5 ms·

Look, my goal here is not to be an apologist for Facebook, a company that I told in my exit interview that I would not consider joining them again (for entirely

Look, my goal here is not to be an apologist for Facebook, a company that I told in my exit interview that I would not consider joining them again (for entirely different reasons). Nor do I want to be convincing anyone that they're wrong. In fact, in some ways you are right. But at the same time, realize that Facebook is not some giant monolith. These are thousands of teams, working in a highly bottoms-up, impact-oriented culture. I read a comment earlier about engineering at scale and how it's a people problem - that's 100% it. People are not infallible, they make mistakes. What I did not see during my tenure there is any malicious intent, people genuinely wanted to build a valuable product and make broken stuff better. Again, my localized experience only. From what I recall (could be wrong here, not first-hand knowledge), the SMS thing was a decision made by a single team ages ago, before privacy was at the forefront. It was a bad decision, but ultimately a technical detail lost in a sea of other technical details. The solution being worked on presently is a systemic one, that ideally would prevent this sort of thing in the future (though the realist in me is skeptical).

teachingassist 6y ago
> From what I recall (could be wrong here, not first-hand knowledge), the SMS thing was a decision made by a single team ages ago I have worked in a tiny charitable organisation, where it was easily understood that if we collected user telephone numbers, there would be constant pressure to use them for other purposes. And, therefore, that we didn't have the capacity to honestly and securely promise to users that we and our future replacements would use them only for one purpose. This is not a failure of one team "before privacy was at the forefront" (when?). It's a systemic failure of multiple teams and of Facebook's culture of constant privacy infringement and misdirection. That this implicit promise to users was made so lightly and not considered important enough to follow through on. As such, it's a breach of contract which I hope is picked up legally.
- bertil 6y ago
  > This is not a failure of one team "before privacy was at the forefront" (when?). If that was not a rhetorical question (and I suspect it was) from 2006 to 2016, the main concern around Facebook was monopolies and interoperability. I would know because that was the topic of my PhD. Many people argued for either open protocols (Stratechery regularly, TechDirt did a big piece about it a year ago, WaitButWhy several years ago too) that would allow individuals to extract their social graph (a list of their friends, or information about them) from one service to find them on another service, hoping that this would lower the influence of a single service. It’s graph-sharing tools like those that were key in all the recent “scandals” about the company, often simultaneously blaming Facebook for both not preventing other services from exporting information and being “a roach motel” where information never leaves (per Cory Doctorow). One particular step involved here, the ability to find friends on Facebook is part of a common priority at Facebook: “growth”. Many people see it as a blind, profit-seeking effort. It’s actually motivated by altruistic means. Outside of the young, educated, technology-savvy classes of the Western World (where most people who could benefit from social tools already know how to use them) having contacts to more friends remains a major positive thing. It’s rarely financially beneficial for Facebook on the short-term to encourage that because it triggers cost without matching advertising revenue (most of the ad sales are still in the US, and to a lesser extend, Europe). “Growth” has lead to several misguided effort, or clumsy attempts (typically: People-you-may-know) but it’s not the rabid unbridled capitalist effort that opponents outside the company like to paint. It was often the primary objective of several teams, outside of interoperability, that contributed to parts of complex systems that ended up being abused later. One final aspect that the original comment might not have clarified is that those tools are often poorly known, even internally; they can be years old and still hidden after people who built them and are familiar with potential abuse vectors have gone. Many people build other tools that can, in combination, lead to bad things, without knowing what’s there. The team who build the infamous year-in-review (one guy really) was trying to demonstrate how to share several posts. He was surprised when it was massively adopted, and more so when it was promoted, without consulting him. The people who tried to raise that tool were curious about another question, nostalgia and the relevance of past posts. It lead to one person famously having to re-visit the grief of loosing his mother because no one consulted the team in charge of writing empathic messages. The priority then was not to squander good ideas with committees and encourage every idea, including privacy-preserving projects, and many empathy-defending ones too. I can personally confirm that many projects defending both (privacy and empathy) still massively popular today would not have been released without that third priority of letting individual employees try things without over-burdening supervision. Until 2016, privacy was not a priority, but a non-negotiable primary absolute. It was enforced by the code (literally: the site is written in Hack, a version of PhP that has access-control hard-coded). Users could not see information they were not supposed to (say, a comment by an ex that had blocked them on a post by a shared friend) because of those hard-coded controls. It was understood to the most that company could do. Confusing situations challenged that absolutist view (like users volunteering whose pages their friends were fans of, something they could legitimately see, through an API, for financial gain) and privacy became not just an absolute condition of any work (that was easy to ignore because pushed one layer of abstraction down) but also a more nuanced approach that required conscious, expensive and sometimes frustrating war-gaming “leaks” through complex adversarial scenarios. Because of that new priority, Facebook closed a lot of old APIs then, to the dismay of many researchers using those to analyse the company, its practices, including privacy and monopoly position. > It's a systemic failure of multiple teams and of Facebook's culture of constant privacy infringement and misdirection. No.
