4 ms·

Meta doesn’t have the ability to monitor its users’ computers to see if any of them end up having data sent to a server.

by ummonk 4y ago

amatecha 4y ago
Again, I'm asking _the person in the thread above_ who made these claims that the app is stealing user data to provide any supporting evidence, perhaps via the methods I described in my last comment. I'm not talking about Meta.
- ummonk 4y ago
  THat's not the what you were asking. You asked 'What evidence do you have that this application was acting as a "proxy" where the developers can "intercept and see all data"?' The app is by definition acting as a proxy, and therefore the developers can intercept and see the data, though they might not be doing so currently.
  - amatecha 4y ago
    Is the Facebook Messenger app a proxy? Is the Instagram client a proxy? Is the mail app on my phone a proxy? I'm trying to grasp what definition of "proxy" you're using here, because every usage of the word "proxy" I've ever see relating to internet services is: "a program which redirects network traffic to another destination". The subject is explored in detail at https://en.wikipedia.org/wiki/Proxy_server https://en.wikipedia.org/wiki/Proxy_server . Yet again, I'm seeking to see any shred of evidence that even _suggests_ that the application has acted as a "proxy" or sent more user data to the app developer than absolutely necessary to function.
  - nobody9999 4y ago
    >The app is by definition acting as a proxy, and therefore the developers can intercept and see the data, though they might not be doing so currently. You're making an assumption here that hasn't been confirmed. That assumption being that any app accessing user data from Meta is proxying (i.e., streaming the requested data to the app publisher's servers and then passing that data along to the end user) that data through their servers. Is that the case with the app in question? Is it the case with every such app? Or are there apps that directly connect to Meta's servers from the user's hardware without streaming the requested data through the app publisher's servers? The app in TFA may be proxying (see above) data through their servers (that's the definition of a proxy in this context), but I don't know if they are doing so. If they are, there certainly are serious privacy/security issues with that process. But again, no one has provided evidence that's what the app in question is doing. If they are, you should run screaming in the other direction. However, if the app is simply performing the same API calls as Meta's app and returning the data directly to the end user, the risk profile is pretty similar for both apps (dependent on code quality, the ethical stance of the publishers, etc.).
    - ummonk 4y ago
      I (and the person who wrote that) made no such assumption. A client side proxy is still a proxy. That’s why, for example, Charles Proxy is a proxy.
      - Dylan16807 4y ago
        Charles Proxy is proxying requests to your browser. If you use the built-in dev tools to do the same thing, then there is no proxy. An alternative client for something is (usually) not a proxy. It connects directly. But more importantly, "a proxy where the app developers can intercept and see all data" is not referring to a client-side proxy. Even if there was a client-side proxy involved somewhere, that would make the initial claim wrong.
- cortesoft 4y ago
  Yes, an individual can do that. That is not the point. The person you replied to wasn't saying they know for sure they were stealing user data, just that Meta has no way of knowing they aren't, and even if they aren't right now, no way of knowing if they will start in the future. It doesn't matter what the app does at this moment, it can be changed at any point.
  - josephcsible 4y ago
    Should Meta also ban users who connect to their services from GrapheneOS, since it could be updated to steal all of your application data in the future?
  - nobody9999 4y ago
    >That is not the point. The person you replied to wasn't saying they know for sure they were stealing user data, just that Meta has no way of knowing they aren't, and even if they aren't right now, no way of knowing if they will start in the future. But isn't such an application running on the end-user's hardware and making requests at the end-user's behest? If so, what does Meta have to do with it at all? Should they be allowed to tell me what software I'm allowed to run on my hardware? The risk you mention is all on the user's side and none of it on Meta's side. If the user decides they want to accept that risk, AFAICT it's no skin off Meta's nose. Or am I missing something here?
    - cortesoft 4y ago
      The user is risking more than their own data; they are also risking the data of their friends. If I grant a friend permission to view my photos, I am not also granting some random 3rd party that permission.
      - nobody9999 4y ago
        >If I grant a friend permission to view my photos, I am not also granting some random 3rd party that permission. Assuming the "third-party" client is just that (a client app), there really shouldn't be an issue. If I use FluffyChat[0] instead of Element[1], do the FluffyChat folks have access to all my (and those with whom I communicate) Matrix communications? If I use Element, do they have such access? If you use Firefox to access Facebook, are you granting Mozilla full access to your (and your FB friends') profiles? There has been a lot of noise about "third-parties" and how they only exist to steal your data. But we use "third-party" clients all the time. Web browsers, IRC clients, and a host of other "third-party" apps. Why aren't you up in arms about them stealing your data and that of your contacts? [0] https://fluffychat.im/ https://fluffychat.im/ [1] https://element.io/ https://element.io/

