10 ms·
We know what you're doing
- akozak 14y agoWell no, I didn't. But now I do that you're looking for and publicizing it, I guess?
- georgemcbay 14y agoI'm surprised there isn't a column for people who are reading Hacker News. This guy for example: http://www.facebook.com/profile.php?=743264506 http://www.facebook.com/profile.php?=743264506
- joering2 14y agoor this one http://www.facebook.com/gmcbay http://www.facebook.com/gmcbay
- dmix 14y agoHis username is his full name and its in his profile with his real email... thats not exactly noteworthy that you managed to find it.
- ffmmjj 14y agoIt's kinda scary to see your own facebook profile being posted on HN out of nowhere... =\
- Kenan 14y agoThat's because you're being redirected back to your profile since the URL the parent posted is incorrect.
- troels 14y agoyeah, but why doesn't it respond with 404 as would be appropriate?
- yread 14y ago"You want to see a page we don't have? Let me show you some ads instead!"
- troels 14y agoTechnically, a 404 page with ads on would be fine too ..
- mkjones 14y agoMost web sites don't 404 when fed unrecognized get params.
- troels 14y agoWhile that's true, I would kind of expect Facebook to do better than most sites. Oh, well.
- brlewis 14y agoFacebook tries to do whatever maximizes engagement. Technical correctness only matters when it serves that primary goal.
- troels 14y agoSome times a benefit can be indirect and hard to see immediately. Being "technical correct" reduces complexity, which again reduces costs down the road. For example, it makes it easier for third parties to integrate with your service, to name one benefit. It may never be clear for each individual feature, but violations compound to form a mess of unpredictability. Facebook generally appears to me as being a company with a very strong engineering culture and so it surprises me a bit that they would let something like this slip. Maybe I'm just not seeing the whole picture and it is a clearly thought-out tradeoff and not simply negligence.
- georgemcbay 14y agoJust to set any minds at ease after the initial shock: The link I posted is just a generic bad id link that ends up redirecting to your own Facebook profile if you are currently logged into Facebook. Anyone logged into Facebook will see their own profile. The link joering2 posted OTOH is actually to my Facebook profile. But: A) I don't really care (anything I put on my Facebook profile is assumed to be 1000% publically available information anyway). B) Turnabout is fair play
- deleted 14y ago[deleted]
- ffmmjj 14y agoDidn't know that one :)
- drivingmenuts 14y agoUm, your goat is trying to eat your head or something. That said, nice goat!
- Killswitch 14y agoI don't want to sound gay or anything, but you're handsome... Oh and the guy who's neck your kissing looks okay too.
- djeikyb 14y agoInterestingly, the string of numbers is a real user id. I presume it defaults to your own profile because facebook.com/profile.php goes to your own profile, and fb simply ignores the malformed parameters.
- edu 14y agoNope, the trick is that he's skipping the "id=" part between the '?' and the user ID, so the param is not being passed properly and thus the link is processed as just 'profile.php' without params. The link https://www.facebook.com/profile.php?id=yaddayadda https://www.facebook.com/profile.php?id=yaddayadda would work propperly.
- modarts 14y agoHaha, my heart momentarily jumped out of my chest when I clicked that.
- deleted 14y ago[deleted]
- gfodor 14y agoThis is a neat trick and reminds me of MCI codes from the BBS days. Basically, for a lot of BBS software (and usually enabled by default) visitors to your BBS when posting in discussion threads could insert escape characters (like "%UN") which at runtime would be replaced with metadata related to the person viewing the post at that time. So, if I were to post "%UN's mother was a hamster and father smelled of elderberries" as part of a thread when I viewed it it would say "gfodor's mother..." etc. You could have first name, last name, etc, so with some creative thinking you could post fairly convincing posts that would trick people into thinking you were actually legitimately mentioning them. I can remember many posts filled with angry replies from random users who went off the deep end when seeing that some random person on the BBS was trash talking them personally. Oops. Edit: And for the curious, the purpose of these codes was usually for people creating assets for the BBS. For example, when designing your home screen (an ANSI text file, basically), inserting the codes made it so the home screen would reflect information on the logged in user. Usually when enabled the interpolation happened anywhere, not just in user defined assets. (Of course as BBS software got more mature these types of pranks were not possible with default settings.)
