4 ms·

Facebook Timeline Remover: Works, but Malicious

40 points by vectorbunny 14y ago

islon 14y ago
The old problem of power vs. security. You can't trust your users will be smart enough to understand "this extension should't access all sites", but you can just block the functionality from all the non-evil developers.
dpeck 14y ago
Its interesting to me how anti-timeline people are that they're willing to seek out extensions to get rid of it. I'm not sure I understand it, but honestly I don't understand Facebook so much either. Why the hate for timeline from average users? And when would you ever be looking at your own timeline anyway? Disclosure: barracuda pay me to do stuff
- codemac 14y ago
  Two columns of text. It's a horrible reading experience. Who wants to flip back and forth back and forth with their eyes to read? A | B C | D It's like reading the House of Leaves except that I don't feel any more enlightened when I'm done. The actual construction of a timeline I haven't heard any of my friends really complain too much about.
  - dpeck 14y ago
    So people actually go searching out and reading others timelines? Seems so foreign to me. Against my better judgement I've been on Facebook for years and outside of the occasional look back on someone profile to see when their kid was born, got a new job, etc I never leave the newsfeed view. But, agreed on the horrible reading experience though, the only thing worse is A | C B | D style that academic papers still use. Edit: the above style is worse when reading on a screen of any sort, on paper fine, but screen inevitably leads to scrolling around and doing quite a bit of context switching
    - agscala 14y ago
      How is that worse? That is only 2 context switches whereas the facebook one requires 4
      - aw3c2 14y ago
        Websites are generally exceeding the screen space vertically. So when you scroll B and D suddenly have new content.
  - bradwestness 14y ago
    Although each status update is a discrete element, so it's not as if the dual column layout really matters. I mean, you're not reading a book-- it's more likely you'll read a status update and then expand and read the comments directly below it rather than reading a large number of statuses in a row. The news feed is still in a single-column format because you might actually read quite a few in a row of those. At any rate these extensions seem like an exercise in futility as Facebook will surely completely remove the non-timeline functionality sooner or later.
  - lotharbot 14y ago
    A lot of people have a problem with timeline selecting stuff from years past and making it more easily discoverable, or more "in your face". Those who've recently divorced don't really want to look at their own timeline and see a bunch of stuff with their spouse 2 years ago. Those who have grown in maturity or changed religious/political views don't really want some stupid thing they said 5 years ago to be a mere one screen-length from the top of the page. I personally am irritated with the "curated" experience. It ties in with sorting wall posts to "top stories" instead of by date. I know there was a discussion last month I want to get back to, but FB has decided it doesn't show up on my timeline or my friend's timeline, because it only gives a selection of posts from that month.
  - rhizome 14y ago
    The thing that gets me is, what's behind that? FB has many many well-paid designers and interface people...how did that flip model come to be? Is that really the best they can do with the resources of Facebook? I'm reminded of Microsoft (yet again)...
    - drcube 14y ago
      My guess is getting people to scan left to right rather than top to bottom increases ad views.
      - rhizome 14y ago
        By that token I would think that it's more like "a disjointed reading experience will allow for more cognitive 'slots' in which to place advertising."
    - leviathan 14y ago
      I had a phone interview for a engineer position at Facebook, and the interviewer told me that the timeline project began as an internship project that got traction.
      - rhizome 14y ago
        As I get older, one of my most peevish interpretations of some companies' development models is "putting their student loans to work."
  - mortenjorck 14y ago
    To reframe that question, who wants to read straight through someone's timeline like it's all a big blog post?
- slig 14y ago
  There's a Chrome extension to change the FB color with 600k users. There're things that normal people care that we, on our bubble, will have a hard time gasping.
goatslacker 14y ago
The funny thing is that people probably think this plugin will revert their timeline back to old facebook profile. Most users I know who dislike Timeline do so because they don't want you to see their timeline, they had no problem viewing other people's timelines.
xSwag 14y ago
Nothing new, a worm similar to this called LilyJade got a few million installs (using crossrider - a cross-browser extension thing) by spamming users facebook effectively bypassing csrf because they can read the webpage and spreading itself and banking the spammers a few hundread thousand dollars with CPA (survey scams - "please do this survey to unlock the content")
malenm 14y ago
I'm a little surprised that after inspecting each plugin and finding: "the first 3 plugins work well and do remove the Timeline after the user logins to Facebook. There is no suspicious activity." that the final conclusion is: "In conclusion, we would like to warn all Facebook users to not try any Facebook Timeline Remover apps or plugins." Why take issue with an unsuspicious app that works as advertised? It's a little unfair to the people who built these apps. Aside from the general privacy concern presented by every single FB / smartphone app which has access to some level of your personal data, it seems like this is being too specific in its claim that "Timeline removal apps are scams."
- Karunamon 14y ago