Meta doesn’t have the ability to monitor its users’ computers to see if any of them end up having data sent to a server.

by ummonk 4y ago

Meta doesn’t have the ability to monitor its users’ computers to see if any of them end up having data sent to a server.

amatecha 4y ago

Again, I'm asking _the person in the thread above_ who made these claims that the app is stealing user data to provide any supporting evidence, perhaps via the methods I described in my last comment. I'm not talking about Meta.

ummonk 4y ago
THat's not the what you were asking. You asked 'What evidence do you have that this application was acting as a "proxy" where the developers can "intercept and see all data"?' The app is by definition acting as a proxy, and therefore the developers can intercept and see the data, though they might not be doing so currently.
- amatecha 4y ago
  Is the Facebook Messenger app a proxy? Is the Instagram client a proxy? Is the mail app on my phone a proxy? I'm trying to grasp what definition of "proxy" you're using here, because every usage of the word "proxy" I've ever see relating to internet services is: "a program which redirects network traffic to another destination". The subject is explored in detail at https://en.wikipedia.org/wiki/Proxy_server https://en.wikipedia.org/wiki/Proxy_server . Yet again, I'm seeking to see any shred of evidence that even _suggests_ that the application has acted as a "proxy" or sent more user data to the app developer than absolutely necessary to function.
- nobody9999 4y ago
  >The app is by definition acting as a proxy, and therefore the developers can intercept and see the data, though they might not be doing so currently. You're making an assumption here that hasn't been confirmed. That assumption being that any app accessing user data from Meta is proxying (i.e., streaming the requested data to the app publisher's servers and then passing that data along to the end user) that data through their servers. Is that the case with the app in question? Is it the case with every such app? Or are there apps that directly connect to Meta's servers from the user's hardware without streaming the requested data through the app publisher's servers? The app in TFA may be proxying (see above) data through their servers (that's the definition of a proxy in this context), but I don't know if they are doing so. If they are, there certainly are serious privacy/security issues with that process. But again, no one has provided evidence that's what the app in question is doing. If they are, you should run screaming in the other direction. However, if the app is simply performing the same API calls as Meta's app and returning the data directly to the end user, the risk profile is pretty similar for both apps (dependent on code quality, the ethical stance of the publishers, etc.).
  - ummonk 4y ago
    I (and the person who wrote that) made no such assumption. A client side proxy is still a proxy. That’s why, for example, Charles Proxy is a proxy.
    - Dylan16807 4y ago
      Charles Proxy is proxying requests to your browser. If you use the built-in dev tools to do the same thing, then there is no proxy. An alternative client for something is (usually) not a proxy. It connects directly. But more importantly, "a proxy where the app developers can intercept and see all data" is not referring to a client-side proxy. Even if there was a client-side proxy involved somewhere, that would make the initial claim wrong.
cortesoft 4y ago
Yes, an individual can do that. That is not the point. The person you replied to wasn't saying they know for sure they were stealing user data, just that Meta has no way of knowing they aren't, and even if they aren't right now, no way of knowing if they will start in the future. It doesn't matter what the app does at this moment, it can be changed at any point.
- josephcsible 4y ago
  Should Meta also ban users who connect to their services from GrapheneOS, since it could be updated to steal all of your application data in the future?
- nobody9999 4y ago
  >That is not the point. The person you replied to wasn't saying they know for sure they were stealing user data, just that Meta has no way of knowing they aren't, and even if they aren't right now, no way of knowing if they will start in the future. But isn't such an application running on the end-user's hardware and making requests at the end-user's behest? If so, what does Meta have to do with it at all? Should they be allowed to tell me what software I'm allowed to run on my hardware? The risk you mention is all on the user's side and none of it on Meta's side. If the user decides they want to accept that risk, AFAICT it's no skin off Meta's nose. Or am I missing something here?
  - cortesoft 4y ago
    The user is risking more than their own data; they are also risking the data of their friends. If I grant a friend permission to view my photos, I am not also granting some random 3rd party that permission.
    - nobody9999 4y ago
      >If I grant a friend permission to view my photos, I am not also granting some random 3rd party that permission. Assuming the "third-party" client is just that (a client app), there really shouldn't be an issue. If I use FluffyChat[0] instead of Element[1], do the FluffyChat folks have access to all my (and those with whom I communicate) Matrix communications? If I use Element, do they have such access? If you use Firefox to access Facebook, are you granting Mozilla full access to your (and your FB friends') profiles? There has been a lot of noise about "third-parties" and how they only exist to steal your data. But we use "third-party" clients all the time. Web browsers, IRC clients, and a host of other "third-party" apps. Why aren't you up in arms about them stealing your data and that of your contacts? [0] https://fluffychat.im/ https://fluffychat.im/ [1] https://element.io/ https://element.io/