- inoop 14y agoMy favorite BBS hack was that on some standard RA configs, unless explicitly turned off by the sysop, you could save received messages to disk even if you were just a normal user. This meant that you could send a message to yourself, i.e. 'del . /q /s' (or whatever zapped your dos disk, I can't really remember.), and then save it to 'c:\autoexec.bat' ... Other fun things where nailbombs, small .zip files that would expand to multiple gigs. When you uploaded those to early RA systems the virus scanner would attempt to unpack them and quickly fill up the entire disk, causing the BBS to grind to a halt. Kids these days have no idea what they missed :3
- pgeorgi 14y agoKids these days improved on the old pranks: http://research.swtch.com/zip http://research.swtch.com/zip
- 14y ago
- Jauny 14y agoits me. what's happening? ohuhoh nevermind :) Got shocked lol
- yread 14y agoFunny thing is that when you try to post it on your facebook wall the preview shows your profile. But when somebody else clicks it it takes them to their profile
- fchollet 14y agoPreviews on FB are loaded and processed in your own browser, and then results are uploaded to FB (to spare server load, I assume).
- BHSPitMonkey 14y agoI use PHP every day. I understand how this happens. I've known about this particular trick for years. ... My heart still stopped.
- yread 14y agoSearching for '743264506' reveals that it is actually quite an old trick. And the poor chap whose facebook profile number it is doesn't seem to be a geek so he probably didn't invent it
- TazeTSchnitzel 14y agoWhat? It isn't anyone's profile number. It's a random number in a broken profile URL.
- yread 14y agohttps://www.facebook.com/profile.php?id=743264506 https://www.facebook.com/profile.php?id=743264506
- TazeTSchnitzel 14y agoIt's a coincidence that any profile exists with that number. It's meaningless too, you could use ANY number.
- yread 14y agoSure you could. But do a google search on this one and compare it with a google search for a random number of similar length. Besides you can see from the search that it is this number that is used quite often with this trick
- TazeTSchnitzel 14y agoPeople have copied the URL, that's all. Similar URLs have also been copied. What is your point?
- yread 14y agoI was just saying that it's interesting that this number has such a history. I didn't expect it. And from your first reply it seems you didn't either. It is a profile ID not a random number and it has been used multiple times for this exact trick
- instakill 14y agoOh you sneaky bastard!
- talhof8 14y agoI'm also a programmer, and I know how it works but I got to admit you freaked me up for a while :-)
- stuaxo 14y agoOK, that was disconcerting to click.
- stuaxo 14y agoLol
- normalfaults 14y agoI wonder if there is a list of other sites like this?
- slig 14y agoSee also: http://openbook.org/ http://openbook.org/
- eulo 14y agoType "such a nerd". Commence rage.
- jaredsohn 14y agoHere are some more interesting terms courtesy of a TechCrunch article about FacebookSearch (now defunct) http://techcrunch.com/2010/05/14/your-public-facebook-status-updates-now-publicly-searchable-outside-facebook/ http://techcrunch.com/2010/05/14/your-public-facebook-status... “playing hooky” "don’t tell anyone", "rectal exam", "stupid boss", "HIV test", "control urges"
- mathewsimonton 14y agoGreat work and also this is a cool tool, makes me think of bing.com/social.(does Google offer something like this?) I would like to see a basic search implemented into weknowwhatyouredoing, though I understand its purpose as is. I'd also really like to see a region-based search option in one of these tools (beyond hashtags on Twitter, etc.)
- stfu 14y agoReminds me on the who-is-not-at-home syndication from Facebook and Twitter. Even so these are scary, I really think they provide excellent privacy teaching moments. Hope you are going to keep this up for some time and enhance it with other categories.
- Henwys 14y agoI find it odd that people are surprised by things like this. The information is very public.
- andreasvc 14y agoMaybe because they never consciously chose to make it public; that's simply facebook's default and IMO it's counter-intuitive that social interactions are made public.
- ComputerGuru 14y agoIn case it's not immediately obvious (no visible sign, even on hover), clicking on the people's names will take you to their facebook profiles.
- bob_kelso 14y agoHmm, looks like they removed this feature. It at least won't work for me (in neither chrome nor firefox). It is fairly easy to get a link to the profiles however: The urls to the profile-images look like this: "https://graph.facebook.com/[facebook https://graph.facebook.com/[facebook profile id]/picture" By replacing "graph" with "www" and removing "/picture" we get the url to the profile.
- lukevdp 14y agoI can't believe people are still publicly posting stuff about their bosses. Surely there has been enough press coverage about people getting fired for fb/twitter antics
- megablast 14y agoMost bosses do not have the time, wherewithal or care enough to do this. There is nothing wrong with people blowing of steam.
- lukevdp 14y ago>>Most bosses do not have the time, wherewithal or care enough to do this. Agreed. >>There is nothing wrong with people blowing of steam. And each to their own, but it's easy to make a post private instead of public, and doing so seems much more prudent to me.
