4 ms·

Excellent recap. Re: displaying brand logos in the editor and retrieving these online and mainly from Facebook. There are a lot of reasons why this is problema

Excellent recap. Re: displaying brand logos in the editor and retrieving these online and mainly from Facebook. There are a lot of reasons why this is problematic, not the least that it violates EU privacy regulation without prior consent of the users I'd like to understand what the issue is here. I'm assuming it isn't just a matter of grabbing a logo (jpg) from Facebook. I assume iD is sending (meta) data about the person who is simply browsing the map to Facebook (i.e. without disclosing that info is being sent or what data is sent)?

tmcw 7y ago
> I'm assuming it isn't just a matter of grabbing a logo (jpg) from Facebook. I assume iD is sending (meta) data about the person who is simply browsing the map to Facebook (i.e. without disclosing that info is being sent or what data is sent)? Given the scale of the drama, you'd assume that it was something nefarious, but it isn't. iD loads images for brands from Facebook, and nothing more: here's the relevant code https://github.com/osmlab/name-suggestion-index/blob/66412f05f362f78893490d8c72e56174ac0e4860/build_wikidata.js#L431-L450 https://github.com/osmlab/name-suggestion-index/blob/66412f0... Fun story from back in the day: we added 'social share' buttons to iD. Knowing the fundamentals of web security, they were implemented as simple links, with no JavaScript component on the iD side, no 'trackers', nothing of the sort. But some buzz came out about how other Facebook trackers were up to no good, and the OSM community got in a tizzy about how we had installed nefarious tracking devices in the codebase, and after a few days someone recommended that we should implement the buttons as simple links, which is precisely what they were in the first place. That combination of bad faith and nobody reading the code was constant.
- rmc 7y ago
  Everything you do on Facebook is tracked, monitor and used. Everyone knows that. If you start requesting images of fast food chains from Facebook, we all know Facebook is going to analyze and utilize your new found interest in fast food.
maxerickson 7y ago
The feature literally only pulls images from Facebook's graph api. It is of course a privacy leak, but there's not actually pushback on addressing that, just not a time machine to go back and fix it already. So there will be a privacy policy notifying users of potential third party data accesses and an option to turn that stuff off.
rmc 7y ago
iD, instructs the users browser to fetch an image from graph.facebook.com. The problem is that this tells Facebook that you're interested in a certain brand, if you're logged into Facebook, then FB associates the two. We all know that FB grabs and uses and assembles every bit of information that it can, even repeatidly breaking the law. Adding a Mothercare shop on OSM shouldn't result in Facebook showing you baby/pregnancy adverts, but here we are.

tmcw 7y ago

> I'm assuming it isn't just a matter of grabbing a logo (jpg) from Facebook. I assume iD is sending (meta) data about the person who is simply browsing the map to Facebook (i.e. without disclosing that info is being sent or what data is sent)? Given the scale of the drama, you'd assume that it was something nefarious, but it isn't. iD loads images for brands from Facebook, and nothing more: here's the relevant code https://github.com/osmlab/name-suggestion-index/blob/66412f05f362f78893490d8c72e56174ac0e4860/build_wikidata.js#L431-L450 https://github.com/osmlab/name-suggestion-index/blob/66412f0... Fun story from back in the day: we added 'social share' buttons to iD. Knowing the fundamentals of web security, they were implemented as simple links, with no JavaScript component on the iD side, no 'trackers', nothing of the sort. But some buzz came out about how other Facebook trackers were up to no good, and the OSM community got in a tizzy about how we had installed nefarious tracking devices in the codebase, and after a few days someone recommended that we should implement the buttons as simple links, which is precisely what they were in the first place. That combination of bad faith and nobody reading the code was constant.

rmc 7y ago
Everything you do on Facebook is tracked, monitor and used. Everyone knows that. If you start requesting images of fast food chains from Facebook, we all know Facebook is going to analyze and utilize your new found interest in fast food.

maxerickson 7y ago

The feature literally only pulls images from Facebook's graph api. It is of course a privacy leak, but there's not actually pushback on addressing that, just not a time machine to go back and fix it already. So there will be a privacy policy notifying users of potential third party data accesses and an option to turn that stuff off.

rmc 7y ago

iD, instructs the users browser to fetch an image from graph.facebook.com. The problem is that this tells Facebook that you're interested in a certain brand, if you're logged into Facebook, then FB associates the two. We all know that FB grabs and uses and assembles every bit of information that it can, even repeatidly breaking the law. Adding a Mothercare shop on OSM shouldn't result in Facebook showing you baby/pregnancy adverts, but here we are.