5 ms·

This is the result of open APIs. It shows why web sites like Facebook have to close them down. They are not worth it, they are a liability.

by bzb6 6y ago

Nextgrid 6y ago
Disagreed - this is the result of stupid users. If the APIs are gone they will just be entering their Facebook credentials directly (which would leak way more data than what relatively limited API access allows).
- deleted 6y ago
  [deleted]
- pratio 6y ago
  I think its a bit harsh to call users stupid. When we move away from HN, we realize how teach naive a layman can be. We haven't seen something of this sort happen at this scale happen many times before. A lot of efforts are going into privacy now, way more than before.
- bzb6 6y ago
  Obviously it’s the result of stupid users, but you can get rid of the APIs, you can’t get rid of the stupid users.
  - jwolfe 6y ago
    If you get rid of the API it will just happen through malicious Chrome extensions instead. I guess that's an improvement in practical impact. Will the next argument be that browsers shouldn't be extensible, because it's a liability with stupid users?
- JKCalhoun 6y ago
  I may be mistaken, but I understood that "stupid users" allowed access to their friends/contacts as well. I guess I'm stupid too if I have a stupid friend or relative.
  - bzb6 6y ago
    If your friend has view access to your profile, why shouldn’t he be able to extract that information via an API as well?
    - ceejayoz 6y ago
      For the same reason visiting my house doesn't mean they can steal the silverware?
      - lordnacho 6y ago
        Silverware isn't information though. This is more like inviting your friend over and then they tell someone the floor plan of your house.
      - lupire 6y ago
        Nothing was stolen. People visiting your allows are allowed to remember and say that your silverware exists, unless they sign an NDA.
      - deleted 6y ago
        [deleted]
      - delecti 6y ago
        More like: just because someone can visit my house doesn't mean I'd be okay with them walking around video recording everything in sight.
    - PeterisP 6y ago
      Someone who has view access to my profile may view my data, and they might also extract that information with API - however, they do not have any right to give permission on my behalf to someone else (e.g. Cambridge Analytica), that would require a power of attorney or something like that. My friend might technically send that information to Cambridge Analytica, but my friend can't give them permission to use it, CA would be required to acknowledge that they don't have the legal permission to use that data and discard it. My friend can tell Facebook "I permit you to give that information to Cambridge Analytica" but Facebook is not allowed to act based on that "permission" since it's not something my friend can permit.
- Cthulhu_ 6y ago
  People ARE stupid, this is a known fact; this is one reason why consumer and privacy protection laws are a thing, why two-factor authentication is a thing, why e-mail verification of logins is a thing, why you can't just start trading in stocks, buy alcohol, etc etc etc. Companies protect their users from themselves; they HAVE to, in case they (the users) shoot themselves in the foot. And consumer have a reasonable expectation, regardless of Facebook's terms & conditions, that their data isn't shared to third parties - or that they at least get asked when it happens, instead of being pointed to a tl;dr of T's & C's. Plenty of people do not have the literacy level to understand terms and conditions [1]. This is a worrying trend, but it's something that companies like Facebook should (and are) aware of - people don't read terms and conditions, people don't understand them. [1] https://literacytrust.org.uk/parents-and-families/adult-literacy/ https://literacytrust.org.uk/parents-and-families/adult-lite...
lm28469 6y ago
If you drive a car at 350kph on the highway, crash and die. Your death isn't due to "open roads", it's due to neglect/abuse
- syshum 6y ago
  Roads are not really open, there is a ton a regulations around roads, what kind of cars can be sold for public road use and who can utilize the public road ways as a driver so your analogy fails on its face there. besides that fact, we also do not sue a Car manufacturer if a User of their car does go 350kph on the highway' crashes and dies.....
  - lm28469 6y ago
    > there is a ton a regulations around roads, what kind of cars can be sold for public road use and who can utilize the public road ways as a driver so your analogy fails on its face there. "open" api doesn't mean "do whatever you want", you're kind of making my point and the point of the article. There is nothing bad about Facebook going to court over that. This isn't the result of open api, it's the result of badly designed and badly regulated open api.

