5 ms·

> and then test/monitor what is being sent back to the third party. Trust, but verify. Especially FB. I see a lot of comments about a paid service using track

> and then test/monitor what is being sent back to the third party. Trust, but verify. Especially FB. I see a lot of comments about a paid service using tracking pixels. I understand the backlash but this is also how companies that are taking your hard earned money improve and iterate on their products. I know people don’t like tracking but usage analytics are invaluable to improving the product. There’s only so much customer engagement you can do, and often that leaves really unexpected outcomes in the dark (if you asked most customers, they’d ask for a faster horse). The issue here is that Backblaze injected untrusted code into their core product which by its very nature is extremely sensitive. I’m not really sure what they were thinking. Rolling your own tracking is a pain, but some security contexts demand it.

skinkestek 6y ago
> Trust, but verify. Especially FB. In the particular case of Facebook many of us simplify to "don't trust if not absolutely necessary" ;-)
- happymellon 6y ago
  I removed all Facebook many years ago. In the particular case of Facebook many of us simplify to "don't trust" There is no upside for Facebook to have anything about me.
  - qubex 6y ago
    Unfortunately Facebook has lots of information about you whether you have an account or not. You’re a big black hole with known characteristics inferred from those acquaintances of yours who interact with you in a manner Facebook can track. You might not have a name and an account, but there’s a big you-shaped golem in their data and there’s absolutely nothing you can do about it, unfortunately, and they’ll use it as they see fit with or without your consent.
    - happymellon 6y ago
      Completely agree. I block Facebook at the router but I can't stop other people giving away my PII. But I do make choices where I can.
    - ljm 6y ago
      Makes me think of that Junji Ito comic with the person-shaped holes in the rock after an earthquake. Only now, it's an allegory for social media giants and their corrupting influence on the people they lure into their system.
    - sofixa 6y ago
      You can I'd you live in a jurisdiction which gives you the right to demand for all information a company has on you, and the right to be forgotten ( GDPR in the EU, maybe California as well?)
- bigiain 6y ago
  I totally trust Facebook. To fuck me over at every possible opportunity, even if they’ve pinky promised “we’d never do that!”. Because they have a track record of doing exactly that.
  - qubex 6y ago
    ‘Trust’ is defined as wilful forbearance toward those agencies that we can conceive of as being sources of harm to us. If you “trust Facebook to fuck [you] over” then you’re not trusting Facebook. You’re expecting Facebook to fuck you over and minimising your exposure to that process.
    - mnw21cam 6y ago
      If you ask a computing security (or indeed any security) professional, "trust" has a different definition. If A trusts B, then B has the capability of doing something bad to A. This is regardless of whether A has granted B that capability. So, when you drive down the road, you trust the oncoming car not to swerve into your path and crash into you. This is just another way of saying that the oncoming car has the capability to swerve into your path and crash into you. There's no wilful forbearance involved.
      - qubex 6y ago
        I disagree insofar as the scenarios you describe (implicit trust in computer security, trust that another driver won’t swerve into your vehicle’s path) are perfectly good examples of the overall definition I posited above. Indeed, if one didn’t have forbearance of (say) a software vendor or perhaps a dependency then one would be entirely free to not use that vendor’s product or that particular package. Similarly, if you don’t swerve right to prudentially make space for an approaching vehicle to serve into your path then you’re showing them forbearance and trusting them (or swerve left, depending on one’s location on the Earth what side of the road is legally mandate). So, yep: those are perfect examples of Trust as embodied in the definition I presented above. And of course it lies at the root of initiatives such as Trusted Computing Initiative & cetera.
- qubex 6y ago
  A necessary evil is no less evil merely because it is necessary.
happymellon 6y ago
> I know people don’t like tracking but usage analytics are invaluable to improving the product. I wasn't aware that Facebook offered a Google Analytics style service, I was only aware of the Facebook Analytics for your Facebook page. Can you provide links to this service, as my Google-fu doesn't return anything.
- wildy 6y ago
  Is it not this? https://www.facebook.com/business/learn/facebook-ads-pixel https://www.facebook.com/business/learn/facebook-ads-pixel
  - happymellon 6y ago
    Could be, I wouldn't touch a Facebook property to test it, but the description implies this is all advertising tracking rather than usage analytics.
borispavlovic 6y ago
Fine, then use Matomo (https://matomo.org/ https://matomo.org/) which even offers a free tier.
tiborsaas 6y ago
> I’m not really sure what they were thinking. My guess would be that developers installed a single Google Tag Manager script and left the tracking to the marketing/analytics team. From that point they manage what third party scripts are added to the site, not engineers. This situation cases a tunnel vision which can unfortunately lead to situations like this.
goatinaboat 6y ago
this is also how companies that are taking your hard earned money improve and iterate on their products. What analytics do you think they can do using Facebook that they cannot do from their own httpd access logs, a technology that's 30 years old at this point?
- dnzm 6y ago
  Or, if that is not sufficient, one of the increasing number of ethical and/or self-hosted services, like Plausible? There is no need whatsoever to ship this kind of data to an outside party.
stefan_ 6y ago
Facebook doesn't make an usage analytics service. And I really, really doubt 99.9% of the people using these abundance of tracking services ever discover any worthwhile corner cases you extol their virtues for. "Analytics" is just the 2000 word for "Reporting" - clueless middlemanagers demand shiny graphics.
deadbytes 6y ago
Tracking is not ethical. Corporations only get away with it because most users don't realise it's even happening. If you went into a retail store and an employee followed you around the whole time with a notebook and stopwatch writing down everywhere you walked and every product you looked at, you would rightly be creeped the fuck out and tell him to stop. This is exactly what online tracking is, but done virtually.
- sbarre 6y ago
  > If you went into a retail store and an employee followed you around the whole time with a notebook and stopwatch writing down everywhere you walked and every product you looked at I hate to break it to you, but retail companies are doing this today using security camera footage, to figure out what parts of the store customers start at, or spend the most time in..
  - prirun 6y ago
    They're also doing it with Bluetooth beacons / pings, explaining why every store has an app they want you to install: https://www.nytimes.com/interactive/2019/06/14/opinion/bluetooth-wireless-tracking-privacy.html https://www.nytimes.com/interactive/2019/06/14/opinion/bluet...
  - PeterisP 6y ago
    This is one of key applications of GDPR in Europe - the fact that you can collect data for one purpose (e.g. security cameras) does not necessarily imply that you're permitted to use the same data for any other purpose (e.g. marketing analysis of customer movements). For the former purpose, it would generally be sufficient to inform visitors with a sign on the entrance with legitimate interest clause; for the latter example IMHO the only practical compliant solution would require anonymization of the data, so you could make and store density data iff you don't have any way to tie them back to customer identities including the purchases they made, which is a key difference from the facebook example, which (as far as I understand) uses unique IDs to link the conversions to specific FB accounts.
- charcircuit 6y ago
fabbari 6y ago
Pet peeve of mine: "Trust but verify" is an oxymoron. If you "trust" someone/something you don't need to verify. I understand the sentiment, but it's based on a faulty assumption that trust is a binary state. It's most exemplary case is the use done by the security teams in most IT shops: "Yes, we did put endpoint protection on your laptop, it's not that we don't trust you -- but you know what they say...". I wish they would simply say:"Of course we don't trust you, not on this. You are going to click on that shady link or download and run random executables from the interwebs. But we do trust you're good at your job".
- PeterisP 6y ago
  The historical usage of the saying "trust but verify" is that the verification happens after they had the chance to do the thing (possibly badly), as opposed to mistrust where you'd verify everything that they'd do before allowing the thing to be done. It's essentially "audits instead of pre-approval".

