4 ms·

Here's where the critique of Facebook gets interesting: we criticize it for creating a "closed silo of content" in which information is not represented in open

Here's where the critique of Facebook gets interesting: we criticize it for creating a "closed silo of content" in which information is not represented in open URLs, while simultaneously criticizing it for not providing and enforcing strong, simple privacy controls. I'm not being a smartass here: both of these issues concern me - to the point that I don't have a facebook account - but I'm not sure how to reconcile them in an internally consistent overarching critique.

user24 16y ago
Would not supporting open URLs for those things which users have chosen to share reconcile these seemingly opposed desiderata?
benwerd 16y ago
I think they can be reconciled - but only with an open standard (or set of open standards) for access control on the web. We've moved far beyond the web as a publishing medium; it's an application and data platform. In those contexts, some kind of universal access control - and open identity to go along with it - is critical. For what it's worth, my vote would be a simple system, like oAuth, that would send access and identity data in the HTTP header along with a request. This wouldn't break existing web patterns, or require vast amounts of new development, but would add a little extra identity-centric context. It could be sent from the browser itself, I suppose, but I see it being added as a layer from feed reader style apps. I wrote a summary of the idea down a while back: http://benwerd.com/2010/03/activity-streams-and-oauth-a-social-web-architecture/ http://benwerd.com/2010/03/activity-streams-and-oauth-a-soci... There are lots of possible solutions, but this is one.
- buro9 16y ago
  FOAF+SSL is what you want. People controlling their own profile and how it's used, but keeping it openly and universally accessible. It already works in all browsers too... though it's a little ugly and the user experience should be improved a hell of a lot.
  - benwerd 16y ago
    I'm not sure how FOAF and SSL could be used in themselves? FOAF is fine for storing social contact information, for sure, and SSL is a handy security layer. But while they could be used in an access control mechanism, they don't constitute one. (Is FOAF actually still used anywhere?)
    - buro9 16y ago
      http://esw.w3.org/Foaf%2Bssl http://esw.w3.org/Foaf%2Bssl "FOAF+SSL is a secure authentication protocol that enables the building of distributed, open and secure social networks: the Social Web. We are just in the process of starting the formal standardisation process."
      - ujal 16y ago
        Thank you. Did not know about it before. Finally something open is going to replace Facebook & Co. Good ui/ux is also guaranteed as this will be the new space for browsers to compete on.
        buro9 16y ago
        It needs people to implement it though... one of the guys involved is willing to help people do this. Just contact Henry Story if you're interested in learning more: http://bblfish.net/ http://bblfish.net/
        benwerd 16y ago
        I've actually spoken to Henry about it, and seen him demonstrate it together with WebID. The problem is, it's really technical right now; without input and UI support from the browser vendors, it's going to be out of reach for most casual web users.
        ujal 16y ago
        Why not contacting someone directly from Mozilla or Google? They should both 'adopt' it in no time. Also I have seen zero coverage of it until now.
hxa7241 16y ago
They are both about control of data, yes, but privacy is about you controlling it, and centralisation is about someone else controlling it. Technically they have some resemblance, but in human usage they are practically opposites.
aristus 16y ago
I don't get the criticism "each piece of information does not have a URI". Has TBL not seen http://graph.facebook.com http://graph.facebook.com ?
- scrrr 16y ago
  I can't view that link because I'm not logged in to Facebook.
  - aristus 16y ago
    Well, sure. It's your private data so it's behind a login. You can get a free application key which you allow you to programmatically download your information, eg graph.facebook.com/me/events /photos, etc. Every bit of data has its own URL, contrary to TBL's claims in the article. Authentication and authorization are orthogonal to the URI scheme.
  - pyre 16y ago
    Is Apache hurting the way because you can password-protect URIs? Is "403: Forbidden" the 'evil' part of the HTTP spec? I somehow don't think that, "this information requires a login," is the death of the web.
pyre 16y ago
Huh? It's pretty easy. Give users the proper ability to control what of their information is and isn't private. That's it. The situation as it stands now: * Facebook tries as hard as it can to make it impossible for a user to liberate their information from the system (either to ditch Facebook for a new system, or to run both in parallel). * Facebook constantly has bugs/oversights/intentional misrepresentations that allow 3rd parties to get access to user information that the user though they had ultimate control over. This information obvious isn't a click-button interface to access, but the people trying to harvest that type of information are more technical (or will just hire more technical people) than the majority Facebook's user-base. The ultimate goal is give the user control and meet user expectations: * When a user says, "Hide my email from everyone but my friends," they don't want there to be some way for a 3rd party or a friend of a friend to url-hack their way to that information (even if they don't know what url-hacking even means; don't prey on user ignorance, and claim that you're ethical). * The user does want the ability to export the information that they have in the system. Don't hide behind some excuse like, "You can't export all of your friends' contact information because that information belongs to your friends." As long as your friends have given you access to see it, then you have access to that information. It's not a privacy violation if you allow a user to export data that they have read-access to. If your friend revokes access to their (e.g.) email address down the road, that doesn't mean that you still don't know what it is. You could have manually entered it into Gmail, or your physical address book. An export feature is just an automation of this process, not a privacy violation.
- joe_the_user 16y ago
  It's not a privacy violation if you allow a user to export data that they have read-access to. That applies more to email addresses than photos. Of course, you can persuasively argue that users want their friends to have the right to save their contact information but not necessarily their photos (after all, contact information is worthless if you can't save it).
joe_the_user 16y ago
we criticize it for creating a "closed silo of content" in which information is not represented in open URLs, while simultaneously criticizing it for not providing and enforcing strong, simple privacy controls. Good point - criticism of Facebook is confused and needs to become more focused. The "closed silo of content" point is key and the "lack of privacy" point is ultimately a canard. It's not one shouldn't have privacy but that Facebook promises an impossible kind of "privacy" akin to personal DRM, impossible like personal DRM, and serving merely as a excuse for Facebook's enhanced control and increasing it's "silo". See Facebook's ridiculous reply to Google on email addresses - as if someone giving you their email address via Facebook could reasonably expect to revoke that gift at a later point("DRM-like"/impossible). The short story of Facebook privacy is that you shouldn't post anything that could get fired etc, using your real name, whether it's on your Facebook page or elsewhere.