FabHK 6y ago
> What I did not see during my tenure there is any malicious intent, people genuinely wanted to build a valuable product and make broken stuff better. But the argument is not that the many individual well intentioned engineers at Facebook (or even Zuckerberg himself) set out maliciously to create a monster; but rather that the confluence of new technology, human nature, incentives, advertisement, tracking etc. has resulted in something that has many negative consequences (which might exceed the positives); and of which they profit very handsomely.
danShumway 6y ago
> But at the same time, realize that Facebook is not some giant monolith. These are thousands of teams, working in a highly bottoms-up, impact-oriented culture. Okay, but let's cycle back around to your original point. A bottoms-up culture in which mistakes like this can happen is not a culture that is responsible enough to hold information like my phone number, address, credit card information, etc... It's not competent enough to manage a voice assistant, or to have access to my contacts. We're kind of dancing around the original poster's confusion, which was: > "On the one hand I picture a classic clueless business people driven culture driving poor demotivated engineers and so stuff like the latest hack happen." > "But then, I see this other picture where teams of quite functional teams are doing good engineering." But you're not reconciling those pictures. You're trying to paint a picture of a good organization that means well and that is constantly getting better, but that also makes giant mistakes like misusing data and breaking data silos because it's too large to manage and because the culture encourages playing fast-and-loose with data. The question is, when Facebook starts collecting IDs to validate accounts, when Facebook starts releasing voice assistants, or trying to launch a currency, how can we confidently say that these mistakes won't keep happening? Because to just say "people aren't infallible" isn't enough when talking about an organization that wants this kind of power and insight into everyone's information. ---- So here's how I reconcile those pictures: Facebook has talented people employed who like to believe they're doing the right things. But they're not willing to take this seriously or to really think about the impact of their products. Facebook is not holding off on collecting data because they're worried they might leak it. Facebook is asking people to verify information, they want your cell phone number, they're collecting PII on people who don't even have accounts. They want people to send money over their chat app, and to talk to businesses using their platform, and to schedule events, and to link their contacts, and send their location. They want basically all of the data, and none of these leaks has changed their attitude towards data collection. So I don't think Facebook is incompetent, I think it's about average just like most other businesses, but the difference is that it wants to be seen as a highly competent, infallible company that's worthy of unprecedented access into people's lives until something goes wrong. Then, once everyone's phone number is leaked, it falls back on the "pobudies nefect" card, just like it already has so many times before. And I think that's a big source of anger, because it's hard to look at that behavior without coming away with the idea that the company is either malicious or just grossly irresponsible. No, they're not malicious in the sense that they literally want to leak your information, but they're clearly not losing sleep over the fact that they're putting your information at risk, even though they've demonstrated over and over again that they can't keep it secure. I don't know what a good word for that is. If not "malicous", maybe "callous" or "uncaring"? Facebook is a group of average-to-talented developers and managers who are nevertheless unwilling to take the steps necessary to actually protect my data, and they're actively hostile to me keeping my data from them (remember, phone numbers were leaked here from accounts that had been deleted, from people who had signaled that they did not want Facebook to have that information any more). So maybe Facebook devs "care" in the abstract sense, but they don't appear to care in any of the practical ways that really matter. And I'm just so tired of people telling me that the culture at Facebook is changing when it is so clearly not changing. Facebook devs have been saying the same thing to me after every controversy for over a decade at this point. I'm excited that we're no longer experimenting on depressed teens, and now we've graduated to leaking every single phone number online, trying to cover it up, and then claiming to press that it's not a real leak. Maybe in another 10 years we'll only be misrepresenting impression numbers to advertisers. Progress!
matkoniecz 6y ago
I am not claiming that everyone working in FB is malicious. But if somehow someone missed any malicious intent from FB they seem to be deliberately ignoring glaring issues. > People are not infallible, they make mistakes. What I did not see during my tenure there is any malicious intent I never worked in FB but I consider things like https://noyb.eu/en/facebooks-gdpr-bypass-reaches-austrian-supreme-court https://noyb.eu/en/facebooks-gdpr-bypass-reaches-austrian-su... as malicious > On 25.5.2018 at midnight, when the GDPR became applicable, Facebook has simply named things like "personalized advertisement" in its terms and conditions. Facebook now argues that it has a "duty to provide personalized advertisement" to the users, therefore, it does not need the user's consent to process his or her personal data. Or https://news.ycombinator.com/item?id=26777739 https://news.ycombinator.com/item?id=26777739 > It's interesting how Guy Rosen, a co-founder of the spyware company Onavo, is now Facebook's "vice-president of integrity"

