9 ms·

> The bill would require communications platforms with more than 100 million monthly active members - Facebook has more than two billion - to allow its users to

> The bill would require communications platforms with more than 100 million monthly active members - Facebook has more than two billion - to allow its users to easily move, or port, their data to another network, Warner’s office said in a statement. Facebook already has a data export feature. You have to manually navigate to that page and download a giant zip file. Cool. The much more important concept being proposed here is delegation: > Under the bill the companies would be required to maintain an interface to facilitate interoperability. Or users would be allowed to choose another company to manage a user’s account settings, content, and online interactions, the statement said. Very few people are going to manually export their data from Facebook. But they might go to a new network that supports cross-posting to Facebook, or an automatic import that doesn't require them to navigate Facebook's menus. Delegation is a severely underappreciated digital right. Beyond advocating for data-exports, we should advocate that users have the right to delegate data-access through APIs to third-parties. If I can manually update/download my Facebook status, I should also be allowed to programmatically update it. And I should be able to authorize another person to update/download it on my behalf.

buboard 7y ago
So, facebook and twitter already have apis for almost all their functions. What's the goal of this legislation?
- duxup 7y ago
  At least as far as Twitter goes don't they limit some of their APIs like how many users a given set of API keys can use or something like that?
  - buboard 7y ago
    Yeah they severely limit bots and ask for phone numbers and then they 'll ban your number if you use it twice. Who's responsible for that other then the media FUD about russian bots? I really can't blame twitter (and FB) for limiting their platforms here.
    - bilbo0s 7y ago
      Hmm. That's actually a good question. Does it outline in this legislation who is responsible if twitter throws open their api's and the company that a user delegated steals the user's data by acting, essentially, as a proxy api for other companies? I would think it's obvious that from the moment you delegate access to your data, Twitter would no longer be responsible. Basically, they should only be responsible for making sure that data is given only to whoever authenticates with the appropriate keys that the user in question authorized. What happens from there should be no longer Twitter's legal problem. That seems obvious to me, but it's definitely something you would have to check.
      - buboard 7y ago
        Thhis isnt even about theft, but that people give their permission willy nilly to bad actors. Thats not a solvable problem
        bilbo0s 7y ago
        >Thats not a solvable problem Well, we're not trying to "solve" the problem. We're just trying to clarify that Twitter has no legal liability for the problem. If you delegate access to your account and someone proxies it; or there are all of a sudden all these GDPR violations flooding in because you gave away access to your contacts' private information when you delegated access to your account; etc etc; that liability should fall on either the user, or the entity to which the user delegated access. It shouldn't really fall on Twitter. That's all we're talking about here, just making sure that legal and criminal liability is matched with delegated authorization. Because the legal ramifications are what tend to ensure security and privacy.
        buboard 7y ago
        That’s what platforms already do - yet they are being slandered for not saving their users from themselves.
        7y ago
- romaaeterna 7y ago
  To break the Facebook and Twitter monopolies.
  - scarface74 7y ago
    So Twitter and Facebook have monopolies? Isn’t that kind of the opposite of a monopoly?
    - sasasassy 7y ago
      They are different kinds of websites.
      - buboard 7y ago
        and that s why they are "monopolies" - they each dominate a format. It's like saying IRC is a monopoly - which it is, just not owned by a central entity. It's not really going to work with people having 2 facebook-like accounts - they 'll eventually gravitate to one. What will work, is if there are viable , better open source and decentralized alternatives.
        scarface74 7y ago
        So if we granular defined monopoly - HN could be defined as a monopoly. But the fact that people have LinkedIn, Facebook, Twitter, Reddit, etc accounts does show that people will use more than one service. How many people are in multiple Slack groups.
        buboard 7y ago
        Hn and reddit are the same format. And linkedin could easily merge with facebook. But facebook and twitter don’t mix > How many people are in multiple Slack groups Aren’t they using a single app?
        scarface74 7y ago
- danShumway 7y ago