user24 16y ago

Would not supporting open URLs for those things which users have chosen to share reconcile these seemingly opposed desiderata?

benwerd 16y ago

I think they can be reconciled - but only with an open standard (or set of open standards) for access control on the web. We've moved far beyond the web as a publishing medium; it's an application and data platform. In those contexts, some kind of universal access control - and open identity to go along with it - is critical. For what it's worth, my vote would be a simple system, like oAuth, that would send access and identity data in the HTTP header along with a request. This wouldn't break existing web patterns, or require vast amounts of new development, but would add a little extra identity-centric context. It could be sent from the browser itself, I suppose, but I see it being added as a layer from feed reader style apps. I wrote a summary of the idea down a while back: http://benwerd.com/2010/03/activity-streams-and-oauth-a-social-web-architecture/ http://benwerd.com/2010/03/activity-streams-and-oauth-a-soci... There are lots of possible solutions, but this is one.

buro9 16y ago
FOAF+SSL is what you want. People controlling their own profile and how it's used, but keeping it openly and universally accessible. It already works in all browsers too... though it's a little ugly and the user experience should be improved a hell of a lot.
- benwerd 16y ago
  I'm not sure how FOAF and SSL could be used in themselves? FOAF is fine for storing social contact information, for sure, and SSL is a handy security layer. But while they could be used in an access control mechanism, they don't constitute one. (Is FOAF actually still used anywhere?)
  - buro9 16y ago
    http://esw.w3.org/Foaf%2Bssl http://esw.w3.org/Foaf%2Bssl "FOAF+SSL is a secure authentication protocol that enables the building of distributed, open and secure social networks: the Social Web. We are just in the process of starting the formal standardisation process."
    - ujal 16y ago
      Thank you. Did not know about it before. Finally something open is going to replace Facebook & Co. Good ui/ux is also guaranteed as this will be the new space for browsers to compete on.
      - buro9 16y ago
        It needs people to implement it though... one of the guys involved is willing to help people do this. Just contact Henry Story if you're interested in learning more: http://bblfish.net/ http://bblfish.net/
        benwerd 16y ago
        I've actually spoken to Henry about it, and seen him demonstrate it together with WebID. The problem is, it's really technical right now; without input and UI support from the browser vendors, it's going to be out of reach for most casual web users.
        ujal 16y ago
        Why not contacting someone directly from Mozilla or Google? They should both 'adopt' it in no time. Also I have seen zero coverage of it until now.