- dinkumthinkum 14y agoI think this is so naive. Sure a "good" boss probably won't be snooping on his or her employees. However, I'm pretty sure most bosses are humans and humans tend to snoop on each other
- csallen 14y agoAu contraire, regardless of whether or not it's wise to diss your boss online, the last thing we need more of is mass knee-jerk reactions to information over-reported by the press.
- paganel 14y ago> I can't believe people are still publicly posting stuff about their bosses. It's a free world. People should be allowed to say whatever they want on whatever medium they want (as long as it's not hate-speech etc.)
- raquo 14y agoIt's also free in that the boss can fire you if he feels like it in many places.
- ChrisNorstrom 14y agoI can see this blossoming into a very titalating "Juicy Gossip" like startup involving delving deep into other people's lives. I own Jussip.com (Juicy+Gossip) hit me up if interested. My contact info(s) can be found on my blog ChrisNorstrom.com
- confluence 14y agoA great example that should remind people that it's probably best to assume that everything they say or do online (offline as well) is now (and forevermore) public. Assume that anything you say or do has the ability to be seen by anyone and everyone around the globe instantly - without any methods of recourse. The genie is out of the bottle. Hence one should adapt one's own behaviour and act accordingly (that doesn't mean that you should get paranoid - just be more careful :). Reduce risk and watch what you say from now on.
- fossuser 14y agoI've been saying this for a while too. There's no such thing as online privacy - privacy is dead. It's better that the default for most things online is public since any privacy setting is just an illusion of security. Of course there are some notable exceptions to this (encrypted backup services that encrypt locally before backup), but for the most part if it's online and at least some other people can see it - everyone can see it.
- adrusi 14y agousing encryption it's completely possible to make any information exchange as secure as it can possibly be without accounting for humans on the other end leaking the information.
- fossuser 14y agoThat's exactly the reason it isn't secure.
- EGreg 14y agoYeah, if you think that, then you should read this :) http://www.faqs.org/patents/app/20120110469#b http://www.faqs.org/patents/app/20120110469#b It took me a loooong time to figure out how to do privacy and social networking at the same time, using only web technology. Actually it can't be provably private using web technology because you have to trust the server -- which is why we need this: http://news.ycombinator.com/item?id=2024164 http://news.ycombinator.com/item?id=2024164
- treetrouble 14y agoWhat am I doing? Not giving a fuck about who is hung over or takes drugs
- farnsworth 14y agoIt's not a research tool... you're missing the point.
- treetrouble 14y agoYou're missing my point. That information is uninteresting to me no matter what the purpose of this site is
- Karunamon 14y agoThe point isn't that it's uninteresting to you, the point is that it may very well be interesting to stalkers, bosses, insurance companies, thieves, exes, "lost" relatives, arsonists, mother stabbers, father rapers, litterbugs, jaywalkers, identity thieves, nosy neighbors, and other undesirables. It's a thought experiment. Along the lines of YOU DOLTS, YOU REALLY SHOULDN'T BE PUTTING ALL THIS STUFF OUT HERE!
- treetrouble 14y agoYes, I understand that. The fact is that people drink and do drugs. Smart people, stupid people. That's reality. This is a "thought experiment" that teaches cowardice, IMO
- Karunamon 14y agoOn a purely ideal level I agree with you (the fact that at any time someone has been fired from their job for expressing personal opinions on non-company time does not sit well with me..), but the reality of it is, how many of these people do you think know that their info is on this site and/or accessible to quite literally anyone in the world? Of the people that know that, how many of them do you think understand the implications of that openness? This is why you lock down your privacy settings.
- jrochkind1 14y agoUntil I read the comments I didn't get what this was supposed to be --- ghostery for the win, blocks Facebook Social Graph and Facebook Social Plugin.
- skeletonjelly 14y agoRight but the data is still being collected via public postings on Facebook etc
- briandear 14y agoThis is freakin awesome. Nice work!
- iamdave 14y agoYou know what? Use that same GET method from the about page, mine for certain words, display analytics on a dashboard next to a stream and you've probably just put a few social media "consultants" out of work. /dastardlyGrin
- barbs 14y agoReminds me of youropenbook, which doesn't exist anymore :(
- stephen272 14y agoshould include twitter as well
- Henwys 14y agoI find it odd that people are surprised by things like this. The information is very public.
- chrischen 14y agoSad how most of these people fail to form a coherent sentence.
- pyre 14y agoImpressively they handle unique well enough. It still caught, "I hätë my böss" under "Who wants to get fired?"
