4 ms·

Open API doesn't mean all data available to everyone all the time. You'd still have ACLs and privacy options. It would just mean that the data and interactions

Open API doesn't mean all data available to everyone all the time. You'd still have ACLs and privacy options. It would just mean that the data and interactions you as a user already have in Facebook's proprietary walled garden, would be API callable from 3rd parties. Today you cannot see my FB page if we're not friends, an open API wouldn't allow you to access my data either. If we were friends, you could use your custom FB client to look at my page though, which would be very user friendly.

traek 7y ago
> It would just mean that the data and interactions you as a user already have in Facebook's proprietary walled garden, would be API callable from 3rd parties. This was precisely the level of access which caused the Cambridge Analytica scandal.
- shkkmo 7y ago
  In what way? They were not using user level permissions.
  - traek 7y ago
    Yes, they were. https://www.vox.com/2018/3/17/17134072/facebook-cambridge-analytica-trump-explained-user-data https://www.vox.com/2018/3/17/17134072/facebook-cambridge-an...
    - shkkmo 7y ago
      > Facebook also allowed developers to collect some information on the friend networks of people who used Facebook Login. So no, Cambridge Analytics did not have API access to everything that that that the users who used Facebook login had access to. This was a specific set of permissions granted to apps with which users used their Facebook identities as login identities.
      - SpicyLemonZest 7y ago
        That's right, so I'm not sure how we're drawing different conclusions from it. Cambridge Analytica got an API that was only moderately open, with much less than the full access you'd need to implement something like a Facebook client, and that amount of access still wasn't okay.
        shkkmo 7y ago
        Again, this access was granted when you used your facebook identity to log into a 3rd party site, not using an API to provide an alternative client to the user. Those are very different use cases and have very different expectations of privacy and levels of concern. Your browser has direct access to TONS of private data, if you install certain browser extensions they have access to all that data as well. A custom facebook client would be fundamentally similar and would clearly be considered a piece of software that requires trust to use. The level of trust you should have in the software provider who provides such clients is MUCH higher than a 3rd party site where you simply used facebook as a login provider.
        bryan_w 7y ago
        You would see ads for people to install the "Cambridge Facebook Client -- Earn $2/month just by using Facebook!" While they silently slurp up the same information on not just that person, but their friends.
        shkkmo 7y ago
        Why would this be any different from browsers and browser extensions?
        SpicyLemonZest 7y ago
        It's not different. The current state of the browser extension ecosystem can cause and has caused massive data privacy violations; browser vendors are locking down previously open APIs to try and remediate that, breaking some functionality that developers want. Context: https://securitywithsam.com/2019/07/dataspii-leak-via-browser-extensions/ https://securitywithsam.com/2019/07/dataspii-leak-via-browse... https://www.zdnet.com/article/apple-neutered-ad-blockers-in-safari-but-unlike-chrome-users-didnt-say-a-thing/ https://www.zdnet.com/article/apple-neutered-ad-blockers-in-...
- buckminster 7y ago
  But if I access data through the API how does Cambridge Analytica influence me?
- gfodor 7y ago
  False, the level of access which caused that scandal and others was the fact that the early versions of the Facebook API granted access to second degree nodes in the network once you approved an app. Cambridge did not manage to get hundreds of millions of people to take their survey, they got access to the hundreds of millions of friends of those who did.
  - traek 7y ago
    > If we were friends, you could use your custom FB client to look at my page though, which would be very user friendly. Yes, this is what used to exist, and this is what Cambridge Analytica exploited. The level of access I'm talking about, and what people in this thread are advocating for, is allowing a third party app to see all info an authenticated user is authorized to see (including their friend's info).
  - toast0 7y ago
    A FB api that doesn't provide information about my friends can't replace the feed.
Nasrudith 7y ago
In practice it would for anything which the API can touch given "dancing monkey > security" levels of security awareness in practice.
dehrmann 7y ago
> You'd still have ACLs and privacy options. People saw an ACL grant screen before Cambridge Analytica took their data. Too many of these screens and people just click "OK."
- malvosenior 7y ago
  Maybe they actually are OK with it? I know I am. On most services your friend list is public, I don't see that as sensitive information and if I did, I wouldn't use social networks since info I share with people is already available to anyone they chose to share it with.
