6 ms·

This must have been a painful engineering effort that I bet absolutely consumed the backlogs of at least tens of teams. Usually business assumptions about user

by cnity 3y ago

This must have been a painful engineering effort that I bet absolutely consumed the backlogs of at least tens of teams. Usually business assumptions about user accounts have their tendrils deep into the architecture and services that presumably many many years of code sits on top of.

madsbuch 3y ago
Could be that they have not been entirely consolidated yet as they all previously were individual products. From a user perspective is appears like the users have been relatively loosely coupled.
- cnity 3y ago
  True, in which case it might be even more painful: imagine ending a year long epic to consolidate user account logic only to have to reverse it.
- mynameisvlad 3y ago
  Instagram might have been a separate product, but Messenger was just Facebook’s built in chat feature.
ffpip 3y ago
> presumably many many years of code sits on top of. Not so many, since they tried to link all 3 only few years ago https://www.theverge.com/2019/3/6/18253472/mark-zuckerberg-facebook-letter-privacy-encrypted-messaging https://www.theverge.com/2019/3/6/18253472/mark-zuckerberg-f...
- LinAGKar 3y ago
  That may be the case for Instagram, which was developed separately and then acquired, and which still uses separate accounts that AFAIK can be created without a Facebook account, although they can be connected to one. Messenger though has always just been the chat function on Facebook, which can nowadays also be used via a dedicated website/app if you like. It doesn't even have separate account infrastructure on the backend, unlike Instagram. Looks like they're getting around that by essentially creating a second Facebook account, with social media features disabled.
  - wrboyce 3y ago
    Many years ago when I disabled my Facebook account I noticed that Messenger continued to work, so there was definitely some level of separation.
    - smashed 3y ago
      But can you really disable a Facebook account?
      - TheRoque 3y ago
        Disabling merely means just making yourself invisible, and the Facebook profile unusable, but all the data stays there. If you delete it though, your messenger account is no more.
        eastbound 3y ago
        Even for EU citizen with GDPR?
        Sharlin 3y ago
        Disabling is what it says on the tin, giving you the chance to re-enable the account later. Nothing GDPR-violating with that. As long as you are also given an option to actually nuke all your PII.
        RHSman2 3y ago
        Anonymize data with a restore capability. Maintains historical continuity for never ending total user awareness.
  - Perz1val 3y ago
    There has been an option to create messenger only accout (so you could do that for your grandma who would not have figured facebook anyways, but you can send her photos now)
loceng 3y ago
I guess part of karmic consequence of "move fast and break things" motto - especially when it comes to not caring to develop or have forethought on security-safety concerns for what such a system, a digital version of The Facebook, could have on society; Harvard was planning to launch a digital version of their print version of The Facebook - and part of Mark's history he's quoted as saying, along with lying to the ConnectU twins he was hired to develop, that he didn't understand why Harvard was taking so long to get it going - that he could do it way faster; the externalized costs/harms are practically incalculable - all for that sweet sweet cheap-shallow-manipulative advertising revenue.
stavros 3y ago
> Usually business assumptions about user accounts have their tendrils deep into the architecture If their business assumptions are "users will never have a choice about how much we track them", they deserve what they got.
- ethbr1 3y ago
  "They" being Meta, yes. "They" being engineers, eh? It's a tough sell to justify greenfield dev effort when there's a BigCorp paved road laid out for you.
  - avgcorrection 3y ago
    > "They" being engineers, eh? If you’re a volunteer Roman legionnaire don’t be surprised when you are ordered to march on Gaul.
    - ethbr1 3y ago
      Fair! I took the original question in the vein of "Who is to blame?" I feel like IC latitude isn't usually sufficient to say "Do we really want to require the identity our platform is based around?"
      - ryandrake 3y ago
        ICs (at least the people good enough to pass a Meta interview) have a choice of where they work though. I've quit a job where I had an ethical issue with what the company was doing with the code I wrote. When Company X does something naughty, the individual developers need to at least share blame with the managers making the decisions. After all, whose fingers are typing the code in and hitting submit?
      - someotherperson 3y ago
        I haven't worked for a company as large as Meta but we encounter these issues on smaller projects too: should the unique identifier for an account be their email? Or a UUID? If your business only uses SSO, should you use the [Google/Microsoft/whatever] ID as the identifier for that user on your database? I personally wouldn't think that Facebook engineers would have had their hand forced on something like this.
XghTk 3y ago
Those are all acquired services, so the opposite is likely: they were linked together through the number of ugly hacks.
- dewey 3y ago
  That was a very long time ago though, so I could imagine that there's not much left from the original code base after it was moved onto Meta's infrastructure.
  - chimeracoder 3y ago
    > That was a very long time ago though, so I could imagine that there's not much left from the original code base after it was moved onto Meta's infrastructure. They only linked them a few years ago, in anticipation of an antitrust battle. They are now unliking them because they have lost/ceded that fight.
