7 ms·

This is good info, but Backblaze shouldn't even be using FB pixels to begin with.

KingOfCoders 6y ago
Exactly. When the most important thing for a backup provider is the trust people put in you, don't do anything that risks that trust.
gigatexal 6y ago
Edit: my biases against Facebook keep me from making cogent points.
- mvzvm 6y ago
  This feels like an almost intentional misunderstanding.
  - gigatexal 6y ago
    Pixel tracking on an internal customer page... scanning and uploading metadata about users backups? How much am I misunderstanding?
    - mvzvm 6y ago
      > I guess they can’t afford to cover costs given current prices so they sell customer metadata to Facebook This sentence, your thesis, is absurd. Where does it say they make money from selling data? Furthermore, "I guess they can’t afford to cover costs given current prices" is a really strange foundation to leap from. Do you have any facts? Or are you just speculating on BackBlaze and making wild assumptions? > now that other like-minded crazies can find each other faster than ever You are right, there is nowhere else online where "crazies" gather - not 4chan, not reddit, not voat, not twitter, just Facebook?
      - gigatexal 6y ago
        The last point I’ll admit exposes my bias against Facebook. But the previous two points make no difference on why tracking is baked into an internal portal so I speculated as to the reasoning as anyone would do — it’s not a stretch to think that data owners could sell customer data to an aggregator like Facebook for an additional line item of revenue.
        manigandham 6y ago
        Facebook does not, and never will, pay for data like this.
        mnw21cam 6y ago
        Which raises the question - why would anyone ever include a Facebook tracking pixel in their web page, if it provides no benefits, and has a cost?
        manigandham 6y ago
        > "if it provides no benefits" Because it does? There are valid reasons for using the pixel in advertising.
      - goatinaboat 6y ago
        Where does it say they make money from selling data? What would be their motivation for just giving their customers data to Facebook for free?
        suprfsat 6y ago
        Apparently it's incompetence, if they're unaware that they could have been making money on the deal.
    - deleted 6y ago
      [deleted]
    - busymom0 6y ago
      > I guess they can’t afford to cover costs given current prices This is plain wrong. One of the reasons I was a fan of B2 was their tech and how they achieved such low costs: https://www.backblaze.com/blog/design-thinking-b2-apis-the-hidden-costs-of-s3-compatibility/ https://www.backblaze.com/blog/design-thinking-b2-apis-the-h... https://www.backblaze.com/blog/backblaze-and-cloudflare-partner-to-provide-free-data-transfer/ https://www.backblaze.com/blog/backblaze-and-cloudflare-part... While this FB pixel debacle is obviously a very big screw up, it's pretty much a "screw up" and unintentional from what I understand so far. And they have fixed it already which is a positive step towards redemption. From my speculation - the screw up seems to have happened from including the googletagmanager. They probably only wanted it to stay on the home page of B2 (for ad conversion tracking if I were to guess), not on the dashboard itself after login. The screw up caused it to be on the dashboard too.
cosmie 6y ago
I don't necessarily disagree with you, and whether a pixel should be there at all is definitely a discussion in itself. But for those who are implementing FB Pixels, I wanted to put out some potentially useful information that can help protect against unintended data disclosure, after mentioning the auto-listener behavior in a reply to another comment and being met with surprise[1]. [1] https://news.ycombinator.com/item?id=26537078 https://news.ycombinator.com/item?id=26537078
- nerdponx 6y ago
  Seems like it's designed to make it easy to accidentally send more of your users'/customers' data back to FB than intended. Oopsie!
  - azernik 6y ago
    Given their (paying) customer base, which skews more towards content producers, I suspect it's more likely intended to ease setup for less-technically-savvy users. ie they don't really want your truly-security-critical customer data. But if they can boost their conversion rate with sites like dogfoodreviews.com by 5%, and the price is sending backblaze.com's fantastically-sensitive paid customer data into an unsecured data path, they will absolutely do it. Comparable to the absolute havoc that Zoom wreaked on browser security to save one click on starting a call.
    - cosmie 6y ago
      > I suspect it's more likely intended to ease setup for less-technically-savvy users. > ie they don't really want your truly-security-critical customer data. It's both. It eases implementation with a one-and-done snippet, and then slaps a user-friendly GUI on the other side for marketers to sort through the firehose and use what they want. While making it also trivially easy for marketers to toggle a button that OKs the turbo-boost mode that siphons up (hashed) sensitive customer information, which can then be used to claim credit for additional conversions by cross-referencing the (hashed) PII siphoned up against what Facebook has for those exposed to your ads.
  - 6y ago
mvzvm 6y ago
Why is that? Perhaps they get business value out of it?
- bschwindHN 6y ago
  Won't somebody please think of the business value???
  - manigandham 6y ago
    That's how businesses make decisions.
    - bschwindHN 6y ago
      > Backblaze shouldn't even be using FB pixels to begin with. > Why is that? Perhaps they get business value out of it? Oh, they get value out of invading my privacy? Carry on then!
      - manigandham 6y ago
        Running and measuring ads is one of many things that delivers value to a business, yes. The privacy issue in this case is clearly an implementation mistake and seems to have been resolved. Ignoring the situation and context to make a comical statement doesn't really add anything to the discussion.
        ksec 6y ago
        The overwhelmingly mentality on HN is that All Ads are bad. And all targeting Ads is bad. Because by their definition, All ads are tracking ads. This mentality also fits the current Internet and Twitter narrative. Especially true when it is from Facebook. Which happens to be pure evil on HN, twitter sphere and MainStream Media.
        Nextgrid 6y ago
manigandham 6y ago
Why? Using ads to increase business is completely valid. This issue is data leakage due to an implementation error and has nothing to do with using advertising services from Facebook or other companies.
- deleted 6y ago
  [deleted]
- Nextgrid 6y ago
  There are ways to use ads without violating privacy nor breaking the law (remember that this practice is illegal under the GDPR). Either way, if you must do ad tracking, do so on your homepage. Once the user is logged in and has paid you money for a service there shouldn’t be any ads nor tracking.
  - manigandham 6y ago
    > "without violating privacy" Yes, that's covered by this being a mistake in implementation as I said. > "there shouldn’t be any ads nor tracking" Again, based on what exactly? Finding new users that are similar to your existing customers is a completely valid strategy. Most people in this thread are making wild statements from the typical emotional/outrage driven pile-on when anything happens.
    - Nextgrid 6y ago
      Based on respect, common sense and the GDPR? > Finding new users that are similar to your existing customers is a completely valid strategy. But this can be achieved with tracking in the homepage without embedding trackers in the actual product right next to sensitive data? > Most people in this thread are making wild statements from the typical emotional/outrage driven pile-on when anything happens. This doesn't make these statements any less valid though? Most people are indeed outraged that a paid professional product is ratting them out to Facebook which makes total sense as nobody would've expected that.
      - 6y ago