SpicyLemonZest 7y ago
Right, and that's all you need for Cambridge Analytica to happen. They didn't have a backdoor to see everyone's data all the time; they just used the open-ish APIs that existed back before 2015, allowing them to grab all the data all your friends shared with you if you gave their custom app permission.
- gfodor 7y ago
  Presumably such an API would be restricted to only accessing data generated by the person who approved the API. For example, it would prevent any kind of "news feed" functionality until your connected network also granted access. (This is distinct from what happened with CA)
  - deleted 7y ago
    [deleted]
shuw 7y ago
Cambridge Analytica didn't need all data available to everyone. They had access to an API exactly as you'd describe: with ACLs and privacy options.
- malvosenior 7y ago
  They didn't have all the data Facebook has though, just the data people explicitly granted them via the ACLs. That includes data they had access to view, but that's ok as it's the nature of social networking and communication. Once you send someone information, they can do with it as they please including share it with 3rd parties (unless you have some sort of contract saying that's forbidden).
chongli 7y ago
The problem is that Facebook defaults to everything being open. So even though we may not be able to see your page to get your friends list, unless all of your friends toggle on the same privacy settings anyone could reconstruct your friends list by finding all people that have you as a friend. Defaults matter.
- zentiggr 7y ago
  I truly wonder what would happen if FB were forced to make all security and privacy settings default to tightest possible, and therefore users would have to see the settings and decide just how exposed they wanted to be... Of course, FB would have to be forced into it by law, and they'd lobby hard against being the only company so burdened, so they law would only pass if it applied to every option in every software... and every company in the world would scream "But users will hate us! Our profits! oh my!" No doubt a huge number of people would be outraged by that much workload forced on them, but I like that world. Yeah, I use uMatrix on maximum blacklisting on every site all the time, and Blockada on my phone, ...
- malvosenior 7y ago
  Is that a problem though? It's the nature of the service. Facebook was basically built to show off who you are connected to.
bilbo0s 7y ago
>It would just mean that the data and interactions you as a user already have in Facebook's proprietary walled garden, would be API callable from 3rd parties. I'm not sure you're entirely clear on how the Cambridge Analytica hack worked?
spunker540 7y ago
Thus you end up with 3rd party clients gaining access to data of others who never granted them explicit access (aka Cambridge Analytica) through friend connections.
- malvosenior 7y ago
  Right but that's not "everyone's data", it's just data available to people who granted that app permission. You can't for instance get a FB firehose of everyone's posts. That's the nature of social data (and it's already this way for email -- Google knows what you email @gmail.com addresses even if you don't have one). I personally see nothing wrong with this. I didn't think Cambridge Analytica was a big deal either, just something the media blew out of proportion. If you communicate with people, what you send them will be available to whoever they share it with.
  - NeedMoreTea 7y ago
    There is something qualitatively different about showing a private email to a friend or partner, and it being available to an unknown third party business because someone got dark-patterned into agreeing.
    - malvosenior 7y ago
      There's no way to prevent this though. You already don't know what your connection's email clients are doing with the emails you send them. That's a much bigger info leak than anything that's going to happen on FB but no one seems concerned about it.
scarface74 7y ago
what’s stopping those third parties from using the access that you gave it to gather data of your friends? Can I block access from your third party client?
- malvosenior 7y ago
  Nothing, but that's how it works today. I could show anyone my feed and they could see my friends activity. Same with my web browser, plugins, anything happening to be running in my OS that can capture screenshots, people looking over my shoulder... I'd argue that those are even greater risks as people I know are most likely more sensitive to the information I publish than 3rd party businesses that are scraping data in aggregate for ad targeting purposes. There will always be the analog hole and many a user experience have been degraded in the quixotic attempt to close it.
  - scarface74 7y ago
    Unless your friends looking at your computer are going to write down your whole social graph manually, I doubt that’s the the same threat. Also, most people use one of three browsers. I don’t trust Google but I doubt they are surreptitiously using everyone’s FB login to crawl their social graph.

