5 ms·

"This extension can access: Your data on all websites" This part made me chuckle a bit. We are so afraid of Google and Facebook tracking our searches/web pages

by orijing 15y ago

"This extension can access: Your data on all websites" This part made me chuckle a bit. We are so afraid of Google and Facebook tracking our searches/web pages, yet we freely install plugins from 3rd party developers that can easily gather everything that Google and Facebook can get, and more. In theory, I could make a Facebook Disconnect 2, which secretly sends data back home about what pages have been visited, and nobody except the most vigilant (enough to read the source of the plugin) would know. Why do we not trust large corporations who have billions of dollars at stake, but trust independent developers who have little skin in the game? Is it because we are those developers, so there's some form of camaraderie?

alexgartrell 15y ago
People don't trust Facebook because they don't know what we (fellow Facebook Engineer[0]) know about what it's like on the inside. They don't believe that people are just legitimately interested in making stuff that people will like and use, that we obsess over the stats to make sure that we're making stuff that people and use (they think it's tracking them), and that ultimately, we just want to give people ads that they don't hate (for some reason this is called "selling data to advertisers"). Ultimately though, the opinions of Hacker Newsers (a group with which I've proudly associated for ~3 years now) are only a hint at how much we're helping (or hurting) the world, and while we should always keep it in mind, we need to recognize that this is a group which is accustomed to the IRC style of social networking. I don't blame anyone at Hacker News for thinking "we" are evil, because we do a shitty job at communicating what we're actually doing and why[1] (and we can't really communicate everything anyway). Instead, we've just gotta try to address the problems that are legitimate and be as transparent as possible. Shortly, if you call tin foil hat theories tin foil hat theories (even with sound logic as to why they are tin foil hat theories), all you're going to do is convince the tin foil hat theorists that it's yet another elaborate step in manipulating them into believing The Corporate Directive. And, everyone else, for what it's worth, I'd much prefer it if we could just go back to hacker news on here. I'm a C Hacker first (before being assimilated, I contributed to open source projects like Chromium and Mongrel2, because I loved the problems (coincidentally the same reason I allowed myself to become assimilated into facebook -- I work on code that's hit my millions of users billions of times a day[2]) [0] Cache Infra in 1050 B2 [1] We've enabled applications to write to our network as they wish without introducing much friction or overhead (a single approval), but we've managed to communicate that in such a way that instead of leading people to believe that we've put the onus on developers (and users, as they must ultimately know which apps to trust), we've instead "put our tentacles" into yet another area and are again sharing without reason. [2] memcache protocol stack stuff, we issue lots (and lots and lots) of requests per page load :)
- nknight 15y ago
  > People don't trust Facebook because they don't know what we (fellow Facebook Engineer[0]) know about what it's like on the inside. Bull. We don't trust Facebook because of its actions. Beacon, account deletion, random modification of privacy settings and policies. Facebook has done virtually nothing to earn trust, and taken several clear, conscious actions that violate trust. Your perception of Facebook's intent does nothing to change what Facebook has actually done to its users.
  - pclark 15y ago
    I bet - as someone that respects what Facebook has crafted but really has no vested interest in their long term success - that Facebook internally feels that it has done a ton at demonstrating it's awareness and empathy towards users and their privacy and has concluded that actually, users as a meaningful percentage, do not give a crap about what Facebook does or doesn't do wit their data.
  - presty 15y ago
    Also, it's not just what Facebook is currently doing or has done, but also what it _can_ do with my data.
  - hello_moto 15y ago
    Many of my friends trust Facebook. I'm starting to think that those smug bloggers are in it for the traffic. It all depends on your perspective I suppose.
- curiouskat 15y ago
  A few weeks ago a close friend sent me a message on Facebook asking what I've been up to, and I told him about the startup I am working on. As soon as I hit send I was hit with the impulse that I shouldn't have sent those kind of details over FB messaging -- thinking back to warnings such as (http://www.youtube.com/watch?v=2cdrCYrZIvI http://www.youtube.com/watch?v=2cdrCYrZIvI). And sure enough a day and half later I received an email from a Facebook recruiter wanting to talk to me about a job. Normally that would be fine, but the timing is so suspect. I asked around if anyone had heard of FB mining/reading users messages, and no was certain but reminded me that the FB privacy policy states that they own your data and an ex-FB employee said that many engineers have access to the DB. Does FB mine or read user messages, and why doesn't it do more to prevent so many engineers from having access to the DB?
power78 15y ago
He actually is doing this. Take a look at the source code. He has tracking javascript right at the bottom. Its sort of ironic...
- archgoon 15y ago
  I'm looking at the source code, and I'm not seeing what you're talking about. The code is only in content.js, and nothing is being talked to as far as I see. How is he sending out tracking data?
  - power78 15y ago
    Edit: I'm sorry guys, I guess the file that the install button links to is not the addon itself like the Firefox addon site does, so saving it does not give you the addon. I'm retarded. He does not have tracking cookies, I apologize.
- jonknee 15y ago
  Where? The source is exceedingly simple and there is no tracking JS: http://code.google.com/p/byoogle/source/browse/trunk/google/chrome/fbdc/content.js http://code.google.com/p/byoogle/source/browse/trunk/google/...
  - deleted 15y ago
    [deleted]
archgoon 15y ago
My first thought when I saw this was: "I should check out the source first and see what it does". Here is the source: const DOMAINS = ['facebook.com', 'facebook.net', 'fbcdn.net']; /* Determines whether any of a bucket of domains is part of a URL, regex free. */ function isMatching(url, domains) { const DOMAIN_COUNT = domains.length; for (var i = 0; i < DOMAIN_COUNT; i++) if (url.toLowerCase().indexOf(domains[i], 7) >= 7) return true; // A valid URL has seven-plus characters ("http://"), then the domain. } /* Traps and selectively cancels a request. */ if (!isMatching(location.href, DOMAINS)) { document.addEventListener("beforeload", function(event) { if (isMatching(event.url, DOMAINS)) event.preventDefault(); }, true); } I am not concerned with this plugin. It may break websites, but it does nothing malicious. It is no more dangerous than any other chrome plugin.
- Murkin 15y ago
  Yup, until the author uploads a new, more 'clever' version and chrome auto-updates your browser, without you knowing it (since permissions didn't change).
  - alexro 15y ago
    It looks like we need another plugin which will track the source changes of other plugings and report them.
    - sjs 15y ago
      Who will watch the watchmen?
  - MostAwesomeDude 15y ago
    You already trust Google to not do bad things inside Chrome; why not trust this guy, as well?
    - e40 15y ago
      Because if google doesn't something that people find out about, there will be a firestorm. If this guy does... will it rise in the headlines anywhere? I doubt it.
goblin89 15y ago
We freely install these plugins, yet we can't force ourselves to simply log out of Facebook[0], can we. How ambivalent is that. [0] http://news.ycombinator.com/item?id=3033385 http://news.ycombinator.com/item?id=3033385 Upd: They say now logging out is not enough (http://news.ycombinator.com/item?id=3035418 http://news.ycombinator.com/item?id=3035418), which partly invalidates my point.
nextparadigms 15y ago
Yeah, Google doesn't really get it how to set permissions properly. They do this on Android, too, and freak people out when they see permissions that at least seem so general - like giving a SMS app "full Internet access" or "full SD card access" and so on. The problem with naming them like that is that showing the permissions becomes pointless, because people will install them anyway seeing how 95% of the apps have that permission, so they might miss the malicious one that has that, too.
- eli 15y ago
  In order to block Facebook, this extension is injecting javascript into every page you load. It absolutely should come with a large warning.
brown9-2 15y ago
I believe this is a problem with the extension API, where the extension needs to request "your data on all websites" in order to be able to run JS code in the context of the page/tab. Technically if it's able to do this, then it is able to access the data on that page as well, whether or not the extension is doing so.

