5 ms·

Just an FYI in case this isn't clear to people. Even though this is a serious problem, it's super unlikely that FB is using the filenames in any way, or aware t

Just an FYI in case this isn't clear to people. Even though this is a serious problem, it's super unlikely that FB is using the filenames in any way, or aware they were being sent. That part is probably just a (really awful) mistake.

walrus01 6y ago
But you have absolutely no way of knowing for certain.
- mgraczyk 6y ago
  That's not actually true, it's possible to wait and see if FB publishes a statement. If they do, you'll know.
swiley 6y ago
This is the same company that has published iOS apps that have silently escaped the sandbox. I think pathological is probably an appropriate word for them and wouldn't trust anything remotely related to them with a single bit of personal data.
- mgraczyk 6y ago
  Sounds unrelated
  - tzmudzin 6y ago
    Possibly, but company culture transcends the immediate team. And if your business model is based on data siphoned off every possible channel, the concern is very justified.
- exikyut 6y ago
  > silently escaped the sandbox I can has reference? Sounds genuinely interesting, and that info didn't find its way through the rock I'm apparently under.
TheDudeMan 6y ago
> it's super unlikely that FB is using the filenames in any way You mean other than storing them forever?
- mgraczyk 6y ago
  Facebook, like other GDPR compliant companies, deletes most data after 90 days by default. My guess is that this data was not intentionally stored, and any place where it was will be deleted manually within a few days as part of remediation for this issue. Even if that doesn't happen, it would automatically disappear after 90 days.
  - zertrin 6y ago
    How can we know for sure that's actually what happens? Are there audits to check compliance?
    - mgraczyk 6y ago
      Yes, there are: https://www.facebook.com/legal/terms/dataprocessing https://www.facebook.com/legal/terms/dataprocessing
      - matkoniecz 6y ago
        Why I would believe what FB publishes? FB used 2FA phone numbers for spying, after repeatedly promising that they will be not used in this way. See also FB promises about WhatsApp during merger. Is there a truly independent confirmation?
  - justinclift 6y ago
    > Facebook, like other GDPR compliant companies, ... Isn't there a lawsuit or similar going through the EU courts atm about Facebook not really being GDPR compliant? eg They claim they are, but the court case is about them not being.
RobLach 6y ago
I’m unsure if there’s any evidence to support this claim.
akudha 6y ago
super unlikely that FB is using the filenames in any way First, we don't know that. Second, it doesn't matter even if they are not using it in any way. Backblaze shouldn't be sending this data to FB. And lastly, even if FB isn't using it in any way today, how do we know they won't use in future? Nobody should be having access to any data that they don't absolutely need. It doesn't matter how mundane the data is, which company the data is going to, etc etc.
- mgraczyk 6y ago
  It matters a lot. Like I said, it's definitely a problem regardless. But this is like saying it that if you misplace your cell phone, it doesn't matter whether you left it in your friend's car or a taxi. Of course it matters whether or not data is being (mis)used.
- AnonC 6y ago
  More so with all the machine learning code being deployed to gather better information about people to thrust more ads on them, it's possible that even those who work at Facebook may probably not know the extent to which all this data is funneled into various systems and attempts are made to extract monetary value from it.

walrus01 6y ago

But you have absolutely no way of knowing for certain.

mgraczyk 6y ago
That's not actually true, it's possible to wait and see if FB publishes a statement. If they do, you'll know.

swiley 6y ago

This is the same company that has published iOS apps that have silently escaped the sandbox. I think pathological is probably an appropriate word for them and wouldn't trust anything remotely related to them with a single bit of personal data.

mgraczyk 6y ago
Sounds unrelated
- tzmudzin 6y ago
  Possibly, but company culture transcends the immediate team. And if your business model is based on data siphoned off every possible channel, the concern is very justified.
exikyut 6y ago
> silently escaped the sandbox I can has reference? Sounds genuinely interesting, and that info didn't find its way through the rock I'm apparently under.

TheDudeMan 6y ago

> it's super unlikely that FB is using the filenames in any way You mean other than storing them forever?

mgraczyk 6y ago
Facebook, like other GDPR compliant companies, deletes most data after 90 days by default. My guess is that this data was not intentionally stored, and any place where it was will be deleted manually within a few days as part of remediation for this issue. Even if that doesn't happen, it would automatically disappear after 90 days.
- zertrin 6y ago
  How can we know for sure that's actually what happens? Are there audits to check compliance?
  - mgraczyk 6y ago
    Yes, there are: https://www.facebook.com/legal/terms/dataprocessing https://www.facebook.com/legal/terms/dataprocessing
    - matkoniecz 6y ago
      Why I would believe what FB publishes? FB used 2FA phone numbers for spying, after repeatedly promising that they will be not used in this way. See also FB promises about WhatsApp during merger. Is there a truly independent confirmation?
- justinclift 6y ago
  > Facebook, like other GDPR compliant companies, ... Isn't there a lawsuit or similar going through the EU courts atm about Facebook not really being GDPR compliant? eg They claim they are, but the court case is about them not being.

RobLach 6y ago

I’m unsure if there’s any evidence to support this claim.

akudha 6y ago

super unlikely that FB is using the filenames in any way First, we don't know that. Second, it doesn't matter even if they are not using it in any way. Backblaze shouldn't be sending this data to FB. And lastly, even if FB isn't using it in any way today, how do we know they won't use in future? Nobody should be having access to any data that they don't absolutely need. It doesn't matter how mundane the data is, which company the data is going to, etc etc.

mgraczyk 6y ago
It matters a lot. Like I said, it's definitely a problem regardless. But this is like saying it that if you misplace your cell phone, it doesn't matter whether you left it in your friend's car or a taxi. Of course it matters whether or not data is being (mis)used.
AnonC 6y ago
More so with all the machine learning code being deployed to gather better information about people to thrust more ads on them, it's possible that even those who work at Facebook may probably not know the extent to which all this data is funneled into various systems and attempts are made to extract monetary value from it.