4 ms·

I don't necessarily disagree with you, and whether a pixel should be there at all is definitely a discussion in itself. But for those who are implementing FB P

by cosmie 6y ago

I don't necessarily disagree with you, and whether a pixel should be there at all is definitely a discussion in itself. But for those who are implementing FB Pixels, I wanted to put out some potentially useful information that can help protect against unintended data disclosure, after mentioning the auto-listener behavior in a reply to another comment and being met with surprise[1]. [1] https://news.ycombinator.com/item?id=26537078 https://news.ycombinator.com/item?id=26537078

nerdponx 6y ago
Seems like it's designed to make it easy to accidentally send more of your users'/customers' data back to FB than intended. Oopsie!
- azernik 6y ago
  Given their (paying) customer base, which skews more towards content producers, I suspect it's more likely intended to ease setup for less-technically-savvy users. ie they don't really want your truly-security-critical customer data. But if they can boost their conversion rate with sites like dogfoodreviews.com by 5%, and the price is sending backblaze.com's fantastically-sensitive paid customer data into an unsecured data path, they will absolutely do it. Comparable to the absolute havoc that Zoom wreaked on browser security to save one click on starting a call.
  - cosmie 6y ago
    > I suspect it's more likely intended to ease setup for less-technically-savvy users. > ie they don't really want your truly-security-critical customer data. It's both. It eases implementation with a one-and-done snippet, and then slaps a user-friendly GUI on the other side for marketers to sort through the firehose and use what they want. While making it also trivially easy for marketers to toggle a button that OKs the turbo-boost mode that siphons up (hashed) sensitive customer information, which can then be used to claim credit for additional conversions by cross-referencing the (hashed) PII siphoned up against what Facebook has for those exposed to your ads.
- OneLeggedCat 6y ago
  Literally every external privacy setting of fb across its entire business is designed that way.

by cosmie 6y ago

nerdponx 6y ago

Seems like it's designed to make it easy to accidentally send more of your users'/customers' data back to FB than intended. Oopsie!

azernik 6y ago
Given their (paying) customer base, which skews more towards content producers, I suspect it's more likely intended to ease setup for less-technically-savvy users. ie they don't really want your truly-security-critical customer data. But if they can boost their conversion rate with sites like dogfoodreviews.com by 5%, and the price is sending backblaze.com's fantastically-sensitive paid customer data into an unsecured data path, they will absolutely do it. Comparable to the absolute havoc that Zoom wreaked on browser security to save one click on starting a call.
- cosmie 6y ago
  > I suspect it's more likely intended to ease setup for less-technically-savvy users. > ie they don't really want your truly-security-critical customer data. It's both. It eases implementation with a one-and-done snippet, and then slaps a user-friendly GUI on the other side for marketers to sort through the firehose and use what they want. While making it also trivially easy for marketers to toggle a button that OKs the turbo-boost mode that siphons up (hashed) sensitive customer information, which can then be used to claim credit for additional conversions by cross-referencing the (hashed) PII siphoned up against what Facebook has for those exposed to your ads.
OneLeggedCat 6y ago
Literally every external privacy setting of fb across its entire business is designed that way.