teachingassist 6y ago

> From what I recall (could be wrong here, not first-hand knowledge), the SMS thing was a decision made by a single team ages ago I have worked in a tiny charitable organisation, where it was easily understood that if we collected user telephone numbers, there would be constant pressure to use them for other purposes. And, therefore, that we didn't have the capacity to honestly and securely promise to users that we and our future replacements would use them only for one purpose. This is not a failure of one team "before privacy was at the forefront" (when?). It's a systemic failure of multiple teams and of Facebook's culture of constant privacy infringement and misdirection. That this implicit promise to users was made so lightly and not considered important enough to follow through on. As such, it's a breach of contract which I hope is picked up legally.

bertil 6y ago
> This is not a failure of one team "before privacy was at the forefront" (when?). If that was not a rhetorical question (and I suspect it was) from 2006 to 2016, the main concern around Facebook was monopolies and interoperability. I would know because that was the topic of my PhD. Many people argued for either open protocols (Stratechery regularly, TechDirt did a big piece about it a year ago, WaitButWhy several years ago too) that would allow individuals to extract their social graph (a list of their friends, or information about them) from one service to find them on another service, hoping that this would lower the influence of a single service. It’s graph-sharing tools like those that were key in all the recent “scandals” about the company, often simultaneously blaming Facebook for both not preventing other services from exporting information and being “a roach motel” where information never leaves (per Cory Doctorow). One particular step involved here, the ability to find friends on Facebook is part of a common priority at Facebook: “growth”. Many people see it as a blind, profit-seeking effort. It’s actually motivated by altruistic means. Outside of the young, educated, technology-savvy classes of the Western World (where most people who could benefit from social tools already know how to use them) having contacts to more friends remains a major positive thing. It’s rarely financially beneficial for Facebook on the short-term to encourage that because it triggers cost without matching advertising revenue (most of the ad sales are still in the US, and to a lesser extend, Europe). “Growth” has lead to several misguided effort, or clumsy attempts (typically: People-you-may-know) but it’s not the rabid unbridled capitalist effort that opponents outside the company like to paint. It was often the primary objective of several teams, outside of interoperability, that contributed to parts of complex systems that ended up being abused later. One final aspect that the original comment might not have clarified is that those tools are often poorly known, even internally; they can be years old and still hidden after people who built them and are familiar with potential abuse vectors have gone. Many people build other tools that can, in combination, lead to bad things, without knowing what’s there. The team who build the infamous year-in-review (one guy really) was trying to demonstrate how to share several posts. He was surprised when it was massively adopted, and more so when it was promoted, without consulting him. The people who tried to raise that tool were curious about another question, nostalgia and the relevance of past posts. It lead to one person famously having to re-visit the grief of loosing his mother because no one consulted the team in charge of writing empathic messages. The priority then was not to squander good ideas with committees and encourage every idea, including privacy-preserving projects, and many empathy-defending ones too. I can personally confirm that many projects defending both (privacy and empathy) still massively popular today would not have been released without that third priority of letting individual employees try things without over-burdening supervision. Until 2016, privacy was not a priority, but a non-negotiable primary absolute. It was enforced by the code (literally: the site is written in Hack, a version of PhP that has access-control hard-coded). Users could not see information they were not supposed to (say, a comment by an ex that had blocked them on a post by a shared friend) because of those hard-coded controls. It was understood to the most that company could do. Confusing situations challenged that absolutist view (like users volunteering whose pages their friends were fans of, something they could legitimately see, through an API, for financial gain) and privacy became not just an absolute condition of any work (that was easy to ignore because pushed one layer of abstraction down) but also a more nuanced approach that required conscious, expensive and sometimes frustrating war-gaming “leaks” through complex adversarial scenarios. Because of that new priority, Facebook closed a lot of old APIs then, to the dismay of many researchers using those to analyse the company, its practices, including privacy and monopoly position. > It's a systemic failure of multiple teams and of Facebook's culture of constant privacy infringement and misdirection. No.