by orijing 15y ago

alexgartrell 15y ago

People don't trust Facebook because they don't know what we (fellow Facebook Engineer[0]) know about what it's like on the inside. They don't believe that people are just legitimately interested in making stuff that people will like and use, that we obsess over the stats to make sure that we're making stuff that people and use (they think it's tracking them), and that ultimately, we just want to give people ads that they don't hate (for some reason this is called "selling data to advertisers"). Ultimately though, the opinions of Hacker Newsers (a group with which I've proudly associated for ~3 years now) are only a hint at how much we're helping (or hurting) the world, and while we should always keep it in mind, we need to recognize that this is a group which is accustomed to the IRC style of social networking. I don't blame anyone at Hacker News for thinking "we" are evil, because we do a shitty job at communicating what we're actually doing and why[1] (and we can't really communicate everything anyway). Instead, we've just gotta try to address the problems that are legitimate and be as transparent as possible. Shortly, if you call tin foil hat theories tin foil hat theories (even with sound logic as to why they are tin foil hat theories), all you're going to do is convince the tin foil hat theorists that it's yet another elaborate step in manipulating them into believing The Corporate Directive. And, everyone else, for what it's worth, I'd much prefer it if we could just go back to hacker news on here. I'm a C Hacker first (before being assimilated, I contributed to open source projects like Chromium and Mongrel2, because I loved the problems (coincidentally the same reason I allowed myself to become assimilated into facebook -- I work on code that's hit my millions of users billions of times a day[2]) [0] Cache Infra in 1050 B2 [1] We've enabled applications to write to our network as they wish without introducing much friction or overhead (a single approval), but we've managed to communicate that in such a way that instead of leading people to believe that we've put the onus on developers (and users, as they must ultimately know which apps to trust), we've instead "put our tentacles" into yet another area and are again sharing without reason. [2] memcache protocol stack stuff, we issue lots (and lots and lots) of requests per page load :)