  Twitter's API is notoriously bad for 3rd party apps.[0] In order to use the standard API, you need to register for a developer account, which requires manual approval and which Twitter can deny for any reason.[1] Facebook has a history of outright suing 3rd party apps.[2] If I can log into Twitter, I should also be able to update my account with an HTTP request. That's it. I shouldn't need to sign an agreement, or tell them why I'm programmatically accessing my account, or dig into a settings page. I should be able to grant an OAUTH permission to anyone that gives them access to that API, and Facebook shouldn't be able to sue that person just because they got around an IP block. That should just be part of my account. I don't know if this legislation guarantees that (the article doesn't link to the text of the bill). Most tech legislation is bad, so there's a good chance it doesn't. But the principle remains. [0]: https://www.theverge.com/2018/8/16/17699626/twitter-third-party-apps-streaming-api-deprecation https://www.theverge.com/2018/8/16/17699626/twitter-third-pa... [1]: https://developer.twitter.com/en/docs/basics/developer-portal/overview https://developer.twitter.com/en/docs/basics/developer-porta... [2]: https://www.eff.org/cases/facebook-v-power-ventures https://www.eff.org/cases/facebook-v-power-ventures
  - buboard 7y ago
    i wonder what caused them to limit their platforms so much.
    - egypturnash 7y ago
      wanting to own all ads placed against user content wanting to lock users in and make it harder to leave for another service and still maintain a presence (which is also a constant ad for that other service) by cross-posting wanting to make it harder to see the stuff you're following people for without ads inserted every few posts
      - buboard 7y ago
        It s still possible to leave but nobody leaves. Surely they benefit from some extra safeguards, but i don't think either are worried that users will take their data elsewhere. Usually when a new platform emerges, it 's a new format (e.g. tiktok). I 'm pretty sure their response was in order to avoid bad PR during the Analytica scandal period.
sp332 7y ago
Is that different from the API access Facebook already makes available to apps?
neuroticfish 7y ago
>Beyond advocating for data-exports, we should advocate that users have the right to delegate data-access through APIs to third-parties. IMO we should first and foremost be advocating for the right to have our data destroyed.
- bilbo0s 7y ago
  I agree. But this is the government, they are definitely going to be loathe to accede to that request. This is a "take what we can get" type of step.
- tlb 7y ago
  Someone will write an app that uses a delegation API to destroy your data. Possibly including better or more nuanced ways than simply deleting your account, like removing all pictures of yourself smoking or wearing a beret.
- dependenttypes 7y ago
  The concept of data ownership is a very anti-freedom/pro-copyright concept.
  - jonfw 7y ago
    With such a shallow view of freedom, physical property ownership is a very anti-freedom concept as well, is it not? Ownership of a house is an infringement on the freedoms of other poeple who want to live there? Intellectual property is no different than any other sort of property. The right to own property is invaluable, and serves the purpose of maximizing freedoms in the long run.
    - concordDance 7y ago
      > Intellectual property is no different than any other sort of property. Is this rhetorical or literal?
    - the8472 7y ago
      Ill-gotten goods can be confiscated. The same for knowledge would involve lobotomies. Would you please hold still for a moment?
silon42 7y ago
> should advocate that users have the right to delegate data-access through APIs to third-parties Not just third parties, but themselves (aka, write/use your own client for messenger/discord/...). This is the only way to get rid of having to use dozens of clients for various networks (apart from total standardization and federation which isn't happening anytime soon)
- megous 7y ago
  Yeah, EU made the same mistake with banking APIs. Banks now have to have API access, but not for end users, just for registered intermediaries. It just pushes the data into hands of more corporations, instead of giving users easy access to their bank.
- giancarlostoro 7y ago
  Pidgin would thrive once again!
Alex3917 7y ago
> Facebook already has a data export feature. No it doesn't. It doesn't have the phone numbers or email addresses for the vast majority of people, even the ones who have their email address and phone number in their profile.
- purple_ducks 7y ago
  That's not your data - it's theirs (the respective persons)
  - Alex3917 7y ago
    No it's not. If someone gives you their physical business card, would you expect to lose access to it if you move houses? Once they give you their contact info, you should have a copy of it forever. Otherwise it's completely useless.
    - akersten 7y ago
      Isn't that an argument Facebook could make too, that it's not your data now that you've given it to them?
    - bilbo0s 7y ago
