5 ms·

Facebook bans KDE application, deletes user photos

87 points by Garbage 15y ago

wladimir 15y ago
Banning the application could be justifiable (don't know the details), but removing everyones user photos just because they were uploaded with a certain tool, wow, that's messed up. I simply don't have words for it.
- FlowerPower 15y ago
  Facebook is a walled in garden, they wont let outsiders benefit on their backs. Any app which recieves fame is due for "accidents".
- arcs 15y ago
  Content from spammy apps are hidden when the app is disabled. If you think about this it sort of makes sense: if the app is sending lots of crap without user consent, merely disabling an app does not remove all the crap it has already sent out. I don't think the posted content are actually deleted though, they should be unhidden when the app is unblocked.
- dendory 15y ago
  If you've been following the recent threads, Facebook has recently started targeting tons of photo apps, often for no visible reason, and many think it's because Facebook is about to get into the game themselves with their own photo sharing apps. Expect an answer within the month or so when they release it.
- nl 15y ago
  It's likely that the tool (or - more precisely - the app id & secret) let people upload pictures into other people's accounts. Facebook couldn't let that stand.
  - r00fus 15y ago
    Just deleting photos without a proper explanation of why you did so leaves a very bad taste in the mouth. I can see why people would be bitter... FB just deleted their photos because their upload method was "wrong". If they said there was no possible way to examine the situation, or that they would restore your photos if you waded through an indemnification click-through, then OK, I can understand. But just deleting the photos with no warning or even notification?
Xuzz 15y ago
I'm going to assume this was a mistake. However, I have been seeing quite a few "mistakes" similar to this from Facebook lately. They have a legitimate problem with application spam, but if they are going to try and fight that by banning applications, they better be damn sure they are getting the right ones. But, they don't seem to be doing a particularly good job of that, at least from what I've seen. However: maybe they are doing a great job, and it's just the few mistakes we hear about. Or, even — maybe there's a legitimate reason for banning this application (although they could be better at communicating that reason, if there is one). But, at this point, even just the cases I've heard about here on HN don't inspire me (or, it seems, many others) to choose Facebook as the platform to develop upon. And that might be a bigger issue, even more than application spam. Edit: after reading saurik's post, this seems like a legitimate situation for them to pull it. However, the point still stands: they need to communicate this better to both KDE and the users of the application. I like Facebook. Just don't like it when stuff like this happens.
- Blunt 15y ago
  "they better be damn sure they are getting the right ones." No, see, the problem is you're not in control of FB. They are still a private company and they get to do what ever they want, obviously within the confines of US Laws and, obviously, to the benefit or detriment of their company. Life is simple: If you don't agree with their practices, then you have the power to chose to stop using their services. Why is that so hard for people to understand?
  - seabee 15y ago
    People expect others not to jerk them around. They will bitch about how they've been jerked around long before they'll cut the jerk from their life. Hopefully, because said jerk will change their behaviour, in a perfect world. There is also a lot of inertia created from using Facebook for a little while. You can't just pretend that inertia doesn't exist.
- ltamake 15y ago
  Unfortunately, I cannot write this off as another "mistake". If I didn't have employees I talk to on Facebook, this would be the point at which I would delete my account. Facebook had its chance to redeem itself in my eyes. The attempted Google slander was a tipping point for me, but hearing that my fellow developers are having their apps shut down and their data deleted finally did it for me. I wouldn't have cared if they had just deactivated the app. If it was clear that KDE was leaking its API credentials, I would have done the same thing. But deleting user data is unacceptable. Yes, you shouldn't rely on Facebook for image storage. But that doesn't mean you shouldn't worry about your data being randomly deleted.
saurik 15y ago
From the error, it actually sounds like the application had an API key distributed inside of it... which means that anyone, anywhere, could pretend to be the application.. and could use its credentials to upload anything they want. Yeah, right here: fbtalker.cpp: m_apiKey = "bf430ad869b88aba5c0c17ea6707022b"; fbtalker.cpp: m_secretKey = "0434307e70dd12c414cc6d0928f132d8"; To be honest, as much as I hate Facebook's developer program, sharing an API key in an end-user downloaded application (open source or not: doesn't matter) seems downright inane, and I can easily see circumstances where it looked like the application in general was doing something downright forbidden (maybe uploading porn), and the entire application got banned and all of its content got retroactively pulled. In fact, I'm a little rusty on this whole Facebook API thing, but I could easily see situations where the application was authorized to access peoples' photo galleries, then allowing anyone with those API keys to upload photos /as other people/. This likely went unnoticed for a while, but eventually someone figured it out, uploaded porn to /someone else's account/, and then the only feasible way to fix the situation (assuming a person even bothered looking into it, and I wouldn't blame Facebook much if no one did) was to just pull all photos that had been uploaded. Seriously: this is not a situation of "do not use Facebook": this is a situation of "do not use insecure applications".
- fleitz 15y ago
  How exactly does one solve this issue? Facebook's auth/app system makes a whole lot of sense for web sites but zero sense for desktop/mobile apps. The app is not insecure, how does exposing two keys endanger ANY user data? iPhone apps have the EXACT same issue, as this application, give me an IPA file and I'll give you the app's keys. Look at Facebook's official docs and they recommend embedding the keys into the app in this manner.
  - teej 15y ago
    They have a special desktop API that solves this exact issue. EDIT: they used to, at least. They now want devs to use the web OAuth flow by adding an embedded web view to your desktop app. http://developers.facebook.com/docs/authentication/ http://developers.facebook.com/docs/authentication/
dendory 15y ago
It's simple, you get your own site, which you pay for if you have to, then add one of the countless plugins that automatically share you content to Twitter, Facebook, etc. If all you do is upload your primary content directly to Facebook and nowhere else, you're just asking for trouble.
- rmc 15y ago
  If all you do is upload your primary content directly to Facebook and nowhere else, you're just asking for trouble. That applies to 99% of the Facebook audience.
- bnr 15y ago
  If I'm not mistaken, in case that plugin you have used gets banned, all your posted links should also disappear.
doogle88 15y ago
I seem to remember Mark Zuckerberg using KDE in The Social Network. Seems ironic.
- troels 15y ago
  Nah, that was an actor.
nsomaru 15y ago
well, there goes three of my albums. I really hope this gets resolved.
makmanalp 15y ago
While putting an API key like that inside code is pretty silly, and the ban makes sense, I don't understand why our content had to disappear along with the app. All the photos were in normal facebook photo albums. Bad customer service play.
- dorian-graph 15y ago
  They may have thought something like: Someone could have taken advantage of the API key and used it to upload content for not-so-good reasons and rather then checking all content uploaded using that key, they removed it all.