    - EMIRELADERO 3y ago
      Could you elaborate on that?
  - sitzkrieg 3y ago
    yea sf companies are definitely known to cleanup their hacks to go to market at any cost w a barely working thing later
    - dylan604 3y ago
      isn't that done naturally when they rewrite it the trendy language of the day?
deleted 3y ago
[deleted]
mcmcmc 3y ago
It’ll save them a good chunk of time when they eventually get split off like Baby Bells
andy_ppp 3y ago
And it’s good for consumers and Facebook can afford to do it, I wish the UK was still in the EU and I would be extremely happy about unlinking Instagram from Facebook just to avoid their notifications for it that pop up on Instagram never mind the ease of spying this creates.
- _7c0c 3y ago
  Isn't the UK GDPR basically the same as the EU GDPR?
  - withinboredom 3y ago
    Different sized teeth.
    - davidwritesbugs 3y ago
      Same size teeth, different inclination to bite.
waynesonfire 3y ago
Probably not, if it was painful they would have done it everywhere. Since now they have to maintain two configurations, linked and unlinked. It also highlights how much revenue is tied to this bundling of service since it's probably very expensive to maintain this dual configuration.
amelius 3y ago
And I bet management asked: what can be so difficult about decoupling the accounts? Just set coupling=false somewhere or something, okay?
summerlight 3y ago
At least they have a choice to unlink accounts, which probably makes the overall DMA compliance much easier. For Google, it's just been an engineering nightmare, cross-cutting across the entire stack :D
scyzoryk_xyz 3y ago
Sounds like a them problem not an us problem. Nothing they couldn’t afford „tens of teams”. It’s a nice moment living in the EU, knowing that common sense policies like GDPR and anti-trust can be enacted and enforced.
jarjoura 3y ago
The challenge isn't unlinking accounts in the database, that's just a simple copy command. The challenge is in all the metadata that is used for account A (Facebook), and account B (IG) that can no longer share any downstream metadata. So when you have to split the two apart, it's likely a hard legal requirement that there's no way account A can know anything about account B anymore. This means, countless metrics and logs and whatever has to be thrown away. So I imagine, there's lots of auditing of systems and every single property that is stored somewhere was scrutinized in long meetings. Less an engineering burden than a policy and legal burden.
- klabb3 3y ago
  A burden that is proportional to the amount of personal data the corporation collects sounds excellent.
  - closeparen 3y ago
    The compliance burden is proportional to the complexity of the architecture. You could have vast quantities of highly invasive personal data written to a monolithic RDBMS, and it would be simple matter of following foreign key relationships. Or you could have a very minimal set of entities & transactions actually collected from the customer via the edge, but propagated through so many microservices, queues, logs, warehouses, pipelines, and derived tables that it's infeasible to comprehensively trace all the scraps. The latter is more typical of a consumer internet company AFAICT.
- dmix 3y ago
  I have a feeling a lot of HN devs overvalue the value of old data... probably because they have adblockers and dont know what ads they are targeted for. Youtube's algorithm seems to forget my interests after a year (or less), I often have totally new feeds than I did 6 months ago. When I got back into music production and also watched some airplane crash videos my entire feed became music + "dark stories" related content bringing non-stop music gear + engineering related education sites. Almost all ads I see on my phone via Google properties are related to the current thing I care about. Beyond biographic details which are 99% disconnected from my old individual instagram/fb data (FB can just buy some correlation between email/phone/IP from my credit card or private postage company or whatever) they probably only profile IRL off the last 1-2yrs of your browsing behaviour in most cases. The classic privacy invading ads usecase is a woman who is pregnant suddenly getting ads for kid stuff before other people they know they are pregnant. They probably won't be getting those ads a year later. At most they are now labelled as potential mother in some macro profile, but for day-to-day targetting it's all about the current thing she's looking at online. I'm not defending this stuff and macro details matter for privacy at the nation-state and higher level, but my general point is that it's a living machine, constantly adapting with a short timeframe of data to maximize utility, not one that cares much about what you googled a few yrs ago 99% of the time.
rodgerd 3y ago
> This must have been a painful engineering effort It would be less painful if it were a universal option, and they didn't have to test with a bunch of geo-linked options.
j45 3y ago
Could the limited EU accessibility to this engineering feat be broadened by users identifying as living out of Europe?
SOLAR_FIELDS 3y ago
Given that the people on these teams are reaping stock from the efforts of mining personal data for people over decades I have a very strong “not sorry” feeling about any sort of negative anything that employees of Meta might experience. I would even go so far as to say, fuck these people, I have no empathy for you. You decided to be a part of the problem, and sucks to suck

by cnity 3y ago

madsbuch 3y ago

Could be that they have not been entirely consolidated yet as they all previously were individual products. From a user perspective is appears like the users have been relatively loosely coupled.