hxa7241 16y ago

They are both about control of data, yes, but privacy is about you controlling it, and centralisation is about someone else controlling it. Technically they have some resemblance, but in human usage they are practically opposites.

aristus 16y ago

I don't get the criticism "each piece of information does not have a URI". Has TBL not seen http://graph.facebook.com http://graph.facebook.com ?

scrrr 16y ago
I can't view that link because I'm not logged in to Facebook.
- aristus 16y ago
  Well, sure. It's your private data so it's behind a login. You can get a free application key which you allow you to programmatically download your information, eg graph.facebook.com/me/events /photos, etc. Every bit of data has its own URL, contrary to TBL's claims in the article. Authentication and authorization are orthogonal to the URI scheme.
- pyre 16y ago
  Is Apache hurting the way because you can password-protect URIs? Is "403: Forbidden" the 'evil' part of the HTTP spec? I somehow don't think that, "this information requires a login," is the death of the web.

pyre 16y ago

Huh? It's pretty easy. Give users the proper ability to control what of their information is and isn't private. That's it. The situation as it stands now: * Facebook tries as hard as it can to make it impossible for a user to liberate their information from the system (either to ditch Facebook for a new system, or to run both in parallel). * Facebook constantly has bugs/oversights/intentional misrepresentations that allow 3rd parties to get access to user information that the user though they had ultimate control over. This information obvious isn't a click-button interface to access, but the people trying to harvest that type of information are more technical (or will just hire more technical people) than the majority Facebook's user-base. The ultimate goal is give the user control and meet user expectations: * When a user says, "Hide my email from everyone but my friends," they don't want there to be some way for a 3rd party or a friend of a friend to url-hack their way to that information (even if they don't know what url-hacking even means; don't prey on user ignorance, and claim that you're ethical). * The user does want the ability to export the information that they have in the system. Don't hide behind some excuse like, "You can't export all of your friends' contact information because that information belongs to your friends." As long as your friends have given you access to see it, then you have access to that information. It's not a privacy violation if you allow a user to export data that they have read-access to. If your friend revokes access to their (e.g.) email address down the road, that doesn't mean that you still don't know what it is. You could have manually entered it into Gmail, or your physical address book. An export feature is just an automation of this process, not a privacy violation.

joe_the_user 16y ago
It's not a privacy violation if you allow a user to export data that they have read-access to. That applies more to email addresses than photos. Of course, you can persuasively argue that users want their friends to have the right to save their contact information but not necessarily their photos (after all, contact information is worthless if you can't save it).

joe_the_user 16y ago

we criticize it for creating a "closed silo of content" in which information is not represented in open URLs, while simultaneously criticizing it for not providing and enforcing strong, simple privacy controls. Good point - criticism of Facebook is confused and needs to become more focused. The "closed silo of content" point is key and the "lack of privacy" point is ultimately a canard. It's not one shouldn't have privacy but that Facebook promises an impossible kind of "privacy" akin to personal DRM, impossible like personal DRM, and serving merely as a excuse for Facebook's enhanced control and increasing it's "silo". See Facebook's ridiculous reply to Google on email addresses - as if someone giving you their email address via Facebook could reasonably expect to revoke that gift at a later point("DRM-like"/impossible). The short story of Facebook privacy is that you shouldn't post anything that could get fired etc, using your real name, whether it's on your Facebook page or elsewhere.