Exactly. When the most important thing for a backup provider is the trust people put in you, don't do anything that risks that trust.

gigatexal 6y ago

Edit: my biases against Facebook keep me from making cogent points.

mvzvm 6y ago
This feels like an almost intentional misunderstanding.
- gigatexal 6y ago
  Pixel tracking on an internal customer page... scanning and uploading metadata about users backups? How much am I misunderstanding?
  - mvzvm 6y ago
    > I guess they can’t afford to cover costs given current prices so they sell customer metadata to Facebook This sentence, your thesis, is absurd. Where does it say they make money from selling data? Furthermore, "I guess they can’t afford to cover costs given current prices" is a really strange foundation to leap from. Do you have any facts? Or are you just speculating on BackBlaze and making wild assumptions? > now that other like-minded crazies can find each other faster than ever You are right, there is nowhere else online where "crazies" gather - not 4chan, not reddit, not voat, not twitter, just Facebook?
    - gigatexal 6y ago
      The last point I’ll admit exposes my bias against Facebook. But the previous two points make no difference on why tracking is baked into an internal portal so I speculated as to the reasoning as anyone would do — it’s not a stretch to think that data owners could sell customer data to an aggregator like Facebook for an additional line item of revenue.
      - manigandham 6y ago
        Facebook does not, and never will, pay for data like this.
        mnw21cam 6y ago
        Which raises the question - why would anyone ever include a Facebook tracking pixel in their web page, if it provides no benefits, and has a cost?
        manigandham 6y ago
        > "if it provides no benefits" Because it does? There are valid reasons for using the pixel in advertising.
    - goatinaboat 6y ago
      Where does it say they make money from selling data? What would be their motivation for just giving their customers data to Facebook for free?
      - suprfsat 6y ago
        Apparently it's incompetence, if they're unaware that they could have been making money on the deal.
  - deleted 6y ago
    [deleted]
  - busymom0 6y ago
    > I guess they can’t afford to cover costs given current prices This is plain wrong. One of the reasons I was a fan of B2 was their tech and how they achieved such low costs: https://www.backblaze.com/blog/design-thinking-b2-apis-the-hidden-costs-of-s3-compatibility/ https://www.backblaze.com/blog/design-thinking-b2-apis-the-h... https://www.backblaze.com/blog/backblaze-and-cloudflare-partner-to-provide-free-data-transfer/ https://www.backblaze.com/blog/backblaze-and-cloudflare-part... While this FB pixel debacle is obviously a very big screw up, it's pretty much a "screw up" and unintentional from what I understand so far. And they have fixed it already which is a positive step towards redemption. From my speculation - the screw up seems to have happened from including the googletagmanager. They probably only wanted it to stay on the home page of B2 (for ad conversion tracking if I were to guess), not on the dashboard itself after login. The screw up caused it to be on the dashboard too.