87 points by Garbage 15y ago

Banning the application could be justifiable (don't know the details), but removing everyones user photos just because they were uploaded with a certain tool, wow, that's messed up. I simply don't have words for it.

FlowerPower 15y ago
Facebook is a walled in garden, they wont let outsiders benefit on their backs. Any app which recieves fame is due for "accidents".
arcs 15y ago
Content from spammy apps are hidden when the app is disabled. If you think about this it sort of makes sense: if the app is sending lots of crap without user consent, merely disabling an app does not remove all the crap it has already sent out. I don't think the posted content are actually deleted though, they should be unhidden when the app is unblocked.
dendory 15y ago
If you've been following the recent threads, Facebook has recently started targeting tons of photo apps, often for no visible reason, and many think it's because Facebook is about to get into the game themselves with their own photo sharing apps. Expect an answer within the month or so when they release it.
nl 15y ago
It's likely that the tool (or - more precisely - the app id & secret) let people upload pictures into other people's accounts. Facebook couldn't let that stand.
- r00fus 15y ago
  Just deleting photos without a proper explanation of why you did so leaves a very bad taste in the mouth. I can see why people would be bitter... FB just deleted their photos because their upload method was "wrong". If they said there was no possible way to examine the situation, or that they would restore your photos if you waded through an indemnification click-through, then OK, I can understand. But just deleting the photos with no warning or even notification?

Xuzz 15y ago

I'm going to assume this was a mistake. However, I have been seeing quite a few "mistakes" similar to this from Facebook lately. They have a legitimate problem with application spam, but if they are going to try and fight that by banning applications, they better be damn sure they are getting the right ones. But, they don't seem to be doing a particularly good job of that, at least from what I've seen. However: maybe they are doing a great job, and it's just the few mistakes we hear about. Or, even — maybe there's a legitimate reason for banning this application (although they could be better at communicating that reason, if there is one). But, at this point, even just the cases I've heard about here on HN don't inspire me (or, it seems, many others) to choose Facebook as the platform to develop upon. And that might be a bigger issue, even more than application spam. Edit: after reading saurik's post, this seems like a legitimate situation for them to pull it. However, the point still stands: they need to communicate this better to both KDE and the users of the application. I like Facebook. Just don't like it when stuff like this happens.