      No. Because that's the same argument FB could make. No. Your data remains your data, even if you allow someone else to look at it. You should be able to allow others to look at it, or even delete it after having allowed others to look at it. Now in practice, you can't. I get that. But that doesn't mean that it's not your data. Certainly your contact info is your data. I shouldn't be able to give a girl's contact info to some other guy without her consent. One, that's douchey. Two, it's not my data, so doing so violates her privacy.
      - Alex3917 7y ago
        > Your data remains your data, even if you allow someone else to look at it. You should be able to allow others to look at it, or even delete it after having allowed others to look at it. So you would argue that it's fine that Apple was deleting people's email the other day, because it's not really their data?
dspillett 7y ago
> we should advocate that users have the right to delegate data-access through APIs to third-parties From my PoV, for my purposes, as a technically minded user I might agree. But thinking about the numpty-on-the-street, this could be a privacy nightmare with people being easily conned into allowing a random application full unrestricted access to slurp their data. This can happen already, of course, but the provider could detect a remote API scraper and try to block it, and a user-local malware scanner can be trained spot a rogue browser extension that scrapes the UI, but if API access like that is mandated they'll have to provide the access and won't be able to tell the difference between that which the user requested and that which the user was conned into requesting.
- bilbo0s 7y ago
  Again though, all that needs to be done is to make sure that the liability for leaked data falls on the user. That's the other part of it right? You delegated access to your account, so InstaFaceTwitter is no longer responsible for what happens to the data on that account. They are only responsible for making sure they give anyone presenting the keys you authorized access to edit and read data on your account. I mean, there are obviously responsibilities that naturally come with having delegated that access. And word will get around. The first GDPR violations because some user delegated access to their account and the entity that was authorized slurped up all of that user's contacts' personally identifiable data without the contacts being notified, will undoubtedly set the tone. That's still likely a GDPR violation. This doesn't change any of that. The only thing that changes is that the consequences for the GDPR violations now fall on the entity that was authorized, or maybe on the user who authorized the entity? (Not sure which?) But it obviously would not fall on Twitter since it is only complying with the law. It's important that legal and criminal liability is matched to authorization or delegation. In practice, it will be the threat of legal liability that ensures data security and data privacy, so that needs to follow delegation to ensure incentives are always aligned properly.
  - codetrotter 7y ago
    > all that needs to be done is to make sure that the liability for leaked data falls on the user I don’t think that was the point of what the parent commenter was saying. As I read it, they were talking not about liability but the likely negative side effect of having more people be conned out of their private data that will then be abused. Who is liable is a secondary concern. The main problem is the fact that people’s private data end up in the wrong hands.
Funes- 7y ago
>> Under the bill the companies would be required to maintain an interface to facilitate interoperability. This would be easily achieved with ActivityPub [0]. >> The bill would require communications platforms with more than 100 million monthly active members [...] to allow its users to easily move, or port, their data to another network... That's the idea behind Berners-Lee's Solid [1]. I wish legislators were more in touch with open-source technology innovators. I feel the FOSS movement's philosophy and the idea of having collective technologies promoted and funded by the government go hand in hand. [0] https://activitypub.rocks/ https://activitypub.rocks/ [1] https://solid.inrupt.com/ https://solid.inrupt.com/
- Vinnl 7y ago
  Solid is not the first effort in this area, but the timing w.r.t. consumer sentiment and legislation, combined with the clout of TimBL, does make it feel like it has a serious shot at success. (Disclosure: I work at inrupt, the main commercial player supporting Solid, founded by TimBL.)
big_chungus 7y ago
You have to somewhat assume a hostile actor here. Have you worked with fb's API before? They _technically_ have one, but frequently make breaking changes. They could easily justify this for such a legally-demanded API, as they do the same thing internally and already have that practice . What would prevent them from making it very difficult to maintain such a service?
merpnderp 7y ago
This is the last thing these companies will allow because it would destroy their business model. This would allow federation of different competing sites and users could pick the company/interface they like most and still have access to all their friends/pages/connections on FaceTweet. I love it.

