8 ms·

As someone who has done a little bit of iOS development for fun, I wouldn't be surprised if this is an actual bug. There used to be 10 different ways to do the

As someone who has done a little bit of iOS development for fun, I wouldn't be surprised if this is an actual bug. There used to be 10 different ways to do the same thing inside iOS, and neither one was "correct." Being a photo app, they probably figured out that having instant access to Camera is their top priority, and because you are allowed to access camera in the background and keep it on, there was no harm in doing so. Of course one could also go deep and assume that Facebook is running all video through an ML that picks out faces, location, items, and whatever else they can grab around your surrounding, and then covert that into ad-intent, but however sexy that sounds from technical point, they are after all a public company and need to play by the rules. Unlikely to take on such a massive intrusion of your privacy, knowing that eventually it would get discovered.

usefulcat 6y ago
> Unlikely to take on such a massive intrusion of your privacy, knowing that eventually it would get discovered. I don't think that's a reason for them not to do it. They could just claim it was an accident, they weren't really collecting the data, etc etc ad infinitum and most people would continue to use facebook just as they always have. The day I uninstalled the facebook app was the day it asked for permission to read all text messages (on top of the many, many other permissions it already had). I figured the next step would be audio and video (after all, there wasn't much left to ask for at that point).
yumraj 6y ago
> I wouldn't be surprised if this is an actual bug. Under other circumstances, yes perhaps. But in the case of a Facebook, with their complete disregard for privacy and search for more and more ways to collect data, this seems like an explicit feature implementation.
- temporary12345 6y ago
  > complete disregard Complete? Aren’t you exaggerating? There were hundreds much worse leaks than any Facebook leak. Any credit card leak is much worse. But Facebook is an easy hatred target. Nothing bad really happened as result of these leaks. Nobody harmed, nobody lost money, and don’t start again on that CA story which happened and fixed several years before you learned about it.
deleted 6y ago
[deleted]
roughly 6y ago
rough experience in a company with an ads department is one ought consider them like some kind of fungus - they may not have been part of a given effort to begin with, but without careful efforts to keep them away, they're bound to colonize whatever it is that gets created eventually.
whoopdedo 6y ago
Wouldn't a network analysis be able to detect a difference in the amount of traffic coming out of the phone? Measure with and without Instagram installed, active, background, and given or denied camera access. If it's capturing images in the background that data has to go somewhere. Even if it batches for sending later. Another way to find out is to feed it "interesting" images with faces and objects, then compare if the camera is pointed at a blank wall for the same amount of time. If the phone is significantly noisier then you can conclude it's actually processing the images and not just dumping them to the bitbucket.
- dewey 6y ago
  > Even if it batches for sending later. Would probably be very hard to spot that if you piggyback on normal story/image upload traffic payloads. Seems like a lot of work for something that's not really that helpful or easier to accomplish.
  - varenc 6y ago
    > Seems like a lot of work for something that's not really that helpful or easier to accomplish. That could be said for Facebook surreptitiously uploading images by piggybacking them onto innocuous requests. I’ve disabled the FB app’s cert pinning so I can MITM it and they really don’t seem to care about minimizing the number of requests. Tons of little logging events will be fired off separately instead of being condensed. Also, there are several unofficial Instagram apps that were developed by thoroughly reverse engineering the app’s private API. Seems unlikely that this could have evaded detection. And just data volume-wise, it’s much harder to conceal uploading weighty images/video. Facebook and Instagram mostly just download data. A long term discrepancy in upload usage between when the app has camera permissions and when it doesn’t would be easy to spot. I have no doubt Facebook is still doing creepy things we don't know about yet, but this particular theory just seems incredibly unlikely to me.
LoSboccacc 6y ago
> I wouldn't be surprised if this is an actual bug https://www.cnet.com/news/facebook-bug-has-camera-activated-while-people-are-using-the-app/ https://www.cnet.com/news/facebook-bug-has-camera-activated-... funny however how often this 'bug' reappears
- spsful 6y ago
  It's noted in the article that no photos or videos were taken when Facebook inadvertently showed the camera page to the user. If they weren't capturing anything, then it really was a bug.