cnity 3y ago
True, in which case it might be even more painful: imagine ending a year long epic to consolidate user account logic only to have to reverse it.
mynameisvlad 3y ago
Instagram might have been a separate product, but Messenger was just Facebook’s built in chat feature.

ffpip 3y ago

> presumably many many years of code sits on top of. Not so many, since they tried to link all 3 only few years ago https://www.theverge.com/2019/3/6/18253472/mark-zuckerberg-facebook-letter-privacy-encrypted-messaging https://www.theverge.com/2019/3/6/18253472/mark-zuckerberg-f...

LinAGKar 3y ago
That may be the case for Instagram, which was developed separately and then acquired, and which still uses separate accounts that AFAIK can be created without a Facebook account, although they can be connected to one. Messenger though has always just been the chat function on Facebook, which can nowadays also be used via a dedicated website/app if you like. It doesn't even have separate account infrastructure on the backend, unlike Instagram. Looks like they're getting around that by essentially creating a second Facebook account, with social media features disabled.
- wrboyce 3y ago
  Many years ago when I disabled my Facebook account I noticed that Messenger continued to work, so there was definitely some level of separation.
  - smashed 3y ago
    But can you really disable a Facebook account?
    - TheRoque 3y ago
      Disabling merely means just making yourself invisible, and the Facebook profile unusable, but all the data stays there. If you delete it though, your messenger account is no more.
      - eastbound 3y ago
        Even for EU citizen with GDPR?
        Sharlin 3y ago
        Disabling is what it says on the tin, giving you the chance to re-enable the account later. Nothing GDPR-violating with that. As long as you are also given an option to actually nuke all your PII.
        RHSman2 3y ago
        Anonymize data with a restore capability. Maintains historical continuity for never ending total user awareness.
- Perz1val 3y ago
  There has been an option to create messenger only accout (so you could do that for your grandma who would not have figured facebook anyways, but you can send her photos now)

loceng 3y ago

I guess part of karmic consequence of "move fast and break things" motto - especially when it comes to not caring to develop or have forethought on security-safety concerns for what such a system, a digital version of The Facebook, could have on society; Harvard was planning to launch a digital version of their print version of The Facebook - and part of Mark's history he's quoted as saying, along with lying to the ConnectU twins he was hired to develop, that he didn't understand why Harvard was taking so long to get it going - that he could do it way faster; the externalized costs/harms are practically incalculable - all for that sweet sweet cheap-shallow-manipulative advertising revenue.

stavros 3y ago

> Usually business assumptions about user accounts have their tendrils deep into the architecture If their business assumptions are "users will never have a choice about how much we track them", they deserve what they got.

ethbr1 3y ago
"They" being Meta, yes. "They" being engineers, eh? It's a tough sell to justify greenfield dev effort when there's a BigCorp paved road laid out for you.
- avgcorrection 3y ago
  > "They" being engineers, eh? If you’re a volunteer Roman legionnaire don’t be surprised when you are ordered to march on Gaul.
  - ethbr1 3y ago
    Fair! I took the original question in the vein of "Who is to blame?" I feel like IC latitude isn't usually sufficient to say "Do we really want to require the identity our platform is based around?"
    - ryandrake 3y ago
      ICs (at least the people good enough to pass a Meta interview) have a choice of where they work though. I've quit a job where I had an ethical issue with what the company was doing with the code I wrote. When Company X does something naughty, the individual developers need to at least share blame with the managers making the decisions. After all, whose fingers are typing the code in and hitting submit?
    - someotherperson 3y ago
      I haven't worked for a company as large as Meta but we encounter these issues on smaller projects too: should the unique identifier for an account be their email? Or a UUID? If your business only uses SSO, should you use the [Google/Microsoft/whatever] ID as the identifier for that user on your database? I personally wouldn't think that Facebook engineers would have had their hand forced on something like this.