buboard 7y ago

So, facebook and twitter already have apis for almost all their functions. What's the goal of this legislation?

duxup 7y ago
At least as far as Twitter goes don't they limit some of their APIs like how many users a given set of API keys can use or something like that?
- buboard 7y ago
  Yeah they severely limit bots and ask for phone numbers and then they 'll ban your number if you use it twice. Who's responsible for that other then the media FUD about russian bots? I really can't blame twitter (and FB) for limiting their platforms here.
  - bilbo0s 7y ago
    Hmm. That's actually a good question. Does it outline in this legislation who is responsible if twitter throws open their api's and the company that a user delegated steals the user's data by acting, essentially, as a proxy api for other companies? I would think it's obvious that from the moment you delegate access to your data, Twitter would no longer be responsible. Basically, they should only be responsible for making sure that data is given only to whoever authenticates with the appropriate keys that the user in question authorized. What happens from there should be no longer Twitter's legal problem. That seems obvious to me, but it's definitely something you would have to check.
    - buboard 7y ago
      Thhis isnt even about theft, but that people give their permission willy nilly to bad actors. Thats not a solvable problem
      - bilbo0s 7y ago
        >Thats not a solvable problem Well, we're not trying to "solve" the problem. We're just trying to clarify that Twitter has no legal liability for the problem. If you delegate access to your account and someone proxies it; or there are all of a sudden all these GDPR violations flooding in because you gave away access to your contacts' private information when you delegated access to your account; etc etc; that liability should fall on either the user, or the entity to which the user delegated access. It shouldn't really fall on Twitter. That's all we're talking about here, just making sure that legal and criminal liability is matched with delegated authorization. Because the legal ramifications are what tend to ensure security and privacy.
        buboard 7y ago
        That’s what platforms already do - yet they are being slandered for not saving their users from themselves.
        7y ago
romaaeterna 7y ago
To break the Facebook and Twitter monopolies.
- scarface74 7y ago
  So Twitter and Facebook have monopolies? Isn’t that kind of the opposite of a monopoly?
  - sasasassy 7y ago
    They are different kinds of websites.
    - buboard 7y ago
      and that s why they are "monopolies" - they each dominate a format. It's like saying IRC is a monopoly - which it is, just not owned by a central entity. It's not really going to work with people having 2 facebook-like accounts - they 'll eventually gravitate to one. What will work, is if there are viable , better open source and decentralized alternatives.
      - scarface74 7y ago
        So if we granular defined monopoly - HN could be defined as a monopoly. But the fact that people have LinkedIn, Facebook, Twitter, Reddit, etc accounts does show that people will use more than one service. How many people are in multiple Slack groups.
        buboard 7y ago
        Hn and reddit are the same format. And linkedin could easily merge with facebook. But facebook and twitter don’t mix > How many people are in multiple Slack groups Aren’t they using a single app?
        scarface74 7y ago
danShumway 7y ago
Twitter's API is notoriously bad for 3rd party apps.[0] In order to use the standard API, you need to register for a developer account, which requires manual approval and which Twitter can deny for any reason.[1] Facebook has a history of outright suing 3rd party apps.[2] If I can log into Twitter, I should also be able to update my account with an HTTP request. That's it. I shouldn't need to sign an agreement, or tell them why I'm programmatically accessing my account, or dig into a settings page. I should be able to grant an OAUTH permission to anyone that gives them access to that API, and Facebook shouldn't be able to sue that person just because they got around an IP block. That should just be part of my account. I don't know if this legislation guarantees that (the article doesn't link to the text of the bill). Most tech legislation is bad, so there's a good chance it doesn't. But the principle remains. [0]: https://www.theverge.com/2018/8/16/17699626/twitter-third-party-apps-streaming-api-deprecation https://www.theverge.com/2018/8/16/17699626/twitter-third-pa... [1]: https://developer.twitter.com/en/docs/basics/developer-portal/overview https://developer.twitter.com/en/docs/basics/developer-porta... [2]: https://www.eff.org/cases/facebook-v-power-ventures https://www.eff.org/cases/facebook-v-power-ventures
- buboard 7y ago
  i wonder what caused them to limit their platforms so much.
  - egypturnash 7y ago
    wanting to own all ads placed against user content wanting to lock users in and make it harder to leave for another service and still maintain a presence (which is also a constant ad for that other service) by cross-posting wanting to make it harder to see the stuff you're following people for without ads inserted every few posts
    - buboard 7y ago
      It s still possible to leave but nobody leaves. Surely they benefit from some extra safeguards, but i don't think either are worried that users will take their data elsewhere. Usually when a new platform emerges, it 's a new format (e.g. tiktok). I 'm pretty sure their response was in order to avoid bad PR during the Analytica scandal period.

