6 ms·

Forcing Facebook and Twitter to have truly open APIs would be amazing. We'd have everything from custom clients, custom News Feed algorithms and much more.. Hec

Forcing Facebook and Twitter to have truly open APIs would be amazing. We'd have everything from custom clients, custom News Feed algorithms and much more.. Heck, they can even require ads to be served, the point is we'd be in a far better situation than we are now.

deleted 7y ago
[deleted]
brenden2 7y ago
We're more likely to see new networks with open APIs than trying to convince a leopard to change its spots.
SpicyLemonZest 7y ago
Forcing Facebook to have truly open API means forcing them to allow Cambridge Analytica to vacuum up everyone's data.
- malvosenior 7y ago
  Open API doesn't mean all data available to everyone all the time. You'd still have ACLs and privacy options. It would just mean that the data and interactions you as a user already have in Facebook's proprietary walled garden, would be API callable from 3rd parties. Today you cannot see my FB page if we're not friends, an open API wouldn't allow you to access my data either. If we were friends, you could use your custom FB client to look at my page though, which would be very user friendly.
  - traek 7y ago
    > It would just mean that the data and interactions you as a user already have in Facebook's proprietary walled garden, would be API callable from 3rd parties. This was precisely the level of access which caused the Cambridge Analytica scandal.
    - shkkmo 7y ago
      In what way? They were not using user level permissions.
      - traek 7y ago
        Yes, they were. https://www.vox.com/2018/3/17/17134072/facebook-cambridge-analytica-trump-explained-user-data https://www.vox.com/2018/3/17/17134072/facebook-cambridge-an...
        shkkmo 7y ago
        > Facebook also allowed developers to collect some information on the friend networks of people who used Facebook Login. So no, Cambridge Analytics did not have API access to everything that that that the users who used Facebook login had access to. This was a specific set of permissions granted to apps with which users used their Facebook identities as login identities.
        SpicyLemonZest 7y ago
        That's right, so I'm not sure how we're drawing different conclusions from it. Cambridge Analytica got an API that was only moderately open, with much less than the full access you'd need to implement something like a Facebook client, and that amount of access still wasn't okay.
        shkkmo 7y ago
        Again, this access was granted when you used your facebook identity to log into a 3rd party site, not using an API to provide an alternative client to the user. Those are very different use cases and have very different expectations of privacy and levels of concern. Your browser has direct access to TONS of private data, if you install certain browser extensions they have access to all that data as well. A custom facebook client would be fundamentally similar and would clearly be considered a piece of software that requires trust to use. The level of trust you should have in the software provider who provides such clients is MUCH higher than a 3rd party site where you simply used facebook as a login provider.
  - Nasrudith 7y ago
    In practice it would for anything which the API can touch given "dancing monkey > security" levels of security awareness in practice.
  - dehrmann 7y ago
    > You'd still have ACLs and privacy options. People saw an ACL grant screen before Cambridge Analytica took their data. Too many of these screens and people just click "OK."
    - malvosenior 7y ago
      Maybe they actually are OK with it? I know I am. On most services your friend list is public, I don't see that as sensitive information and if I did, I wouldn't use social networks since info I share with people is already available to anyone they chose to share it with.
  - SpicyLemonZest 7y ago
    Right, and that's all you need for Cambridge Analytica to happen. They didn't have a backdoor to see everyone's data all the time; they just used the open-ish APIs that existed back before 2015, allowing them to grab all the data all your friends shared with you if you gave their custom app permission.
    - gfodor 7y ago
      Presumably such an API would be restricted to only accessing data generated by the person who approved the API. For example, it would prevent any kind of "news feed" functionality until your connected network also granted access. (This is distinct from what happened with CA)
      - deleted 7y ago
        [deleted]
  - shuw 7y ago
    Cambridge Analytica didn't need all data available to everyone. They had access to an API exactly as you'd describe: with ACLs and privacy options.
    - malvosenior 7y ago
      They didn't have all the data Facebook has though, just the data people explicitly granted them via the ACLs. That includes data they had access to view, but that's ok as it's the nature of social networking and communication. Once you send someone information, they can do with it as they please including share it with 3rd parties (unless you have some sort of contract saying that's forbidden).
  - chongli 7y ago
    The problem is that Facebook defaults to everything being open. So even though we may not be able to see your page to get your friends list, unless all of your friends toggle on the same privacy settings anyone could reconstruct your friends list by finding all people that have you as a friend. Defaults matter.
    - zentiggr 7y ago
      I truly wonder what would happen if FB were forced to make all security and privacy settings default to tightest possible, and therefore users would have to see the settings and decide just how exposed they wanted to be... Of course, FB would have to be forced into it by law, and they'd lobby hard against being the only company so burdened, so they law would only pass if it applied to every option in every software... and every company in the world would scream "But users will hate us! Our profits! oh my!" No doubt a huge number of people would be outraged by that much workload forced on them, but I like that world. Yeah, I use uMatrix on maximum blacklisting on every site all the time, and Blockada on my phone, ...