skinkestek 6y ago

> Trust, but verify. Especially FB. In the particular case of Facebook many of us simplify to "don't trust if not absolutely necessary" ;-)

happymellon 6y ago
I removed all Facebook many years ago. In the particular case of Facebook many of us simplify to "don't trust" There is no upside for Facebook to have anything about me.
- qubex 6y ago
  Unfortunately Facebook has lots of information about you whether you have an account or not. You’re a big black hole with known characteristics inferred from those acquaintances of yours who interact with you in a manner Facebook can track. You might not have a name and an account, but there’s a big you-shaped golem in their data and there’s absolutely nothing you can do about it, unfortunately, and they’ll use it as they see fit with or without your consent.
  - happymellon 6y ago
    Completely agree. I block Facebook at the router but I can't stop other people giving away my PII. But I do make choices where I can.
  - ljm 6y ago
    Makes me think of that Junji Ito comic with the person-shaped holes in the rock after an earthquake. Only now, it's an allegory for social media giants and their corrupting influence on the people they lure into their system.
  - sofixa 6y ago
    You can I'd you live in a jurisdiction which gives you the right to demand for all information a company has on you, and the right to be forgotten ( GDPR in the EU, maybe California as well?)
bigiain 6y ago
I totally trust Facebook. To fuck me over at every possible opportunity, even if they’ve pinky promised “we’d never do that!”. Because they have a track record of doing exactly that.
- qubex 6y ago
  ‘Trust’ is defined as wilful forbearance toward those agencies that we can conceive of as being sources of harm to us. If you “trust Facebook to fuck [you] over” then you’re not trusting Facebook. You’re expecting Facebook to fuck you over and minimising your exposure to that process.
  - mnw21cam 6y ago
    If you ask a computing security (or indeed any security) professional, "trust" has a different definition. If A trusts B, then B has the capability of doing something bad to A. This is regardless of whether A has granted B that capability. So, when you drive down the road, you trust the oncoming car not to swerve into your path and crash into you. This is just another way of saying that the oncoming car has the capability to swerve into your path and crash into you. There's no wilful forbearance involved.
    - qubex 6y ago
      I disagree insofar as the scenarios you describe (implicit trust in computer security, trust that another driver won’t swerve into your vehicle’s path) are perfectly good examples of the overall definition I posited above. Indeed, if one didn’t have forbearance of (say) a software vendor or perhaps a dependency then one would be entirely free to not use that vendor’s product or that particular package. Similarly, if you don’t swerve right to prudentially make space for an approaching vehicle to serve into your path then you’re showing them forbearance and trusting them (or swerve left, depending on one’s location on the Earth what side of the road is legally mandate). So, yep: those are perfect examples of Trust as embodied in the definition I presented above. And of course it lies at the root of initiatives such as Trusted Computing Initiative & cetera.
qubex 6y ago
A necessary evil is no less evil merely because it is necessary.