sp332 7y ago

Is that different from the API access Facebook already makes available to apps?

neuroticfish 7y ago

>Beyond advocating for data-exports, we should advocate that users have the right to delegate data-access through APIs to third-parties. IMO we should first and foremost be advocating for the right to have our data destroyed.

bilbo0s 7y ago
I agree. But this is the government, they are definitely going to be loathe to accede to that request. This is a "take what we can get" type of step.
tlb 7y ago
Someone will write an app that uses a delegation API to destroy your data. Possibly including better or more nuanced ways than simply deleting your account, like removing all pictures of yourself smoking or wearing a beret.
dependenttypes 7y ago
The concept of data ownership is a very anti-freedom/pro-copyright concept.
- jonfw 7y ago
  With such a shallow view of freedom, physical property ownership is a very anti-freedom concept as well, is it not? Ownership of a house is an infringement on the freedoms of other poeple who want to live there? Intellectual property is no different than any other sort of property. The right to own property is invaluable, and serves the purpose of maximizing freedoms in the long run.
  - concordDance 7y ago
    > Intellectual property is no different than any other sort of property. Is this rhetorical or literal?
  - the8472 7y ago
    Ill-gotten goods can be confiscated. The same for knowledge would involve lobotomies. Would you please hold still for a moment?

silon42 7y ago

> should advocate that users have the right to delegate data-access through APIs to third-parties Not just third parties, but themselves (aka, write/use your own client for messenger/discord/...). This is the only way to get rid of having to use dozens of clients for various networks (apart from total standardization and federation which isn't happening anytime soon)

megous 7y ago
Yeah, EU made the same mistake with banking APIs. Banks now have to have API access, but not for end users, just for registered intermediaries. It just pushes the data into hands of more corporations, instead of giving users easy access to their bank.
giancarlostoro 7y ago
Pidgin would thrive once again!

Alex3917 7y ago

> Facebook already has a data export feature. No it doesn't. It doesn't have the phone numbers or email addresses for the vast majority of people, even the ones who have their email address and phone number in their profile.