    - malvosenior 7y ago
      Is that a problem though? It's the nature of the service. Facebook was basically built to show off who you are connected to.
  - bilbo0s 7y ago
    >It would just mean that the data and interactions you as a user already have in Facebook's proprietary walled garden, would be API callable from 3rd parties. I'm not sure you're entirely clear on how the Cambridge Analytica hack worked?
  - spunker540 7y ago
    Thus you end up with 3rd party clients gaining access to data of others who never granted them explicit access (aka Cambridge Analytica) through friend connections.
    - malvosenior 7y ago
      Right but that's not "everyone's data", it's just data available to people who granted that app permission. You can't for instance get a FB firehose of everyone's posts. That's the nature of social data (and it's already this way for email -- Google knows what you email @gmail.com addresses even if you don't have one). I personally see nothing wrong with this. I didn't think Cambridge Analytica was a big deal either, just something the media blew out of proportion. If you communicate with people, what you send them will be available to whoever they share it with.
      - NeedMoreTea 7y ago
        There is something qualitatively different about showing a private email to a friend or partner, and it being available to an unknown third party business because someone got dark-patterned into agreeing.
        malvosenior 7y ago
        There's no way to prevent this though. You already don't know what your connection's email clients are doing with the emails you send them. That's a much bigger info leak than anything that's going to happen on FB but no one seems concerned about it.
  - scarface74 7y ago
    what’s stopping those third parties from using the access that you gave it to gather data of your friends? Can I block access from your third party client?
    - malvosenior 7y ago
      Nothing, but that's how it works today. I could show anyone my feed and they could see my friends activity. Same with my web browser, plugins, anything happening to be running in my OS that can capture screenshots, people looking over my shoulder... I'd argue that those are even greater risks as people I know are most likely more sensitive to the information I publish than 3rd party businesses that are scraping data in aggregate for ad targeting purposes. There will always be the analog hole and many a user experience have been degraded in the quixotic attempt to close it.
      - scarface74 7y ago
        Unless your friends looking at your computer are going to write down your whole social graph manually, I doubt that’s the the same threat. Also, most people use one of three browsers. I don’t trust Google but I doubt they are surreptitiously using everyone’s FB login to crawl their social graph.
- deleted 7y ago
  [deleted]
- scarecrowbob 7y ago
  I don't see how this is true any more than it is for a bank API. I just want API access to the content --I wrote-- that they are monetizing (even if it's just a lure to get my friends on their platform), and if my friends grant me access to something they have written or shared, the API should allow that. I agree that there are likely ways this can be used to do all kinds of terrible thing. But so could bank APIs.
  - SpicyLemonZest 7y ago
    And that was the full set of things that Cambridge Analytica got API access to; the data of people who authorized the app, and any data their friends shared with them. (In fact, they actually got a bit less than that; for instance, Facebook had already locked down the API to prevent apps from seeing email addresses.) If you’re taking the position that Cambridge Analytica wasn’t actually that bad, and it’s worth the trade for a better developer experience, I think that’s an intensely unpopular but defensible claim.
    - malvosenior 7y ago
      > If you’re taking the position that Cambridge Analytica wasn’t actually that bad, and it’s worth the trade for a better developer experience, I think that’s an intensely unpopular but defensible claim. I'll take that position. The media made a huge deal out of Cambridge Analytica but it didn't impact FB usage at all, so I don't think it's as intensely unpopular as you suggest. On most social media services, your friend list is public. I think people who feel that's somehow sensitive information shouldn't be on social media in the first place because there's nothing stopping any one of their friends from sharing all of your info with whoever they want.
- 6gvONxR4sf7o 7y ago
  No, in the same way that an open bank API doesn't mean allowing thieves to vacuum up everyone's money. Open API != open data.
  - SpicyLemonZest 7y ago
    In this context it does mean open data. Facebook already provides APIs for looking at your own stuff; to develop a custom client or such, it’s other people’s data that you’d need an API for.
bilbo0s 7y ago
Just to be clear, you don't really mean forcing FB to have an API that would let anyone access any piece of data on FB do you? I mean, you're advocating for an open API to let people access maybe some public photos and such, but nothing private and no personally identifiable connection information right? Just as a matter of full disclosure, I believe anything sensitive should require explicit consent of the user for each bit of data you download from their profile. I don't believe in radically open data APIs on FB because there is a bit of an argument to be made that it's not FBs data, it's that user's data. If she doesn't want to give the world access to her messages to her lover there should certainly be no API level method that overrides her intentions there.
holler 7y ago
I don't see how this would encourage competition?
- Finnucane 7y ago
  It doesn't. He's glossing over the problem of antitrust needs. An open API would still leave FB in a near-monopolistic control of social data. The FAANG companies can easily buy up and squash potential competitors because for the last few decades government has taken a very narrow view of antitrust with little enforcement effort.

deleted 7y ago

[deleted]

brenden2 7y ago

We're more likely to see new networks with open APIs than trying to convince a leopard to change its spots.