FabHK 6y ago

> What I did not see during my tenure there is any malicious intent, people genuinely wanted to build a valuable product and make broken stuff better. But the argument is not that the many individual well intentioned engineers at Facebook (or even Zuckerberg himself) set out maliciously to create a monster; but rather that the confluence of new technology, human nature, incentives, advertisement, tracking etc. has resulted in something that has many negative consequences (which might exceed the positives); and of which they profit very handsomely.

danShumway 6y ago

> But at the same time, realize that Facebook is not some giant monolith. These are thousands of teams, working in a highly bottoms-up, impact-oriented culture. Okay, but let's cycle back around to your original point. A bottoms-up culture in which mistakes like this can happen is not a culture that is responsible enough to hold information like my phone number, address, credit card information, etc... It's not competent enough to manage a voice assistant, or to have access to my contacts. We're kind of dancing around the original poster's confusion, which was: > "On the one hand I picture a classic clueless business people driven culture driving poor demotivated engineers and so stuff like the latest hack happen." > "But then, I see this other picture where teams of quite functional teams are doing good engineering." But you're not reconciling those pictures. You're trying to paint a picture of a good organization that means well and that is constantly getting better, but that also makes giant mistakes like misusing data and breaking data silos because it's too large to manage and because the culture encourages playing fast-and-loose with data. The question is, when Facebook starts collecting IDs to validate accounts, when Facebook starts releasing voice assistants, or trying to launch a currency, how can we confidently say that these mistakes won't keep happening? Because to just say "people aren't infallible" isn't enough when talking about an organization that wants this kind of power and insight into everyone's information. ---- So here's how I reconcile those pictures: Facebook has talented people employed who like to believe they're doing the right things. But they're not willing to take this seriously or to really think about the impact of their products. Facebook is not holding off on collecting data because they're worried they might leak it. Facebook is asking people to verify information, they want your cell phone number, they're collecting PII on people who don't even have accounts. They want people to send money over their chat app, and to talk to businesses using their platform, and to schedule events, and to link their contacts, and send their location. They want basically all of the data, and none of these leaks has changed their attitude towards data collection. So I don't think Facebook is incompetent, I think it's about average just like most other businesses, but the difference is that it wants to be seen as a highly competent, infallible company that's worthy of unprecedented access into people's lives until something goes wrong. Then, once everyone's phone number is leaked, it falls back on the "pobudies nefect" card, just like it already has so many times before. And I think that's a big source of anger, because it's hard to look at that behavior without coming away with the idea that the company is either malicious or just grossly irresponsible. No, they're not malicious in the sense that they literally want to leak your information, but they're clearly not losing sleep over the fact that they're putting your information at risk, even though they've demonstrated over and over again that they can't keep it secure. I don't know what a good word for that is. If not "malicous", maybe "callous" or "uncaring"? Facebook is a group of average-to-talented developers and managers who are nevertheless unwilling to take the steps necessary to actually protect my data, and they're actively hostile to me keeping my data from them (remember, phone numbers were leaked here from accounts that had been deleted, from people who had signaled that they did not want Facebook to have that information any more). So maybe Facebook devs "care" in the abstract sense, but they don't appear to care in any of the practical ways that really matter. And I'm just so tired of people telling me that the culture at Facebook is changing when it is so clearly not changing. Facebook devs have been saying the same thing to me after every controversy for over a decade at this point. I'm excited that we're no longer experimenting on depressed teens, and now we've graduated to leaking every single phone number online, trying to cover it up, and then claiming to press that it's not a real leak. Maybe in another 10 years we'll only be misrepresenting impression numbers to advertisers. Progress!

matkoniecz 6y ago

I am not claiming that everyone working in FB is malicious. But if somehow someone missed any malicious intent from FB they seem to be deliberately ignoring glaring issues. > People are not infallible, they make mistakes. What I did not see during my tenure there is any malicious intent I never worked in FB but I consider things like https://noyb.eu/en/facebooks-gdpr-bypass-reaches-austrian-supreme-court https://noyb.eu/en/facebooks-gdpr-bypass-reaches-austrian-su... as malicious > On 25.5.2018 at midnight, when the GDPR became applicable, Facebook has simply named things like "personalized advertisement" in its terms and conditions. Facebook now argues that it has a "duty to provide personalized advertisement" to the users, therefore, it does not need the user's consent to process his or her personal data. Or https://news.ycombinator.com/item?id=26777739 https://news.ycombinator.com/item?id=26777739 > It's interesting how Guy Rosen, a co-founder of the spyware company Onavo, is now Facebook's "vice-president of integrity"