purple_ducks 7y ago
That's not your data - it's theirs (the respective persons)
- Alex3917 7y ago
  No it's not. If someone gives you their physical business card, would you expect to lose access to it if you move houses? Once they give you their contact info, you should have a copy of it forever. Otherwise it's completely useless.
  - akersten 7y ago
    Isn't that an argument Facebook could make too, that it's not your data now that you've given it to them?
  - bilbo0s 7y ago
    No. Because that's the same argument FB could make. No. Your data remains your data, even if you allow someone else to look at it. You should be able to allow others to look at it, or even delete it after having allowed others to look at it. Now in practice, you can't. I get that. But that doesn't mean that it's not your data. Certainly your contact info is your data. I shouldn't be able to give a girl's contact info to some other guy without her consent. One, that's douchey. Two, it's not my data, so doing so violates her privacy.
    - Alex3917 7y ago
      > Your data remains your data, even if you allow someone else to look at it. You should be able to allow others to look at it, or even delete it after having allowed others to look at it. So you would argue that it's fine that Apple was deleting people's email the other day, because it's not really their data?

dspillett 7y ago

> we should advocate that users have the right to delegate data-access through APIs to third-parties From my PoV, for my purposes, as a technically minded user I might agree. But thinking about the numpty-on-the-street, this could be a privacy nightmare with people being easily conned into allowing a random application full unrestricted access to slurp their data. This can happen already, of course, but the provider could detect a remote API scraper and try to block it, and a user-local malware scanner can be trained spot a rogue browser extension that scrapes the UI, but if API access like that is mandated they'll have to provide the access and won't be able to tell the difference between that which the user requested and that which the user was conned into requesting.

bilbo0s 7y ago
Again though, all that needs to be done is to make sure that the liability for leaked data falls on the user. That's the other part of it right? You delegated access to your account, so InstaFaceTwitter is no longer responsible for what happens to the data on that account. They are only responsible for making sure they give anyone presenting the keys you authorized access to edit and read data on your account. I mean, there are obviously responsibilities that naturally come with having delegated that access. And word will get around. The first GDPR violations because some user delegated access to their account and the entity that was authorized slurped up all of that user's contacts' personally identifiable data without the contacts being notified, will undoubtedly set the tone. That's still likely a GDPR violation. This doesn't change any of that. The only thing that changes is that the consequences for the GDPR violations now fall on the entity that was authorized, or maybe on the user who authorized the entity? (Not sure which?) But it obviously would not fall on Twitter since it is only complying with the law. It's important that legal and criminal liability is matched to authorization or delegation. In practice, it will be the threat of legal liability that ensures data security and data privacy, so that needs to follow delegation to ensure incentives are always aligned properly.
- codetrotter 7y ago
  > all that needs to be done is to make sure that the liability for leaked data falls on the user I don’t think that was the point of what the parent commenter was saying. As I read it, they were talking not about liability but the likely negative side effect of having more people be conned out of their private data that will then be abused. Who is liable is a secondary concern. The main problem is the fact that people’s private data end up in the wrong hands.

Funes- 7y ago

>> Under the bill the companies would be required to maintain an interface to facilitate interoperability. This would be easily achieved with ActivityPub [0]. >> The bill would require communications platforms with more than 100 million monthly active members [...] to allow its users to easily move, or port, their data to another network... That's the idea behind Berners-Lee's Solid [1]. I wish legislators were more in touch with open-source technology innovators. I feel the FOSS movement's philosophy and the idea of having collective technologies promoted and funded by the government go hand in hand. [0] https://activitypub.rocks/ https://activitypub.rocks/ [1] https://solid.inrupt.com/ https://solid.inrupt.com/

Vinnl 7y ago
Solid is not the first effort in this area, but the timing w.r.t. consumer sentiment and legislation, combined with the clout of TimBL, does make it feel like it has a serious shot at success. (Disclosure: I work at inrupt, the main commercial player supporting Solid, founded by TimBL.)

big_chungus 7y ago

You have to somewhat assume a hostile actor here. Have you worked with fb's API before? They _technically_ have one, but frequently make breaking changes. They could easily justify this for such a legally-demanded API, as they do the same thing internally and already have that practice . What would prevent them from making it very difficult to maintain such a service?

merpnderp 7y ago

This is the last thing these companies will allow because it would destroy their business model. This would allow federation of different competing sites and users could pick the company/interface they like most and still have access to all their friends/pages/connections on FaceTweet. I love it.