want to use third party email or chat clients. In fact, this is in many ways the bete noir of Hacker News whenever a related subject comes up, just today Slack blocking Iranian user. People point out that Slack, and Google Talk, used to have to speak Jabber. So I type my password into a Jabber WebClient, and I have just shared all the messages you sent me with a third party. It is literally this thing. People who used the Nylas N1 client, or now, any app that uses the Nylas APIs are sharing all their email messages, contacts and calendars with a third party - this includes your messages and your telephone number.

mistermann 8y ago

To clear it up, we could just refer to the Facebook blog post where they tell the truth, the whole truth, and nothing but the truth on this matter. Is there such a thing?

miracle2k 8y ago
The Facebook newsroom posts on this matter go into much more detail than the Times reporting. That said, I don't expect Facebook to tell me the inconvenient truth. But I am paying the New York Times so that they improve my understanding of the situation, not make me feel like I can learn more from Facebook PR.
- rock_hard 8y ago
  But being a subscription service doesn’t incentive the NYT to improve your understanding of the situation...the only thing it incentivizes them to do is to keep you from unsubscribing which is easier to do by creating outrage than by staying with the truth. See what I did there?
  - rrix2 8y ago
    Did the editor in chief and owners twirl their mustaches like villians after coming up with this plan, too?
  - cranky_coder 8y ago
    You created a straw man characterization of a news organization to further your own cynical world view? Nicely done?
  - ggggtez 8y ago
    >see what I did there? I see what you did: You used a 10 year old meme. Great insight dude. Next you're going to tell me that just because FB sells access to your data at $10 per account/yr, that this somehow doesn't mean that "you are the product".
    - rock_hard 8y ago
      You are a clever critter

deleted 8y ago

[deleted]

stanleydrew 8y ago

These are the right questions. It is disappointing that our top journalists sometimes prefer to fit a story into an existing narrative but narratives capture the public's attention so the incentives get a little weird. Anyway I do sometimes think that it might be good to have an actual screen recording of everything I do online, just so that I could look back and see what a permission dialog looked like for instance. Maybe I will build a Chrome extension for myself.

ergothus 8y ago
Perhaps not "recording",but I can see a real case for an extension that: 1) automatically grabbed a screen text (so it snags the text hidden inside a scrollable container, for example) capture (with notification) when you had a page with a button or link with the text "Agree" or "Understand" or "Accept" in it. Capture would be "tagged" with referrer url, current url, and timestamp. Possibly a screenshot of the rendered page as well. 2) Allowed you to manually trigger such a capture. I'd think that would involve reasonable space, and even if I wasn't trying to gather legal evidence, it'd be interesting to see the results after, say, only a month.
stcredzero 8y ago
It is disappointing that our top journalists sometimes prefer to fit a story into an existing narrative but narratives capture the public's attention so the incentives get a little weird. 1) It's not "sometimes." It happens many, many times a day. It's basically become the way they do things. 2) "narratives capture the public's attention so the incentives get a little weird" -- So the news is no longer about finding and transmitting the truth. It's about selling narratives? And the more the legacy news industry progresses on its inevitable collapse, the worse it's going to get? Nice.
- stanleydrew 8y ago
  1) We can debate the frequency of this all we want (though I don't think it's useful). In my opinion the top (note this is an important qualifier) journalists are not lazy on purpose and in general are trying to deliver accurate information. You may disagree and that's fine. Also technology reporting is particularly difficult when you yourself are not a technologist, but that's a separate issue. 2) I'm not sure what point you are trying to make here. I didn't say that news isn't about finding the truth. But when describing complex systems and situations there is always going to be judgement applied in the distillation process. So for instance, you could say "Facebook provided private message data to some application partners" or you could say "Facebook's users inadvertently agreed to share private message data with application partners." Both are true.

ameister14 8y ago

The only permission dialogue I have seen was the spotify one from a few years back on Stack Overflow. I have also seen Facebook exec emails about obfuscating permission dialogues in order to get more permissions, though. It seems to have been pretty accepted practice.