XghTk 3y ago

Those are all acquired services, so the opposite is likely: they were linked together through the number of ugly hacks.

dewey 3y ago
That was a very long time ago though, so I could imagine that there's not much left from the original code base after it was moved onto Meta's infrastructure.
- chimeracoder 3y ago
  > That was a very long time ago though, so I could imagine that there's not much left from the original code base after it was moved onto Meta's infrastructure. They only linked them a few years ago, in anticipation of an antitrust battle. They are now unliking them because they have lost/ceded that fight.
  - EMIRELADERO 3y ago
    Could you elaborate on that?
- sitzkrieg 3y ago
  yea sf companies are definitely known to cleanup their hacks to go to market at any cost w a barely working thing later
  - dylan604 3y ago
    isn't that done naturally when they rewrite it the trendy language of the day?

deleted 3y ago

[deleted]

mcmcmc 3y ago

It’ll save them a good chunk of time when they eventually get split off like Baby Bells

andy_ppp 3y ago

And it’s good for consumers and Facebook can afford to do it, I wish the UK was still in the EU and I would be extremely happy about unlinking Instagram from Facebook just to avoid their notifications for it that pop up on Instagram never mind the ease of spying this creates.

_7c0c 3y ago
Isn't the UK GDPR basically the same as the EU GDPR?
- withinboredom 3y ago
  Different sized teeth.
  - davidwritesbugs 3y ago
    Same size teeth, different inclination to bite.

waynesonfire 3y ago

Probably not, if it was painful they would have done it everywhere. Since now they have to maintain two configurations, linked and unlinked. It also highlights how much revenue is tied to this bundling of service since it's probably very expensive to maintain this dual configuration.

amelius 3y ago

And I bet management asked: what can be so difficult about decoupling the accounts? Just set coupling=false somewhere or something, okay?

summerlight 3y ago

At least they have a choice to unlink accounts, which probably makes the overall DMA compliance much easier. For Google, it's just been an engineering nightmare, cross-cutting across the entire stack :D

scyzoryk_xyz 3y ago

Sounds like a them problem not an us problem. Nothing they couldn’t afford „tens of teams”. It’s a nice moment living in the EU, knowing that common sense policies like GDPR and anti-trust can be enacted and enforced.

jarjoura 3y ago

The challenge isn't unlinking accounts in the database, that's just a simple copy command. The challenge is in all the metadata that is used for account A (Facebook), and account B (IG) that can no longer share any downstream metadata. So when you have to split the two apart, it's likely a hard legal requirement that there's no way account A can know anything about account B anymore. This means, countless metrics and logs and whatever has to be thrown away. So I imagine, there's lots of auditing of systems and every single property that is stored somewhere was scrutinized in long meetings. Less an engineering burden than a policy and legal burden.

klabb3 3y ago
A burden that is proportional to the amount of personal data the corporation collects sounds excellent.
- closeparen 3y ago
  The compliance burden is proportional to the complexity of the architecture. You could have vast quantities of highly invasive personal data written to a monolithic RDBMS, and it would be simple matter of following foreign key relationships. Or you could have a very minimal set of entities & transactions actually collected from the customer via the edge, but propagated through so many microservices, queues, logs, warehouses, pipelines, and derived tables that it's infeasible to comprehensively trace all the scraps. The latter is more typical of a consumer internet company AFAICT.
dmix 3y ago
I have a feeling a lot of HN devs overvalue the value of old data... probably because they have adblockers and dont know what ads they are targeted for. Youtube's algorithm seems to forget my interests after a year (or less), I often have totally new feeds than I did 6 months ago. When I got back into music production and also watched some airplane crash videos my entire feed became music + "dark stories" related content bringing non-stop music gear + engineering related education sites. Almost all ads I see on my phone via Google properties are related to the current thing I care about. Beyond biographic details which are 99% disconnected from my old individual instagram/fb data (FB can just buy some correlation between email/phone/IP from my credit card or private postage company or whatever) they probably only profile IRL off the last 1-2yrs of your browsing behaviour in most cases. The classic privacy invading ads usecase is a woman who is pregnant suddenly getting ads for kid stuff before other people they know they are pregnant. They probably won't be getting those ads a year later. At most they are now labelled as potential mother in some macro profile, but for day-to-day targetting it's all about the current thing she's looking at online. I'm not defending this stuff and macro details matter for privacy at the nation-state and higher level, but my general point is that it's a living machine, constantly adapting with a short timeframe of data to maximize utility, not one that cares much about what you googled a few yrs ago 99% of the time.

rodgerd 3y ago

> This must have been a painful engineering effort It would be less painful if it were a universal option, and they didn't have to test with a bunch of geo-linked options.

j45 3y ago

Could the limited EU accessibility to this engineering feat be broadened by users identifying as living out of Europe?

SOLAR_FIELDS 3y ago

Given that the people on these teams are reaping stock from the efforts of mining personal data for people over decades I have a very strong “not sorry” feeling about any sort of negative anything that employees of Meta might experience. I would even go so far as to say, fuck these people, I have no empathy for you. You decided to be a part of the problem, and sucks to suck