nknight 15y ago
> People don't trust Facebook because they don't know what we (fellow Facebook Engineer[0]) know about what it's like on the inside. Bull. We don't trust Facebook because of its actions. Beacon, account deletion, random modification of privacy settings and policies. Facebook has done virtually nothing to earn trust, and taken several clear, conscious actions that violate trust. Your perception of Facebook's intent does nothing to change what Facebook has actually done to its users.
- pclark 15y ago
  I bet - as someone that respects what Facebook has crafted but really has no vested interest in their long term success - that Facebook internally feels that it has done a ton at demonstrating it's awareness and empathy towards users and their privacy and has concluded that actually, users as a meaningful percentage, do not give a crap about what Facebook does or doesn't do wit their data.
- presty 15y ago
  Also, it's not just what Facebook is currently doing or has done, but also what it _can_ do with my data.
- hello_moto 15y ago
  Many of my friends trust Facebook. I'm starting to think that those smug bloggers are in it for the traffic. It all depends on your perspective I suppose.
curiouskat 15y ago
A few weeks ago a close friend sent me a message on Facebook asking what I've been up to, and I told him about the startup I am working on. As soon as I hit send I was hit with the impulse that I shouldn't have sent those kind of details over FB messaging -- thinking back to warnings such as (http://www.youtube.com/watch?v=2cdrCYrZIvI http://www.youtube.com/watch?v=2cdrCYrZIvI). And sure enough a day and half later I received an email from a Facebook recruiter wanting to talk to me about a job. Normally that would be fine, but the timing is so suspect. I asked around if anyone had heard of FB mining/reading users messages, and no was certain but reminded me that the FB privacy policy states that they own your data and an ex-FB employee said that many engineers have access to the DB. Does FB mine or read user messages, and why doesn't it do more to prevent so many engineers from having access to the DB?

power78 15y ago

He actually is doing this. Take a look at the source code. He has tracking javascript right at the bottom. Its sort of ironic...

archgoon 15y ago
I'm looking at the source code, and I'm not seeing what you're talking about. The code is only in content.js, and nothing is being talked to as far as I see. How is he sending out tracking data?
- power78 15y ago
  Edit: I'm sorry guys, I guess the file that the install button links to is not the addon itself like the Firefox addon site does, so saving it does not give you the addon. I'm retarded. He does not have tracking cookies, I apologize.
jonknee 15y ago
Where? The source is exceedingly simple and there is no tracking JS: http://code.google.com/p/byoogle/source/browse/trunk/google/chrome/fbdc/content.js http://code.google.com/p/byoogle/source/browse/trunk/google/...
- deleted 15y ago
  [deleted]

archgoon 15y ago

My first thought when I saw this was: "I should check out the source first and see what it does". Here is the source: const DOMAINS = ['facebook.com', 'facebook.net', 'fbcdn.net']; /* Determines whether any of a bucket of domains is part of a URL, regex free. */ function isMatching(url, domains) { const DOMAIN_COUNT = domains.length; for (var i = 0; i < DOMAIN_COUNT; i++) if (url.toLowerCase().indexOf(domains[i], 7) >= 7) return true; // A valid URL has seven-plus characters ("http://"), then the domain. } /* Traps and selectively cancels a request. */ if (!isMatching(location.href, DOMAINS)) { document.addEventListener("beforeload", function(event) { if (isMatching(event.url, DOMAINS)) event.preventDefault(); }, true); } I am not concerned with this plugin. It may break websites, but it does nothing malicious. It is no more dangerous than any other chrome plugin.

Murkin 15y ago
Yup, until the author uploads a new, more 'clever' version and chrome auto-updates your browser, without you knowing it (since permissions didn't change).
- alexro 15y ago
  It looks like we need another plugin which will track the source changes of other plugings and report them.
  - sjs 15y ago
    Who will watch the watchmen?
- MostAwesomeDude 15y ago
  You already trust Google to not do bad things inside Chrome; why not trust this guy, as well?
  - e40 15y ago
    Because if google doesn't something that people find out about, there will be a firestorm. If this guy does... will it rise in the headlines anywhere? I doubt it.

goblin89 15y ago

We freely install these plugins, yet we can't force ourselves to simply log out of Facebook[0], can we. How ambivalent is that. [0] http://news.ycombinator.com/item?id=3033385 http://news.ycombinator.com/item?id=3033385 Upd: They say now logging out is not enough (http://news.ycombinator.com/item?id=3035418 http://news.ycombinator.com/item?id=3035418), which partly invalidates my point.

nextparadigms 15y ago

Yeah, Google doesn't really get it how to set permissions properly. They do this on Android, too, and freak people out when they see permissions that at least seem so general - like giving a SMS app "full Internet access" or "full SD card access" and so on. The problem with naming them like that is that showing the permissions becomes pointless, because people will install them anyway seeing how 95% of the apps have that permission, so they might miss the malicious one that has that, too.

eli 15y ago
In order to block Facebook, this extension is injecting javascript into every page you load. It absolutely should come with a large warning.

brown9-2 15y ago

I believe this is a problem with the extension API, where the extension needs to request "your data on all websites" in order to be able to run JS code in the context of the page/tab. Technically if it's able to do this, then it is able to access the data on that page as well, whether or not the extension is doing so.