AndyEth 8y ago

There are some useful screen shots for Spotify and Netflix here: https://newsroom.fb.com/news/2018/12/facebooks-messaging-partnerships/ https://newsroom.fb.com/news/2018/12/facebooks-messaging-par.... Not the permission dialog but the integration UIs from the user perspective.

ssivark 8y ago

> Now, how do I do it in a non-evil way? I am presuming here that everyone agrees that should be possible to make that work [...] Apparently Facebook did it the wrong way. Why? I really like Steve Jobs' comments on how to operate, with regards to questions of user privacy: https://www.youtube.com/watch?v=39iKLwlUqBo https://www.youtube.com/watch?v=39iKLwlUqBo (3 minutes) While I'm not convinced about the need for devices to be locked down, the rest of his response should be the gold standard in my opinion.

samstave 8y ago

>does anyone feel comfortable arguing that the reader will understand what is apparently the issue - the permission dialog was not clear enough? There were leaked emails in which FB was discussing how to ACTIVELY ensure the updates for their app specifically obfuscated the fact that they were preventing the users from understanding what they were agreeing to, as it was bad PR, and Zuck authorizing with "yup do it"

logicallee 8y ago
You know, I didn't read the memo but if it's by an expert at how to finagle consent from people without them realizing what you're doing, I'm having a real hard time holding zuck accountable for what "yup do it" authorizes (if this makes any sense.) -- I mean that the person could have finagled the "yup do it" without Zuck realizing the extent of what he just authorized. Note I'm just basing this on what you just wrote - if it was a really clear memo titled "How to trick users into 'consenting' to 'let' us sell their contact lists, messages, and all other data without actually making them realize they've done this" then I take it back.
mpolichette 8y ago
I'm not on Zuck's side, and I'm not explicitly saying you're wrong, but this feels like a mix up of the response from Zuckerberg to blocking the Twitter API. If you have a source for him saying "Yup do it" to an attempt at confusing their users on an agreement... that would be a big news story.
- samstave 8y ago
  I'm looking for the actual emails - basically the discussion was about how to get a feature passively opted into by the user without letting the user know they were allowing that specific permission - and they discussed how to achieve this and then zuck approved the action. https://www.cjr.org/the_media_today/british-parliament-facebook-emails.php https://www.cjr.org/the_media_today/british-parliament-faceb... https://www.mercurynews.com/2018/12/06/facebook-knew-collection-of-android-call-data-was-high-risk-pr-wise-emails-show/ https://www.mercurynews.com/2018/12/06/facebook-knew-collect... https://twitter.com/EFF/status/1071446556946001925 https://twitter.com/EFF/status/1071446556946001925

ergothus 8y ago

> Apparently Facebook did it the wrong way. Why? Do you honestly think that Facebook was trying to allow users to make the decision in an informed way? I suspect most people instead think Facebook was trying to get some way of SAYING that the users agreed while maximizing the odds that the users would be surprised to discover the implications. That'd be my answer as to "why". I could be wrong, but I can't think of an occurrence where FB seemed to be acting in their (non-advertising, non-paying) users' interests. Yet FB will claim otherwise. And that disconnect is what people are finding "wrong".