  - IncRnd 6y ago
    > If they weren't capturing anything, then it really was a bug. That's not true. The camera could quite easily have been intentionally enabled at applciation startup in order to have simplified code or instant responses later.
  - LoSboccacc 6y ago
    holy shit people it's not a bug it's done because camera initialisation is slow as fuck, they will keep doing it funny however how the hn crowd downvotes a post with sourced factual information they somehow manage to disagree with
    - kirillzubovsky 6y ago
      You were probably downvoted for using the F word, but outside of that that, I tend to agree that camera init is slow AF. In fact, by playing privacy-advocate games, Apple is inevitably punishing every app except their own because while they will show "This app is using your camera," I wonder if the same rules apply to their own camera usage. We will know soon.
      - saagarjha 6y ago
        Camera shows the indicator just like every other app.
quotz 6y ago
Nobody actually posts directly through their camera, but rather uploads preshotted pics
- coralreef 6y ago
  You'd have to qualify "nobody" with some statistics, because of the millions of users, I'm sure some of them use IG's camera. Also IG Stories is where all the filters live.
bagacrap 6y ago
never heard of Cambridge analytica?
- kevin_thibedeau 6y ago
  Did they break any laws?
  - ABoldGambit 6y ago
    Yes https://techcrunch.com/2019/01/09/cambridge-analyticas-parent-pleads-guilty-to-breaking-uk-data-law https://techcrunch.com/2019/01/09/cambridge-analyticas-paren...
dpacmittal 6y ago
At this point, does Facebook really deserve benefit of the doubt?
- ignoramous 6y ago
  > At this point, does Facebook really deserve benefit of the doubt? You have a point: Facebook is using the iPhone’s camera as users scroll their feed, https://news.ycombinator.com/item?id=21513471 https://news.ycombinator.com/item?id=21513471
  - temporary12345 6y ago
    It is layout bug, as explained, but who cares rights? Let’s just throw stones and without a shadow of a doubt attribute it to malicious intent.
    - ignoramous 6y ago
      Fool me once...
    - sumedh 6y ago
      Have you read Facebook's origin story?
- chance_state 6y ago
  > For the last 5 years, we accidentally recorded billions of people's reactions to ads as they scrolled past them, then accidentally fed that data into our ad placement algorithm. > We're really, reallllllly sorry and promise to do better. Any day now....
  - addicted 6y ago
    This has been Facebook’s modus operandi for a few years now.
dorkwood 6y ago
Let's say that it was in fact intended as a user experience optimization, as you suggested. If you were Facebook, and you now had access to the camera's feed when it wasn't in use, would you really be able to restrain yourself from violating the user's privacy? I imagine for Facebook it would be like seeing a freshly cooked pie on a window sill.
badrabbit 6y ago
If they get caught they just pay a few billion in fines. They do that all the time and still turn a profit. Maybe their shadiness attracts advertisers and makes up for it in part. Criminal consequence is needed to deter them at this point.
modzu 6y ago
facebook has done worse and they aren't going anywhere over privacy concerns (privacy is antithetical to their raison d'etre) and budgeting for fines and legal fees as contingency for when pseudo legal practises that have business beneifits are discovered is standard practice in most large corporations
ponker 6y ago
Sure, but you’re seeing the effect of earning a bad reputation, which is that all of your actions are interpreted uncharitably.
aahhahahaaa 6y ago
Also... wouldn't the bandwidth of streaming back all that video be pretty obvious? Seems like it would take a lot of resources for data they probably already have anyway.
- varenc 6y ago
  Agreed. No matter what advanced stenography they try to use, if the app’s upload volume increases when given camera permissions that'll be easy to spot. That alone wouldn't prove anything, but it would definitely be interesting enough to merit a deeper investigation. Jailbreaks on iOS are currently flourishing, and developing the multiple exploits needed to pull that off makes reverse-engineering the Instagram app seems easy by comparison.
newscracker 6y ago
> but however sexy that sounds from technical point, they are after all a public company and need to play by the rules. Unlikely to take on such a massive intrusion of your privacy, knowing that eventually it would get discovered. You completely lost me here. We’re talking about Facebook, the company with a near infinite supply and history of privacy issues. Facebook has shown that rules don’t apply to it for as long as it can get away with it. Behind the scenes, it laughs at fines imposed by governments because they’re too tiny to have a material impact on the future of the company and its earnings.

