4 ms·

Doesn't the Facebook user need to allow their connections to be publicly accessed via the Graph API in order for it to be scrape-able in the first place? The m

Doesn't the Facebook user need to allow their connections to be publicly accessed via the Graph API in order for it to be scrape-able in the first place? The main point here is that Google isn't doing anything with the "Facebook data" that the original user of that data (who actually owns it, let's be fair about that) hasn't approved of in one way or another.

rryan 16y ago
Not sure about the Graph API, but your name, your profile picture, and your contact list are all fully public information and you can't control their visibility.
- brown9-2 16y ago
  Are you sure about that? How does one access this info? If I go to http://graph.facebook.com/<myusername> http://graph.facebook.com/<myusername>, the only data that is visible is: { "id": "...", "name": "...", "first_name": "...", "last_name": "...", "username": "...", "gender": "male", "locale": "en_US" }
  - michaelfairley 16y ago
    https://graph.facebook.com/michaelfairley/picture?type=large https://graph.facebook.com/michaelfairley/picture?type=large for the picture. Friends can be accessed similarly, but require an access token (_any_ access token, not just the user's that you're inspecting. More details at Facebook's API docs: https://developers.facebook.com/docs/reference/api/user/ https://developers.facebook.com/docs/reference/api/user/
    - fudged71 16y ago
      Wow. I am shocked that information I explicitly block to users (such as profile picture) are publicly available through a simple URL trick.
    - brown9-2 16y ago
      Friends can be accessed similarly, but require an access token (_any_ access token, not just the user's that you're inspecting. This would seem to be a bug if so, according to this page in the FB documentation: To get additional information about a user, you must first get their permission. At a high level, you need to get an access token for the Facebook user. After you obtain the access token for the user, you can perform authorized requests on behalf of that user by including the access token in your Graph API requests: https://developers.facebook.com/docs/reference/api/ https://developers.facebook.com/docs/reference/api/
  - kmavm 16y ago
    Try, e.g.: curl https://socialgraph.googleapis.com/otherme?q=<yourgmailacct>@gmail.com https://socialgraph.googleapis.com/otherme?q=<yourgmaila... Here's what they have to say about me, to anybody with a web browser, even though I've tried my hardest to opt out: https://socialgraph.googleapis.com/otherme?q=facebook.com/kma https://socialgraph.googleapis.com/otherme?q=facebook.com/km... {"http://twitter.com/keithmadams:{attributes:{atom:http://twitter.com/statuses/user_timeline/keithmadams.atom,bio:Engineer http://twitter.com/keithmadams:{attributes:{atom:http://twit... at Facebook, dad, cyclist.","exists":"1","rss":"http://twitter.com/statuses/user_timeline/keithmadams.rss,url:http://twitter.com/keithmadams,profile:http://twitter.com/keithmadams} http://twitter.com/statuses/user_timeline/keithmadams.rss,ur...},"http://www.quora.com/keith-adams:{attributes:{exists:1,photo:http://d2o7bfz2il9cb7.cloudfront.net/main-thumb-2418-100-zOwSN9N49abe8FyDUcKmtrSWB6fpNfzj.jpeg,fn:Keith http://www.quora.com/keith-adams:{attributes:{exists:1,photo... Adams","url":"http://www.quora.com/keith-adams,profile:http://www.quora.com/keith-adams}}}(dev1438:local-hphp:dbg:~)$ http://www.quora.com/keith-adams,profile:http://www.quora.co...
    - brown9-2 16y ago
      Are you using your Google account to login to these other services? That API call returns nothing for my address.
      - kmavm 16y ago
        No.
  - dxbydt 16y ago
    http://bit.ly/jcvm4R http://bit.ly/jcvm4R That's my list of the first 50 people who joined Facebook, using the Graph API & a bit of Java. Look for Saverin, Zuckerberg, Moskovitz & rest of the gang. Its all in there! Wrote this to find the first million facebook signons.
kmavm 16y ago
No, there's no permission involved on the Google or Facebook side, or at least, there wasn't for me. My understanding from Google's description above is that they are scraping the logged out facebook.com profiles; your logged out profile has a random selection of friends on it. There are enough of them there for Google to infer that facebook.com/kma (me, who is friends with Nick Schrock, e.g.) is the same Keith Adams as kmadams_at_gmail_dot_com (also me, who also has written emails to someone named Nick Schrock). Without clicking through anything on either site, I started getting little faces in my search results last month saying "So-And-So, your friend on Facebook, shared this on Twitter." Here's a screenshot of the results I was seeing: http://imgur.com/0ctAO http://imgur.com/0ctAO Disclosure: I write code for Facebook. I had nothing to do with this whole thing, and cannot officially speak for FB. It could also be the case that I am in a A/B test Google is performing, etc. This was just my experience. It fits with Google's stated mechanisms for how Social Circles work.
- bluelu 16y ago
  Bravo for Facebook not pulling a lame PR stunt like google when they thought Bing would be stealing their results!