bilbo0s 8y ago
Just Devil's Advocate here, but you're essentially saying that people affirmatively agreed to something that they didn't understand in a contract of adhesion. I mean, that's kind of a tough thing to hang our hats on if the idea is to take Facebook down. From congress the best you could hope for there is for companies to be required to use "more clear" language when writing up consumer agreements in the future. Which would be a nightmare requirement in and of itself, so it would likely never happen.
- ergothus 8y ago
  > that's kind of a tough thing to hang our hats on if the idea is to take Facebook down I'm not taking a position on "taking Facebook down" - I'm arguing that legal isn't the same as moral/ethical, and it's entirely correct to label an activity as "wrong" and to be upset by it without that activity being illegal (In fact, I'd argue there's great value in having such legal-but-not-moral areas as long as they aren't too vast). I'm not well-versed enough in the legalities to SAY if the behavior is legal, but I feel well qualified to say when something feels deceptive and wrong. Outside of the general issue of legal vs moral: While I agree with you about the legal requirements of agreements, I'm also okay with saying there is such thing as bad faith in entering an agreement, and a reasonableness standard about what people are actually agreeing to seems legit - the alternative grants all the power to people who can afford the time and lawyers for every agreement. Whether such standards would have any impact on this situation is way beyond my knowledge level to be certain (i.e. I'm not saying that's the solution to this particular problem, it's just a related thought)

ALittleLight 8y ago

If someone is always late to everything, and then one day they really do have a flat tire and are late for good reason, and you doubt them when they say they have a flat, and that person asks "What am I supposed to do to make you believe me when I have a good reason?" The answer, though it may seem unfair in this particular instance, is to not always be late to everything else. If you have a pattern of abuse even legitimate behavior may appear as abuse. The solution is to not engage in a pattern of abuse.

hnauz 8y ago
It's good that you say that and that so many people are upvoting you. It means that any kind of debate around this is not possible because most people here are just out there to badmouth Facebook as much as they can. I like it when people are honest.
skybrian 8y ago
While this happens, is it a good thing? Or should try to avoid logical fallacies? If you want an accurate understanding of what's going on in the world, then you should probably believe that people who are habitually late do sometimes also get flat tires. If they say they had a flat, the logical conclusion isn't blind trust or being sure they're lying, but mild skepticism.
- elefanten 8y ago
  GP's scenario poses that the late person asks in exasperation what they need to do to be believed -- there's no logical fallacy in telling them why perceptions are stacked against them. Or in your framing, why it's skepticism instead of presumptive trust. Yes, the goal should be for both parties to reach a correct understanding: not at fault this time, but often is. Facebook, to some, appears to be only loudly arguing about the specific injustices they feel, without giving up much ground on their habitual mistakes.
  - harlanji 8y ago
    I can empathize with FB leadership, not condone of course. 5 years in SF consumer ad tech turned me into a shell of a person who was coming to accept that reality is created by certain peoples’ wills, so the only lie was deviating from the company message. “Air tight” stories and containment seemed like the M.O. and with 5 figure severance packages and more, I have a hard time seeing many people being the first to be vocal. Everyone wants that money, and most will lie hard for it. Not saying I went full shill, but memories of that time are interesting to reflect on. Surreal, disidentified. I think my soul is growing back, thankfully.

jiveturkey 8y ago

your comment is 100% true, if somewhat pedantic. i think we can use a dose of common sense to understand that what FB did was ... let's say not in the interest of users. so really, the problem is not that fb is being unfairly taken to task. the problem here is the NYT reporting isn't a deep investigative enough piece for your taste. it's more of a drive-by "oh boy, what did FB do now" click attractor.

Quanttek 8y ago

From the politico article: > Facebook also regarded these partners as extensions of itself because they committed to abide by its privacy guidelines, according to the Times report, and therefore the company felt it did not need users' permission before sharing their data.

miracle2k 8y ago
So what is being claimed here, then? That user did not see a permission dialog? That the permission dialog did not mention the full details? Is it too much to ask from our journalists that they go into this level of detail?

stcredzero 8y ago

Say I am running a social network. I want to allow my users to give access to their own damn data to third parties. I want them to be able to use third party chat UIs. This is precisely why I keep pounding on the idea that "Trusted Execution" technologies need to be turned around 180 degrees. It's intimately tied tot he idea of privacy. It's horrible when governments and big companies have "privacy" but use their power to strip individuals of it. Likewise, it's a public good for individuals to have privacy, and for governments and big companies to be transparent. Likewise, it's horrible when big companies turn "Trusted Execution" against individuals -- this is DRM. However, it would be a tremendous good if the voting public got some laws passed requiring big companies to subject themselves to Trusted Execution technologies when handling customer data. Doing this would give individuals the keys to control their own personal information.

jameslevy 8y ago
This is also an area that is of great interest to me. I've been saying for the last couple years that the only way out of this mess is for "Can't be evil" to replace "Don't be evil".