- peterwwillis 14y agopeterwwillis tweets "I LOVE MY BOSS, HE'S THE SMARTEST, I CAN'T WAIT TO WAKE UP EARLY AND FIGHT TRAFFIC!!!" Am I doing it right?
- dasil003 14y agoSycophancy is more effective in person. You could waste a lot of time like this without getting your nose brown at all.
- intended 14y agothe phone number column is really bad form.
- intended 14y agoDoes someone actually think having visible phone numbers put up by unaware people scraped is a good thing? What am I missing here?
- johnchristopher 14y agoReading the comments I understand that it grabs public facebook data if you are logged, right ? Since I am currently logged and can't see any of my data it means that my facebook profile isn't public (or at least the data this page fetches aren't public) ?
- saraid216 14y agoNo. I viewed this on a browser where I'm not logged into Facebook.
- johnchristopher 14y agoWell I think I am totally missing the point then. The page doesn't display any info/statuses related to my fb profile or any of my fb friends. From my point of view it is just displaying random fb results obtained by keyword related searches performed against the fb public data accessible via fb API. As far as I am concerned and aware of nothing in my profile is public.
- andreasvc 14y agoIt's simply displaying public data that has been scraped before-hand (so nothing to do with your own profile). It abuses the fact the people's profiles are public by default, something that people are probably not aware of.
- daviddi 14y agoHaha: Who's hungover? Murray Heather Not Hungover AT ALL, I love these mornings!
- gurraman 14y agoAnother interesting column: "Who's out of town?". I wonder how burglers use social networking.
- Deestan 14y ago> I wonder how burglers use social networking. Allegedly, they do pay attention to tweets from people they can find the home address of. http://www.telegraph.co.uk/technology/news/8789538/Most-burglars-using-Facebook-and-Twitter-to-target-victims-survey-suggests.html http://www.telegraph.co.uk/technology/news/8789538/Most-burg...
- praptak 14y agoI have some doubts about the site's disclaimer: "I cannot be held responsible for any persons actions as a result of using this experiement." If someone gets fired upon a comment you took out of context and put under "people who want to get fired" then I wouldn't bet the above statement as your best line of defence in a lawsuit.
- andrewfelix 14y agoAgreed. I up voted the link, but I think the same message could have been conveyed with garbled names and numbers.
- jahewson 14y agoThat's a terrible disclaimer. You can't just disclaim your way out of statutory liability. There's probably nothing to worry about with re-publishing an already public fact, but the cases where errors are made e.g "I'd hate to be my boss" filled under "People who hate their boss", the casual reader may be confused (some might say mislead). The solution is just to keep people informed, so your disclaimer may say something like: "the information on this site is automatically collected from public posts to Facebook. Posts are classified automatically, and as such our classification of their sentiment may be inaccurate." Also, just in case one of the Facebook posts says something defamatory, hate speech, etc. you can gently remind people that you didn't write, edit, or approve of the content so "are not responsible for the content of messages".
- leke 14y agoIf you click one of these profiles, you can't see those messages, so how does this guy do it?
- icoder 14y agoThis could have been done a little more sophisticated. Now it seems nothing more than some basic text searches. For instance two people saying "Not Hungover AT ALL, I love these mornings" and "Hungover !" respectively are both in the hungover section. And in the doing drugs section there was one guy who was happy he actually quit.
- andreasvc 14y agoThat's a nontrivial problem to solve. Consider "I avoided becoming hungover again!". In other words, you'd have to do a full semantic analysis and get the scope of negations right. I hear that current sentiment analysis techniques use a heuristic by looking for a nearby negation.
- josteink 14y agoNone of the posts have any likes. Now I don't feel so bad about my own ignored facebook posts ;)
- sparknlaunch 14y agoI think most have missed the point of the massive upside of aggregating Facebook data. Sure the initial experiment may have selected some low value categories, however the site shows the technology works. Is anyone here using twitter or Facebook data for commercial purposes?
- ps2000 14y ago99th percentile of people who either don't care or are not able to care about privacy
- Jgrubb 14y agoWhy use jQuery 1.3.2?
- nathanb 14y agoNeeds an RSS feed for data mining purposes...
- dreadsword 14y agoI'm guessing the site is making an API call to pull each user's thumbnail. Remember, your capped at 350 API requests per hour per APP ID. You should cache image links to avoid all the broken image icons.
- godisdad 14y agoHilarious. Reminds me a bit of http://pleaserobme.com/ http://pleaserobme.com/
- russtrpkovski 14y agoSome 18 Year Old Made A Site That's Going To Get People Fired For Using Facebook http://www.businessinsider.com/lock-down-your-facebook-privacy-settings-2012-6 http://www.businessinsider.com/lock-down-your-facebook-priva...