4 ms·
Except Cambridge Analytica occurred in a closed-access scenario. It's a problem either way.
by zpallin 7y ago
Except Cambridge Analytica occurred in a closed-access scenario. It's a problem either way.
- bduerst 7y agoCA scraped Facebook APIs. It's only "closed" in the sense that you needed an account and token to access the open API.
- dominotw 7y ago> CA scraped Facebook APIs what does it mean to scrape an API. I usually hear that word for html website scraping.
- myhf 7y agoNormal API use is to read information about the people directly interacting with a post or an app, for the purpose of facilitating that interaction. Cambridge Analytica used posts to get API access to all users (and friends-of-friends) who interacted with those posts, in order to incrementally build a copy of the complete social graph. The process is similar to scraping.
- r00fus 7y agoThis is still an ACL issue - that Facebook allowed CA to pull data they weren’t authorized for doesn’t mean making API access is a bad idea. It increases the attack surface but publicly to everyone.
- Thorrez 7y agoIf I share some information with a friend of a friend, should that information be viewable by an app that the friend of a friend activated? For Cambridge Analytica, the answer was "yes", so Cambridge Analytica was able to scrape a bunch of stuff. If we make the answer "no", then it won't be possible to build alternate UIs, because the Facebook UI will be able to show my friend of a friend my information, but an alternate UI won't be able to do so.
- zpallin 7y agoExactly my point. Facebook's APIs were not designed for CA's style of scraping, but they took advantage of it anyway. You can try limiting access to data but infiltrators will find a way to abuse it anyway.
- bduerst 7y agoAnd that's also my point - you don't accidentally leave an API open. It was purposefully built this way. What CA did with Facebooks API was by design.