SpicyLemonZest 7y ago

Forcing Facebook to have truly open API means forcing them to allow Cambridge Analytica to vacuum up everyone's data.

malvosenior 7y ago
Open API doesn't mean all data available to everyone all the time. You'd still have ACLs and privacy options. It would just mean that the data and interactions you as a user already have in Facebook's proprietary walled garden, would be API callable from 3rd parties. Today you cannot see my FB page if we're not friends, an open API wouldn't allow you to access my data either. If we were friends, you could use your custom FB client to look at my page though, which would be very user friendly.
- traek 7y ago
  > It would just mean that the data and interactions you as a user already have in Facebook's proprietary walled garden, would be API callable from 3rd parties. This was precisely the level of access which caused the Cambridge Analytica scandal.
  - shkkmo 7y ago
    In what way? They were not using user level permissions.
    - traek 7y ago
      Yes, they were. https://www.vox.com/2018/3/17/17134072/facebook-cambridge-analytica-trump-explained-user-data https://www.vox.com/2018/3/17/17134072/facebook-cambridge-an...
      - shkkmo 7y ago
        > Facebook also allowed developers to collect some information on the friend networks of people who used Facebook Login. So no, Cambridge Analytics did not have API access to everything that that that the users who used Facebook login had access to. This was a specific set of permissions granted to apps with which users used their Facebook identities as login identities.
        SpicyLemonZest 7y ago
        That's right, so I'm not sure how we're drawing different conclusions from it. Cambridge Analytica got an API that was only moderately open, with much less than the full access you'd need to implement something like a Facebook client, and that amount of access still wasn't okay.
        shkkmo 7y ago
        Again, this access was granted when you used your facebook identity to log into a 3rd party site, not using an API to provide an alternative client to the user. Those are very different use cases and have very different expectations of privacy and levels of concern. Your browser has direct access to TONS of private data, if you install certain browser extensions they have access to all that data as well. A custom facebook client would be fundamentally similar and would clearly be considered a piece of software that requires trust to use. The level of trust you should have in the software provider who provides such clients is MUCH higher than a 3rd party site where you simply used facebook as a login provider.
- Nasrudith 7y ago
  In practice it would for anything which the API can touch given "dancing monkey > security" levels of security awareness in practice.
- dehrmann 7y ago
  > You'd still have ACLs and privacy options. People saw an ACL grant screen before Cambridge Analytica took their data. Too many of these screens and people just click "OK."
  - malvosenior 7y ago
    Maybe they actually are OK with it? I know I am. On most services your friend list is public, I don't see that as sensitive information and if I did, I wouldn't use social networks since info I share with people is already available to anyone they chose to share it with.
- SpicyLemonZest 7y ago
  Right, and that's all you need for Cambridge Analytica to happen. They didn't have a backdoor to see everyone's data all the time; they just used the open-ish APIs that existed back before 2015, allowing them to grab all the data all your friends shared with you if you gave their custom app permission.
  - gfodor 7y ago
    Presumably such an API would be restricted to only accessing data generated by the person who approved the API. For example, it would prevent any kind of "news feed" functionality until your connected network also granted access. (This is distinct from what happened with CA)
    - deleted 7y ago
      [deleted]
- shuw 7y ago
  Cambridge Analytica didn't need all data available to everyone. They had access to an API exactly as you'd describe: with ACLs and privacy options.
  - malvosenior 7y ago
    They didn't have all the data Facebook has though, just the data people explicitly granted them via the ACLs. That includes data they had access to view, but that's ok as it's the nature of social networking and communication. Once you send someone information, they can do with it as they please including share it with 3rd parties (unless you have some sort of contract saying that's forbidden).
- chongli 7y ago
  The problem is that Facebook defaults to everything being open. So even though we may not be able to see your page to get your friends list, unless all of your friends toggle on the same privacy settings anyone could reconstruct your friends list by finding all people that have you as a friend. Defaults matter.
  - zentiggr 7y ago
    I truly wonder what would happen if FB were forced to make all security and privacy settings default to tightest possible, and therefore users would have to see the settings and decide just how exposed they wanted to be... Of course, FB would have to be forced into it by law, and they'd lobby hard against being the only company so burdened, so they law would only pass if it applied to every option in every software... and every company in the world would scream "But users will hate us! Our profits! oh my!" No doubt a huge number of people would be outraged by that much workload forced on them, but I like that world. Yeah, I use uMatrix on maximum blacklisting on every site all the time, and Blockada on my phone, ...
  - malvosenior 7y ago
    Is that a problem though? It's the nature of the service. Facebook was basically built to show off who you are connected to.
- bilbo0s 7y ago