This is the result of open APIs. It shows why web sites like Facebook have to close them down. They are not worth it, they are a liability.

by bzb6 6y ago

This is the result of open APIs. It shows why web sites like Facebook have to close them down. They are not worth it, they are a liability.

Nextgrid 6y ago

Disagreed - this is the result of stupid users. If the APIs are gone they will just be entering their Facebook credentials directly (which would leak way more data than what relatively limited API access allows).

deleted 6y ago
[deleted]
pratio 6y ago
I think its a bit harsh to call users stupid. When we move away from HN, we realize how teach naive a layman can be. We haven't seen something of this sort happen at this scale happen many times before. A lot of efforts are going into privacy now, way more than before.
bzb6 6y ago
Obviously it’s the result of stupid users, but you can get rid of the APIs, you can’t get rid of the stupid users.
- jwolfe 6y ago
  If you get rid of the API it will just happen through malicious Chrome extensions instead. I guess that's an improvement in practical impact. Will the next argument be that browsers shouldn't be extensible, because it's a liability with stupid users?
JKCalhoun 6y ago
I may be mistaken, but I understood that "stupid users" allowed access to their friends/contacts as well. I guess I'm stupid too if I have a stupid friend or relative.
- bzb6 6y ago
  If your friend has view access to your profile, why shouldn’t he be able to extract that information via an API as well?
  - ceejayoz 6y ago
    For the same reason visiting my house doesn't mean they can steal the silverware?
    - lordnacho 6y ago
      Silverware isn't information though. This is more like inviting your friend over and then they tell someone the floor plan of your house.
    - lupire 6y ago
      Nothing was stolen. People visiting your allows are allowed to remember and say that your silverware exists, unless they sign an NDA.
    - deleted 6y ago
      [deleted]
    - delecti 6y ago
      More like: just because someone can visit my house doesn't mean I'd be okay with them walking around video recording everything in sight.
  - PeterisP 6y ago
    Someone who has view access to my profile may view my data, and they might also extract that information with API - however, they do not have any right to give permission on my behalf to someone else (e.g. Cambridge Analytica), that would require a power of attorney or something like that. My friend might technically send that information to Cambridge Analytica, but my friend can't give them permission to use it, CA would be required to acknowledge that they don't have the legal permission to use that data and discard it. My friend can tell Facebook "I permit you to give that information to Cambridge Analytica" but Facebook is not allowed to act based on that "permission" since it's not something my friend can permit.
Cthulhu_ 6y ago
People ARE stupid, this is a known fact; this is one reason why consumer and privacy protection laws are a thing, why two-factor authentication is a thing, why e-mail verification of logins is a thing, why you can't just start trading in stocks, buy alcohol, etc etc etc. Companies protect their users from themselves; they HAVE to, in case they (the users) shoot themselves in the foot. And consumer have a reasonable expectation, regardless of Facebook's terms & conditions, that their data isn't shared to third parties - or that they at least get asked when it happens, instead of being pointed to a tl;dr of T's & C's. Plenty of people do not have the literacy level to understand terms and conditions [1]. This is a worrying trend, but it's something that companies like Facebook should (and are) aware of - people don't read terms and conditions, people don't understand them. [1] https://literacytrust.org.uk/parents-and-families/adult-literacy/ https://literacytrust.org.uk/parents-and-families/adult-lite...

lm28469 6y ago

If you drive a car at 350kph on the highway, crash and die. Your death isn't due to "open roads", it's due to neglect/abuse

syshum 6y ago
Roads are not really open, there is a ton a regulations around roads, what kind of cars can be sold for public road use and who can utilize the public road ways as a driver so your analogy fails on its face there. besides that fact, we also do not sue a Car manufacturer if a User of their car does go 350kph on the highway' crashes and dies.....
- lm28469 6y ago
  > there is a ton a regulations around roads, what kind of cars can be sold for public road use and who can utilize the public road ways as a driver so your analogy fails on its face there. "open" api doesn't mean "do whatever you want", you're kind of making my point and the point of the article. There is nothing bad about Facebook going to court over that. This isn't the result of open api, it's the result of badly designed and badly regulated open api.