usefulcat 6y ago

> Unlikely to take on such a massive intrusion of your privacy, knowing that eventually it would get discovered. I don't think that's a reason for them not to do it. They could just claim it was an accident, they weren't really collecting the data, etc etc ad infinitum and most people would continue to use facebook just as they always have. The day I uninstalled the facebook app was the day it asked for permission to read all text messages (on top of the many, many other permissions it already had). I figured the next step would be audio and video (after all, there wasn't much left to ask for at that point).

yumraj 6y ago

> I wouldn't be surprised if this is an actual bug. Under other circumstances, yes perhaps. But in the case of a Facebook, with their complete disregard for privacy and search for more and more ways to collect data, this seems like an explicit feature implementation.

temporary12345 6y ago
> complete disregard Complete? Aren’t you exaggerating? There were hundreds much worse leaks than any Facebook leak. Any credit card leak is much worse. But Facebook is an easy hatred target. Nothing bad really happened as result of these leaks. Nobody harmed, nobody lost money, and don’t start again on that CA story which happened and fixed several years before you learned about it.

deleted 6y ago

[deleted]

roughly 6y ago

rough experience in a company with an ads department is one ought consider them like some kind of fungus - they may not have been part of a given effort to begin with, but without careful efforts to keep them away, they're bound to colonize whatever it is that gets created eventually.

whoopdedo 6y ago

Wouldn't a network analysis be able to detect a difference in the amount of traffic coming out of the phone? Measure with and without Instagram installed, active, background, and given or denied camera access. If it's capturing images in the background that data has to go somewhere. Even if it batches for sending later. Another way to find out is to feed it "interesting" images with faces and objects, then compare if the camera is pointed at a blank wall for the same amount of time. If the phone is significantly noisier then you can conclude it's actually processing the images and not just dumping them to the bitbucket.

dewey 6y ago
> Even if it batches for sending later. Would probably be very hard to spot that if you piggyback on normal story/image upload traffic payloads. Seems like a lot of work for something that's not really that helpful or easier to accomplish.
- varenc 6y ago
  > Seems like a lot of work for something that's not really that helpful or easier to accomplish. That could be said for Facebook surreptitiously uploading images by piggybacking them onto innocuous requests. I’ve disabled the FB app’s cert pinning so I can MITM it and they really don’t seem to care about minimizing the number of requests. Tons of little logging events will be fired off separately instead of being condensed. Also, there are several unofficial Instagram apps that were developed by thoroughly reverse engineering the app’s private API. Seems unlikely that this could have evaded detection. And just data volume-wise, it’s much harder to conceal uploading weighty images/video. Facebook and Instagram mostly just download data. A long term discrepancy in upload usage between when the app has camera permissions and when it doesn’t would be easy to spot. I have no doubt Facebook is still doing creepy things we don't know about yet, but this particular theory just seems incredibly unlikely to me.

LoSboccacc 6y ago

> I wouldn't be surprised if this is an actual bug https://www.cnet.com/news/facebook-bug-has-camera-activated-while-people-are-using-the-app/ https://www.cnet.com/news/facebook-bug-has-camera-activated-... funny however how often this 'bug' reappears

spsful 6y ago
It's noted in the article that no photos or videos were taken when Facebook inadvertently showed the camera page to the user. If they weren't capturing anything, then it really was a bug.
- IncRnd 6y ago
  > If they weren't capturing anything, then it really was a bug. That's not true. The camera could quite easily have been intentionally enabled at applciation startup in order to have simplified code or instant responses later.
- LoSboccacc 6y ago
  holy shit people it's not a bug it's done because camera initialisation is slow as fuck, they will keep doing it funny however how the hn crowd downvotes a post with sourced factual information they somehow manage to disagree with
  - kirillzubovsky 6y ago
    You were probably downvoted for using the F word, but outside of that that, I tend to agree that camera init is slow AF. In fact, by playing privacy-advocate games, Apple is inevitably punishing every app except their own because while they will show "This app is using your camera," I wonder if the same rules apply to their own camera usage. We will know soon.
    - saagarjha 6y ago
      Camera shows the indicator just like every other app.