traek 7y ago

> It would just mean that the data and interactions you as a user already have in Facebook's proprietary walled garden, would be API callable from 3rd parties. This was precisely the level of access which caused the Cambridge Analytica scandal.

shkkmo 7y ago
In what way? They were not using user level permissions.
- traek 7y ago
  Yes, they were. https://www.vox.com/2018/3/17/17134072/facebook-cambridge-analytica-trump-explained-user-data https://www.vox.com/2018/3/17/17134072/facebook-cambridge-an...
  - shkkmo 7y ago
    > Facebook also allowed developers to collect some information on the friend networks of people who used Facebook Login. So no, Cambridge Analytics did not have API access to everything that that that the users who used Facebook login had access to. This was a specific set of permissions granted to apps with which users used their Facebook identities as login identities.
    - SpicyLemonZest 7y ago
      That's right, so I'm not sure how we're drawing different conclusions from it. Cambridge Analytica got an API that was only moderately open, with much less than the full access you'd need to implement something like a Facebook client, and that amount of access still wasn't okay.
      - shkkmo 7y ago
        Again, this access was granted when you used your facebook identity to log into a 3rd party site, not using an API to provide an alternative client to the user. Those are very different use cases and have very different expectations of privacy and levels of concern. Your browser has direct access to TONS of private data, if you install certain browser extensions they have access to all that data as well. A custom facebook client would be fundamentally similar and would clearly be considered a piece of software that requires trust to use. The level of trust you should have in the software provider who provides such clients is MUCH higher than a 3rd party site where you simply used facebook as a login provider.
        bryan_w 7y ago
        You would see ads for people to install the "Cambridge Facebook Client -- Earn $2/month just by using Facebook!" While they silently slurp up the same information on not just that person, but their friends.
        shkkmo 7y ago
        Why would this be any different from browsers and browser extensions?
        SpicyLemonZest 7y ago
        It's not different. The current state of the browser extension ecosystem can cause and has caused massive data privacy violations; browser vendors are locking down previously open APIs to try and remediate that, breaking some functionality that developers want. Context: https://securitywithsam.com/2019/07/dataspii-leak-via-browser-extensions/ https://securitywithsam.com/2019/07/dataspii-leak-via-browse... https://www.zdnet.com/article/apple-neutered-ad-blockers-in-safari-but-unlike-chrome-users-didnt-say-a-thing/ https://www.zdnet.com/article/apple-neutered-ad-blockers-in-...
buckminster 7y ago
But if I access data through the API how does Cambridge Analytica influence me?
gfodor 7y ago
False, the level of access which caused that scandal and others was the fact that the early versions of the Facebook API granted access to second degree nodes in the network once you approved an app. Cambridge did not manage to get hundreds of millions of people to take their survey, they got access to the hundreds of millions of friends of those who did.
- traek 7y ago
  > If we were friends, you could use your custom FB client to look at my page though, which would be very user friendly. Yes, this is what used to exist, and this is what Cambridge Analytica exploited. The level of access I'm talking about, and what people in this thread are advocating for, is allowing a third party app to see all info an authenticated user is authorized to see (including their friend's info).
- toast0 7y ago
  A FB api that doesn't provide information about my friends can't replace the feed.

Nasrudith 7y ago

In practice it would for anything which the API can touch given "dancing monkey > security" levels of security awareness in practice.

dehrmann 7y ago

> You'd still have ACLs and privacy options. People saw an ACL grant screen before Cambridge Analytica took their data. Too many of these screens and people just click "OK."

malvosenior 7y ago
Maybe they actually are OK with it? I know I am. On most services your friend list is public, I don't see that as sensitive information and if I did, I wouldn't use social networks since info I share with people is already available to anyone they chose to share it with.