  >It would just mean that the data and interactions you as a user already have in Facebook's proprietary walled garden, would be API callable from 3rd parties. I'm not sure you're entirely clear on how the Cambridge Analytica hack worked?
- spunker540 7y ago
  Thus you end up with 3rd party clients gaining access to data of others who never granted them explicit access (aka Cambridge Analytica) through friend connections.
  - malvosenior 7y ago
    Right but that's not "everyone's data", it's just data available to people who granted that app permission. You can't for instance get a FB firehose of everyone's posts. That's the nature of social data (and it's already this way for email -- Google knows what you email @gmail.com addresses even if you don't have one). I personally see nothing wrong with this. I didn't think Cambridge Analytica was a big deal either, just something the media blew out of proportion. If you communicate with people, what you send them will be available to whoever they share it with.
    - NeedMoreTea 7y ago
      There is something qualitatively different about showing a private email to a friend or partner, and it being available to an unknown third party business because someone got dark-patterned into agreeing.
      - malvosenior 7y ago
        There's no way to prevent this though. You already don't know what your connection's email clients are doing with the emails you send them. That's a much bigger info leak than anything that's going to happen on FB but no one seems concerned about it.
- scarface74 7y ago
  what’s stopping those third parties from using the access that you gave it to gather data of your friends? Can I block access from your third party client?
  - malvosenior 7y ago
    Nothing, but that's how it works today. I could show anyone my feed and they could see my friends activity. Same with my web browser, plugins, anything happening to be running in my OS that can capture screenshots, people looking over my shoulder... I'd argue that those are even greater risks as people I know are most likely more sensitive to the information I publish than 3rd party businesses that are scraping data in aggregate for ad targeting purposes. There will always be the analog hole and many a user experience have been degraded in the quixotic attempt to close it.
    - scarface74 7y ago
      Unless your friends looking at your computer are going to write down your whole social graph manually, I doubt that’s the the same threat. Also, most people use one of three browsers. I don’t trust Google but I doubt they are surreptitiously using everyone’s FB login to crawl their social graph.
deleted 7y ago
[deleted]
scarecrowbob 7y ago
I don't see how this is true any more than it is for a bank API. I just want API access to the content --I wrote-- that they are monetizing (even if it's just a lure to get my friends on their platform), and if my friends grant me access to something they have written or shared, the API should allow that. I agree that there are likely ways this can be used to do all kinds of terrible thing. But so could bank APIs.
- SpicyLemonZest 7y ago
  And that was the full set of things that Cambridge Analytica got API access to; the data of people who authorized the app, and any data their friends shared with them. (In fact, they actually got a bit less than that; for instance, Facebook had already locked down the API to prevent apps from seeing email addresses.) If you’re taking the position that Cambridge Analytica wasn’t actually that bad, and it’s worth the trade for a better developer experience, I think that’s an intensely unpopular but defensible claim.
  - malvosenior 7y ago
    > If you’re taking the position that Cambridge Analytica wasn’t actually that bad, and it’s worth the trade for a better developer experience, I think that’s an intensely unpopular but defensible claim. I'll take that position. The media made a huge deal out of Cambridge Analytica but it didn't impact FB usage at all, so I don't think it's as intensely unpopular as you suggest. On most social media services, your friend list is public. I think people who feel that's somehow sensitive information shouldn't be on social media in the first place because there's nothing stopping any one of their friends from sharing all of your info with whoever they want.
6gvONxR4sf7o 7y ago
No, in the same way that an open bank API doesn't mean allowing thieves to vacuum up everyone's money. Open API != open data.
- SpicyLemonZest 7y ago
  In this context it does mean open data. Facebook already provides APIs for looking at your own stuff; to develop a custom client or such, it’s other people’s data that you’d need an API for.

bilbo0s 7y ago

Just to be clear, you don't really mean forcing FB to have an API that would let anyone access any piece of data on FB do you? I mean, you're advocating for an open API to let people access maybe some public photos and such, but nothing private and no personally identifiable connection information right? Just as a matter of full disclosure, I believe anything sensitive should require explicit consent of the user for each bit of data you download from their profile. I don't believe in radically open data APIs on FB because there is a bit of an argument to be made that it's not FBs data, it's that user's data. If she doesn't want to give the world access to her messages to her lover there should certainly be no API level method that overrides her intentions there.

holler 7y ago

I don't see how this would encourage competition?

Finnucane 7y ago
It doesn't. He's glossing over the problem of antitrust needs. An open API would still leave FB in a near-monopolistic control of social data. The FAANG companies can easily buy up and squash potential competitors because for the last few decades government has taken a very narrow view of antitrust with little enforcement effort.