happymellon 6y ago

> I know people don’t like tracking but usage analytics are invaluable to improving the product. I wasn't aware that Facebook offered a Google Analytics style service, I was only aware of the Facebook Analytics for your Facebook page. Can you provide links to this service, as my Google-fu doesn't return anything.

wildy 6y ago
Is it not this? https://www.facebook.com/business/learn/facebook-ads-pixel https://www.facebook.com/business/learn/facebook-ads-pixel
- happymellon 6y ago
  Could be, I wouldn't touch a Facebook property to test it, but the description implies this is all advertising tracking rather than usage analytics.

borispavlovic 6y ago

Fine, then use Matomo (https://matomo.org/ https://matomo.org/) which even offers a free tier.

tiborsaas 6y ago

> I’m not really sure what they were thinking. My guess would be that developers installed a single Google Tag Manager script and left the tracking to the marketing/analytics team. From that point they manage what third party scripts are added to the site, not engineers. This situation cases a tunnel vision which can unfortunately lead to situations like this.

goatinaboat 6y ago

this is also how companies that are taking your hard earned money improve and iterate on their products. What analytics do you think they can do using Facebook that they cannot do from their own httpd access logs, a technology that's 30 years old at this point?

dnzm 6y ago
Or, if that is not sufficient, one of the increasing number of ethical and/or self-hosted services, like Plausible? There is no need whatsoever to ship this kind of data to an outside party.

stefan_ 6y ago

Facebook doesn't make an usage analytics service. And I really, really doubt 99.9% of the people using these abundance of tracking services ever discover any worthwhile corner cases you extol their virtues for. "Analytics" is just the 2000 word for "Reporting" - clueless middlemanagers demand shiny graphics.

deadbytes 6y ago

Tracking is not ethical. Corporations only get away with it because most users don't realise it's even happening. If you went into a retail store and an employee followed you around the whole time with a notebook and stopwatch writing down everywhere you walked and every product you looked at, you would rightly be creeped the fuck out and tell him to stop. This is exactly what online tracking is, but done virtually.

sbarre 6y ago
> If you went into a retail store and an employee followed you around the whole time with a notebook and stopwatch writing down everywhere you walked and every product you looked at I hate to break it to you, but retail companies are doing this today using security camera footage, to figure out what parts of the store customers start at, or spend the most time in..
- prirun 6y ago
  They're also doing it with Bluetooth beacons / pings, explaining why every store has an app they want you to install: https://www.nytimes.com/interactive/2019/06/14/opinion/bluetooth-wireless-tracking-privacy.html https://www.nytimes.com/interactive/2019/06/14/opinion/bluet...
- PeterisP 6y ago
  This is one of key applications of GDPR in Europe - the fact that you can collect data for one purpose (e.g. security cameras) does not necessarily imply that you're permitted to use the same data for any other purpose (e.g. marketing analysis of customer movements). For the former purpose, it would generally be sufficient to inform visitors with a sign on the entrance with legitimate interest clause; for the latter example IMHO the only practical compliant solution would require anonymization of the data, so you could make and store density data iff you don't have any way to tie them back to customer identities including the purchases they made, which is a key difference from the facebook example, which (as far as I understand) uses unique IDs to link the conversions to specific FB accounts.
charcircuit 6y ago

fabbari 6y ago

Pet peeve of mine: "Trust but verify" is an oxymoron. If you "trust" someone/something you don't need to verify. I understand the sentiment, but it's based on a faulty assumption that trust is a binary state. It's most exemplary case is the use done by the security teams in most IT shops: "Yes, we did put endpoint protection on your laptop, it's not that we don't trust you -- but you know what they say...". I wish they would simply say:"Of course we don't trust you, not on this. You are going to click on that shady link or download and run random executables from the interwebs. But we do trust you're good at your job".

PeterisP 6y ago
The historical usage of the saying "trust but verify" is that the verification happens after they had the chance to do the thing (possibly badly), as opposed to mistrust where you'd verify everything that they'd do before allowing the thing to be done. It's essentially "audits instead of pre-approval".