cosmie 6y ago

I don't necessarily disagree with you, and whether a pixel should be there at all is definitely a discussion in itself. But for those who are implementing FB Pixels, I wanted to put out some potentially useful information that can help protect against unintended data disclosure, after mentioning the auto-listener behavior in a reply to another comment and being met with surprise[1]. [1] https://news.ycombinator.com/item?id=26537078 https://news.ycombinator.com/item?id=26537078

nerdponx 6y ago
Seems like it's designed to make it easy to accidentally send more of your users'/customers' data back to FB than intended. Oopsie!
- azernik 6y ago
  Given their (paying) customer base, which skews more towards content producers, I suspect it's more likely intended to ease setup for less-technically-savvy users. ie they don't really want your truly-security-critical customer data. But if they can boost their conversion rate with sites like dogfoodreviews.com by 5%, and the price is sending backblaze.com's fantastically-sensitive paid customer data into an unsecured data path, they will absolutely do it. Comparable to the absolute havoc that Zoom wreaked on browser security to save one click on starting a call.
  - cosmie 6y ago
    > I suspect it's more likely intended to ease setup for less-technically-savvy users. > ie they don't really want your truly-security-critical customer data. It's both. It eases implementation with a one-and-done snippet, and then slaps a user-friendly GUI on the other side for marketers to sort through the firehose and use what they want. While making it also trivially easy for marketers to toggle a button that OKs the turbo-boost mode that siphons up (hashed) sensitive customer information, which can then be used to claim credit for additional conversions by cross-referencing the (hashed) PII siphoned up against what Facebook has for those exposed to your ads.
- 6y ago

mvzvm 6y ago

Why is that? Perhaps they get business value out of it?

bschwindHN 6y ago
Won't somebody please think of the business value???
- manigandham 6y ago
  That's how businesses make decisions.
  - bschwindHN 6y ago
    > Backblaze shouldn't even be using FB pixels to begin with. > Why is that? Perhaps they get business value out of it? Oh, they get value out of invading my privacy? Carry on then!
    - manigandham 6y ago
      Running and measuring ads is one of many things that delivers value to a business, yes. The privacy issue in this case is clearly an implementation mistake and seems to have been resolved. Ignoring the situation and context to make a comical statement doesn't really add anything to the discussion.
      - ksec 6y ago
        The overwhelmingly mentality on HN is that All Ads are bad. And all targeting Ads is bad. Because by their definition, All ads are tracking ads. This mentality also fits the current Internet and Twitter narrative. Especially true when it is from Facebook. Which happens to be pure evil on HN, twitter sphere and MainStream Media.
        Nextgrid 6y ago

manigandham 6y ago

Why? Using ads to increase business is completely valid. This issue is data leakage due to an implementation error and has nothing to do with using advertising services from Facebook or other companies.

deleted 6y ago
[deleted]
Nextgrid 6y ago
There are ways to use ads without violating privacy nor breaking the law (remember that this practice is illegal under the GDPR). Either way, if you must do ad tracking, do so on your homepage. Once the user is logged in and has paid you money for a service there shouldn’t be any ads nor tracking.
- manigandham 6y ago
  > "without violating privacy" Yes, that's covered by this being a mistake in implementation as I said. > "there shouldn’t be any ads nor tracking" Again, based on what exactly? Finding new users that are similar to your existing customers is a completely valid strategy. Most people in this thread are making wild statements from the typical emotional/outrage driven pile-on when anything happens.
  - Nextgrid 6y ago
    Based on respect, common sense and the GDPR? > Finding new users that are similar to your existing customers is a completely valid strategy. But this can be achieved with tracking in the homepage without embedding trackers in the actual product right next to sensitive data? > Most people in this thread are making wild statements from the typical emotional/outrage driven pile-on when anything happens. This doesn't make these statements any less valid though? Most people are indeed outraged that a paid professional product is ratting them out to Facebook which makes total sense as nobody would've expected that.
    - 6y ago