SpicyLemonZest 7y ago

Right, and that's all you need for Cambridge Analytica to happen. They didn't have a backdoor to see everyone's data all the time; they just used the open-ish APIs that existed back before 2015, allowing them to grab all the data all your friends shared with you if you gave their custom app permission.

gfodor 7y ago
Presumably such an API would be restricted to only accessing data generated by the person who approved the API. For example, it would prevent any kind of "news feed" functionality until your connected network also granted access. (This is distinct from what happened with CA)
- deleted 7y ago
  [deleted]

shuw 7y ago

Cambridge Analytica didn't need all data available to everyone. They had access to an API exactly as you'd describe: with ACLs and privacy options.

malvosenior 7y ago
They didn't have all the data Facebook has though, just the data people explicitly granted them via the ACLs. That includes data they had access to view, but that's ok as it's the nature of social networking and communication. Once you send someone information, they can do with it as they please including share it with 3rd parties (unless you have some sort of contract saying that's forbidden).

chongli 7y ago

The problem is that Facebook defaults to everything being open. So even though we may not be able to see your page to get your friends list, unless all of your friends toggle on the same privacy settings anyone could reconstruct your friends list by finding all people that have you as a friend. Defaults matter.

zentiggr 7y ago
I truly wonder what would happen if FB were forced to make all security and privacy settings default to tightest possible, and therefore users would have to see the settings and decide just how exposed they wanted to be... Of course, FB would have to be forced into it by law, and they'd lobby hard against being the only company so burdened, so they law would only pass if it applied to every option in every software... and every company in the world would scream "But users will hate us! Our profits! oh my!" No doubt a huge number of people would be outraged by that much workload forced on them, but I like that world. Yeah, I use uMatrix on maximum blacklisting on every site all the time, and Blockada on my phone, ...
malvosenior 7y ago
Is that a problem though? It's the nature of the service. Facebook was basically built to show off who you are connected to.

bilbo0s 7y ago

>It would just mean that the data and interactions you as a user already have in Facebook's proprietary walled garden, would be API callable from 3rd parties. I'm not sure you're entirely clear on how the Cambridge Analytica hack worked?

spunker540 7y ago

Thus you end up with 3rd party clients gaining access to data of others who never granted them explicit access (aka Cambridge Analytica) through friend connections.

malvosenior 7y ago
Right but that's not "everyone's data", it's just data available to people who granted that app permission. You can't for instance get a FB firehose of everyone's posts. That's the nature of social data (and it's already this way for email -- Google knows what you email @gmail.com addresses even if you don't have one). I personally see nothing wrong with this. I didn't think Cambridge Analytica was a big deal either, just something the media blew out of proportion. If you communicate with people, what you send them will be available to whoever they share it with.
- NeedMoreTea 7y ago
  There is something qualitatively different about showing a private email to a friend or partner, and it being available to an unknown third party business because someone got dark-patterned into agreeing.
  - malvosenior 7y ago
    There's no way to prevent this though. You already don't know what your connection's email clients are doing with the emails you send them. That's a much bigger info leak than anything that's going to happen on FB but no one seems concerned about it.

scarface74 7y ago

what’s stopping those third parties from using the access that you gave it to gather data of your friends? Can I block access from your third party client?

malvosenior 7y ago
Nothing, but that's how it works today. I could show anyone my feed and they could see my friends activity. Same with my web browser, plugins, anything happening to be running in my OS that can capture screenshots, people looking over my shoulder... I'd argue that those are even greater risks as people I know are most likely more sensitive to the information I publish than 3rd party businesses that are scraping data in aggregate for ad targeting purposes. There will always be the analog hole and many a user experience have been degraded in the quixotic attempt to close it.
- scarface74 7y ago
  Unless your friends looking at your computer are going to write down your whole social graph manually, I doubt that’s the the same threat. Also, most people use one of three browsers. I don’t trust Google but I doubt they are surreptitiously using everyone’s FB login to crawl their social graph.