rryan 16y ago

Not sure about the Graph API, but your name, your profile picture, and your contact list are all fully public information and you can't control their visibility.

brown9-2 16y ago
Are you sure about that? How does one access this info? If I go to http://graph.facebook.com/<myusername> http://graph.facebook.com/<myusername>, the only data that is visible is: { "id": "...", "name": "...", "first_name": "...", "last_name": "...", "username": "...", "gender": "male", "locale": "en_US" }
- michaelfairley 16y ago
  https://graph.facebook.com/michaelfairley/picture?type=large https://graph.facebook.com/michaelfairley/picture?type=large for the picture. Friends can be accessed similarly, but require an access token (_any_ access token, not just the user's that you're inspecting. More details at Facebook's API docs: https://developers.facebook.com/docs/reference/api/user/ https://developers.facebook.com/docs/reference/api/user/
  - fudged71 16y ago
    Wow. I am shocked that information I explicitly block to users (such as profile picture) are publicly available through a simple URL trick.
  - brown9-2 16y ago
    Friends can be accessed similarly, but require an access token (_any_ access token, not just the user's that you're inspecting. This would seem to be a bug if so, according to this page in the FB documentation: To get additional information about a user, you must first get their permission. At a high level, you need to get an access token for the Facebook user. After you obtain the access token for the user, you can perform authorized requests on behalf of that user by including the access token in your Graph API requests: https://developers.facebook.com/docs/reference/api/ https://developers.facebook.com/docs/reference/api/
- kmavm 16y ago
  Try, e.g.: curl https://socialgraph.googleapis.com/otherme?q=<yourgmailacct>@gmail.com https://socialgraph.googleapis.com/otherme?q=<yourgmaila... Here's what they have to say about me, to anybody with a web browser, even though I've tried my hardest to opt out: https://socialgraph.googleapis.com/otherme?q=facebook.com/kma https://socialgraph.googleapis.com/otherme?q=facebook.com/km... {"http://twitter.com/keithmadams:{attributes:{atom:http://twitter.com/statuses/user_timeline/keithmadams.atom,bio:Engineer http://twitter.com/keithmadams:{attributes:{atom:http://twit... at Facebook, dad, cyclist.","exists":"1","rss":"http://twitter.com/statuses/user_timeline/keithmadams.rss,url:http://twitter.com/keithmadams,profile:http://twitter.com/keithmadams} http://twitter.com/statuses/user_timeline/keithmadams.rss,ur...},"http://www.quora.com/keith-adams:{attributes:{exists:1,photo:http://d2o7bfz2il9cb7.cloudfront.net/main-thumb-2418-100-zOwSN9N49abe8FyDUcKmtrSWB6fpNfzj.jpeg,fn:Keith http://www.quora.com/keith-adams:{attributes:{exists:1,photo... Adams","url":"http://www.quora.com/keith-adams,profile:http://www.quora.com/keith-adams}}}(dev1438:local-hphp:dbg:~)$ http://www.quora.com/keith-adams,profile:http://www.quora.co...
  - brown9-2 16y ago
    Are you using your Google account to login to these other services? That API call returns nothing for my address.
    - kmavm 16y ago
      No.
- dxbydt 16y ago
  http://bit.ly/jcvm4R http://bit.ly/jcvm4R That's my list of the first 50 people who joined Facebook, using the Graph API & a bit of Java. Look for Saverin, Zuckerberg, Moskovitz & rest of the gang. Its all in there! Wrote this to find the first million facebook signons.

kmavm 16y ago

No, there's no permission involved on the Google or Facebook side, or at least, there wasn't for me. My understanding from Google's description above is that they are scraping the logged out facebook.com profiles; your logged out profile has a random selection of friends on it. There are enough of them there for Google to infer that facebook.com/kma (me, who is friends with Nick Schrock, e.g.) is the same Keith Adams as kmadams_at_gmail_dot_com (also me, who also has written emails to someone named Nick Schrock). Without clicking through anything on either site, I started getting little faces in my search results last month saying "So-And-So, your friend on Facebook, shared this on Twitter." Here's a screenshot of the results I was seeing: http://imgur.com/0ctAO http://imgur.com/0ctAO Disclosure: I write code for Facebook. I had nothing to do with this whole thing, and cannot officially speak for FB. It could also be the case that I am in a A/B test Google is performing, etc. This was just my experience. It fits with Google's stated mechanisms for how Social Circles work.

bluelu 16y ago
Bravo for Facebook not pulling a lame PR stunt like google when they thought Bing would be stealing their results!