quotz 6y ago

Nobody actually posts directly through their camera, but rather uploads preshotted pics

coralreef 6y ago
You'd have to qualify "nobody" with some statistics, because of the millions of users, I'm sure some of them use IG's camera. Also IG Stories is where all the filters live.

bagacrap 6y ago

never heard of Cambridge analytica?

kevin_thibedeau 6y ago
Did they break any laws?
- ABoldGambit 6y ago
  Yes https://techcrunch.com/2019/01/09/cambridge-analyticas-parent-pleads-guilty-to-breaking-uk-data-law https://techcrunch.com/2019/01/09/cambridge-analyticas-paren...

dpacmittal 6y ago

At this point, does Facebook really deserve benefit of the doubt?

ignoramous 6y ago
> At this point, does Facebook really deserve benefit of the doubt? You have a point: Facebook is using the iPhone’s camera as users scroll their feed, https://news.ycombinator.com/item?id=21513471 https://news.ycombinator.com/item?id=21513471
- temporary12345 6y ago
  It is layout bug, as explained, but who cares rights? Let’s just throw stones and without a shadow of a doubt attribute it to malicious intent.
  - ignoramous 6y ago
    Fool me once...
  - sumedh 6y ago
    Have you read Facebook's origin story?
chance_state 6y ago
> For the last 5 years, we accidentally recorded billions of people's reactions to ads as they scrolled past them, then accidentally fed that data into our ad placement algorithm. > We're really, reallllllly sorry and promise to do better. Any day now....
- addicted 6y ago
  This has been Facebook’s modus operandi for a few years now.

dorkwood 6y ago

Let's say that it was in fact intended as a user experience optimization, as you suggested. If you were Facebook, and you now had access to the camera's feed when it wasn't in use, would you really be able to restrain yourself from violating the user's privacy? I imagine for Facebook it would be like seeing a freshly cooked pie on a window sill.

badrabbit 6y ago

If they get caught they just pay a few billion in fines. They do that all the time and still turn a profit. Maybe their shadiness attracts advertisers and makes up for it in part. Criminal consequence is needed to deter them at this point.

modzu 6y ago

facebook has done worse and they aren't going anywhere over privacy concerns (privacy is antithetical to their raison d'etre) and budgeting for fines and legal fees as contingency for when pseudo legal practises that have business beneifits are discovered is standard practice in most large corporations

ponker 6y ago

Sure, but you’re seeing the effect of earning a bad reputation, which is that all of your actions are interpreted uncharitably.

aahhahahaaa 6y ago

Also... wouldn't the bandwidth of streaming back all that video be pretty obvious? Seems like it would take a lot of resources for data they probably already have anyway.

varenc 6y ago
Agreed. No matter what advanced stenography they try to use, if the app’s upload volume increases when given camera permissions that'll be easy to spot. That alone wouldn't prove anything, but it would definitely be interesting enough to merit a deeper investigation. Jailbreaks on iOS are currently flourishing, and developing the multiple exploits needed to pull that off makes reverse-engineering the Instagram app seems easy by comparison.

newscracker 6y ago

> but however sexy that sounds from technical point, they are after all a public company and need to play by the rules. Unlikely to take on such a massive intrusion of your privacy, knowing that eventually it would get discovered. You completely lost me here. We’re talking about Facebook, the company with a near infinite supply and history of privacy issues. Facebook has shown that rules don’t apply to it for as long as it can get away with it. Behind the scenes, it laughs at fines imposed by governments because they’re too tiny to have a material impact on the future of the company and its earnings.