JumpCrisscross 8y ago

> I am presuming here that everyone agrees that should be possible to make that work But not on precisely how. I think what we’ve identified, nationally, is a need to legislate standards around digital privacy and information monopolies. Your confusion is reasonable. We, as a nation, never had these conversations. Democracy is, at the end of the day, a reactive system.

birksherty 8y ago

By stating the result of data sharing directly. e.g. if they are sharing the data with a bank, then state clearly that the bank can deny you loan based on what you're doing on that social media. They know this, but will not say. Silicon valley tends to hide or obfuscate as much as possible without being illegal.

thomk 8y ago

An easy way to solve this is to have a permanent data explorer that shows you your own FB data, but through the lens of each entity you've shared it with, and a one click opt out. Maybe a list of entities, and when you click on one, you see what they would see. If you care, you opt out. If you don't, you do not opt out. Either way, it makes it hard to plead ignorance or vagueness of permission dialog text.

seanhunter 8y ago

> What was the permission dialog like, really? Does anyone have a source for this? There have been studies on Facebook's permission dialog and its lack of usability, and it's hard to escape the conclusion that it was deliberately designed to make it hard for users to understand. It has been improved several times over the years. For example http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.183.2159 http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.183.... (from 2010) which discusses how permissions dialogs are not designed in a way that allows users to easily understand permissions (using Facebook as one example) https://dl.acm.org/citation.cfm?id=2078843 https://dl.acm.org/citation.cfm?id=2078843 (from 2011) which found that Facebook users were unaware of the extent of 3rd party apps' data access even after viewing the permissions screen. https://www.ftc.gov/news-events/blogs/techftc/2015/05/usability-transparency-considerations-permission-based-access https://www.ftc.gov/news-events/blogs/techftc/2015/05/usabil... discusses usability concerns around permissions dialog boxes in general so it's been on peoples' radar for a while as an issue.

snowwrestler 8y ago

> Say I am running a social network. I want to allow my users to give access to their own damn data to third parties. You don't. There is no safe way to do this, but more to the point, this is not something that your users want to actually do. If people want to give their data to a "third party" they can just go directly to that party and give it their data. Your permission or participation is not required. If you'd like to try it, start a social network and then start serving big dialogue boxes that say "Would you like to give all your personal data to a third party? Click here to get started." Note that Facebook worked very hard to do the exact opposite of serving that kind of clear dialogue. > I want them to be able to use third party chat UIs. Why? If you are running a chat system, why not just build the UI you want your chat system to have? This doesn't even make sense to me. I think maybe what you mean is that you want your users to be able to interact with 3rd party services through your chat UI? In which case the answer is to build an API for that which properly handles data and privacy. "Let this 3rd party do everything with a user account that a user can do" is a shitty, lazy and/or deliberately permissive way to deliver that feature. Note that Apple and Whatsapp, among others, provide 3rd party chat integrations without letting the 3rd parties read every message in the user's archive.

miracle2k 8y ago
Sure there is. Of course people want to use third party email or chat clients. In fact, this is in many ways the bete noir of Hacker News whenever a related subject comes up, just today Slack blocking Iranian user. People point out that Slack, and Google Talk, used to have to speak Jabber. So I type my password into a Jabber WebClient, and I have just shared all the messages you sent me with a third party. It is literally this thing. People who used the Nylas N1 client, or now, any app that uses the Nylas APIs are sharing all their email messages, contacts and calendars with a third party - this includes your messages and your telephone number.