Blunt 15y ago
"they better be damn sure they are getting the right ones." No, see, the problem is you're not in control of FB. They are still a private company and they get to do what ever they want, obviously within the confines of US Laws and, obviously, to the benefit or detriment of their company. Life is simple: If you don't agree with their practices, then you have the power to chose to stop using their services. Why is that so hard for people to understand?
- seabee 15y ago
  People expect others not to jerk them around. They will bitch about how they've been jerked around long before they'll cut the jerk from their life. Hopefully, because said jerk will change their behaviour, in a perfect world. There is also a lot of inertia created from using Facebook for a little while. You can't just pretend that inertia doesn't exist.
ltamake 15y ago
Unfortunately, I cannot write this off as another "mistake". If I didn't have employees I talk to on Facebook, this would be the point at which I would delete my account. Facebook had its chance to redeem itself in my eyes. The attempted Google slander was a tipping point for me, but hearing that my fellow developers are having their apps shut down and their data deleted finally did it for me. I wouldn't have cared if they had just deactivated the app. If it was clear that KDE was leaking its API credentials, I would have done the same thing. But deleting user data is unacceptable. Yes, you shouldn't rely on Facebook for image storage. But that doesn't mean you shouldn't worry about your data being randomly deleted.

saurik 15y ago

From the error, it actually sounds like the application had an API key distributed inside of it... which means that anyone, anywhere, could pretend to be the application.. and could use its credentials to upload anything they want. Yeah, right here: fbtalker.cpp: m_apiKey = "bf430ad869b88aba5c0c17ea6707022b"; fbtalker.cpp: m_secretKey = "0434307e70dd12c414cc6d0928f132d8"; To be honest, as much as I hate Facebook's developer program, sharing an API key in an end-user downloaded application (open source or not: doesn't matter) seems downright inane, and I can easily see circumstances where it looked like the application in general was doing something downright forbidden (maybe uploading porn), and the entire application got banned and all of its content got retroactively pulled. In fact, I'm a little rusty on this whole Facebook API thing, but I could easily see situations where the application was authorized to access peoples' photo galleries, then allowing anyone with those API keys to upload photos /as other people/. This likely went unnoticed for a while, but eventually someone figured it out, uploaded porn to /someone else's account/, and then the only feasible way to fix the situation (assuming a person even bothered looking into it, and I wouldn't blame Facebook much if no one did) was to just pull all photos that had been uploaded. Seriously: this is not a situation of "do not use Facebook": this is a situation of "do not use insecure applications".

fleitz 15y ago
How exactly does one solve this issue? Facebook's auth/app system makes a whole lot of sense for web sites but zero sense for desktop/mobile apps. The app is not insecure, how does exposing two keys endanger ANY user data? iPhone apps have the EXACT same issue, as this application, give me an IPA file and I'll give you the app's keys. Look at Facebook's official docs and they recommend embedding the keys into the app in this manner.
- teej 15y ago
  They have a special desktop API that solves this exact issue. EDIT: they used to, at least. They now want devs to use the web OAuth flow by adding an embedded web view to your desktop app. http://developers.facebook.com/docs/authentication/ http://developers.facebook.com/docs/authentication/

dendory 15y ago

It's simple, you get your own site, which you pay for if you have to, then add one of the countless plugins that automatically share you content to Twitter, Facebook, etc. If all you do is upload your primary content directly to Facebook and nowhere else, you're just asking for trouble.

rmc 15y ago
If all you do is upload your primary content directly to Facebook and nowhere else, you're just asking for trouble. That applies to 99% of the Facebook audience.
bnr 15y ago
If I'm not mistaken, in case that plugin you have used gets banned, all your posted links should also disappear.

doogle88 15y ago

I seem to remember Mark Zuckerberg using KDE in The Social Network. Seems ironic.

troels 15y ago
Nah, that was an actor.

nsomaru 15y ago

well, there goes three of my albums. I really hope this gets resolved.

makmanalp 15y ago

While putting an API key like that inside code is pretty silly, and the ban makes sense, I don't understand why our content had to disappear along with the app. All the photos were in normal facebook photo albums. Bad customer service play.

dorian-graph 15y ago
They may have thought something like: Someone could have taken advantage of the API key and used it to upload content for not-so-good reasons and rather then checking all content uploaded using that key, they removed it all.