  >Why take issue with an unsuspicious app that works as advertised? #include <closed_sw_boilerplate_warning.h> Because you can't prove that the app isn't doing something suspicious. You know what it purports and appears to do, and you know that it needs access to your activity on facebook.com. Even then, it has an auto update mechanism, so even if it isn't doing something untoward now, it easily could in the future without you being the wiser. Knowing how much of the average user's life is detailed on Facebook, it's one thing that deserves extra scrutiny when it comes to allowing randoms to have access to it.
  - malenm 14y ago
    This was exactly my point - the fact you can't prove that the app isn't doing something suspicious is true of every app. Yes, there are a lot of personal details on Facebook. There are on your phone, too. These are not Timeline-removal app-specific. Yesterday, there was a post on Hacker News about the Wolfram Alpha Facebook Analytics [1] with very little concern about privacy (3 comments out of 104 mention privacy). My issue with this post is that it needlessly targets Timeline removal apps when it just seems to be making a general statement about being careful when installing any app. [1]http://blog.stephenwolfram.com/2012/08/wolframalpha-personal-analytics-for-facebook/ http://blog.stephenwolfram.com/2012/08/wolframalpha-personal...
    - 14y ago
languagehacker 14y ago
What the bloody hell is Google doing with the $5 we're supposed to pay them for review and submission to the Chrome store if they're not catching this stuff? I'm a vociferous Chrome user, but one thing I have to give Mozilla credit for above Google is that their add-on review process is free and quick. The unnecessary cost and additional process (e.g. requiring screenshots) are all reasons LikeBuster (https://addons.mozilla.org/en-US/firefox/addon/likebuster-for-firefox/ https://addons.mozilla.org/en-US/firefox/addon/likebuster-fo...) is available on Mozilla's Firefox add-on site but needs to be manually installed (http://github.com/relwell/LikeBuster http://github.com/relwell/LikeBuster) for Chrome. Knowing that the extra b.s. doesn't actually accomplish anything for user security really grinds my gears as someone who would like to make it as easy as possible for people to download my extension.
- quaunaut 14y ago
  It's obvious what it's for. $5 keeps people from quickly and easily just spamming the store with thousands of extensions, while still keeping it cheap enough that anyone can afford. It isn't for doing security screening, there's no way $5 would be worth the time of someone professional enough to look at your code for 20 or 30 minutes, God forbid if it's longer than that.
  - tptacek 14y ago
    You're obviously right (by approximately a factor of 50) but let me add: There is a way to make app review "for safety" scale at this price point: be ultra restrictive about what apps are allowed to do, and review them not as much for security as for compliance to API guidelines. •Cough•.
    - jaredsohn 14y ago
      >be ultra restrictive about what apps are allowed to do Chrome does this on some level via host permissions (http://developer.chrome.com/extensions/manifest.html#permissions http://developer.chrome.com/extensions/manifest.html#permiss...) and a content security policy (http://developer.chrome.com/extensions/contentSecurityPolicy.html http://developer.chrome.com/extensions/contentSecurityPolicy...) and is setting a more strict default security as manifest v2 gets phased in.
jaredsohn 14y ago
For people looking to greatly customize the Facebook UI using a non-malicious extension, check out Social Fixer (http://socialfixer.com/ http://socialfixer.com/), previously known as Better Facebook. Among (many) other things, it allows you to switch your timeline to show items in a single column. (Unfortunately, it will not disable timeline completely since the author feels the technique for doing that (pretending to be IE7 since timeline doesn't support it) is fragile.)
drcube 14y ago
Fluff Busting Purity, nee Facebook Purity, aka F B Purity (fbpurity.com) has been keeping my feed free of spam and other garbage for several years now. They've got a feature that removes timeline (from your view, other people will still see your profile as a timeline) that works fairly well. Also, I can change colors, so now my Facebook experience is Zenburned. I really can't recommend these guys enough, and it's too bad Barracuda didn't study them.
pohl 14y ago
This isn't what I was hoping it to be. I would love to have a browser extension that would iterate through every item, delete it and confirm the delete action. (In preparation for divorcing from Facebook entirely).
zavulon 14y ago
I've been using Facebook social fixer (http://socialfixer.com/ http://socialfixer.com/) and it's been great, turns Facebook back into a normal clutter-free experience. Plus, it has a "Friend tracker" which lets you see who've defriended you (vain, I know, but can't help it)

40 points by vectorbunny 14y ago

islon 14y ago

The old problem of power vs. security. You can't trust your users will be smart enough to understand "this extension should't access all sites", but you can just block the functionality from all the non-evil developers.

dpeck 14y ago

Its interesting to me how anti-timeline people are that they're willing to seek out extensions to get rid of it. I'm not sure I understand it, but honestly I don't understand Facebook so much either. Why the hate for timeline from average users? And when would you ever be looking at your own timeline anyway? Disclosure: barracuda pay me to do stuff

codemac 14y ago
Two columns of text. It's a horrible reading experience. Who wants to flip back and forth back and forth with their eyes to read? A | B C | D It's like reading the House of Leaves except that I don't feel any more enlightened when I'm done. The actual construction of a timeline I haven't heard any of my friends really complain too much about.
- dpeck 14y ago
  So people actually go searching out and reading others timelines? Seems so foreign to me. Against my better judgement I've been on Facebook for years and outside of the occasional look back on someone profile to see when their kid was born, got a new job, etc I never leave the newsfeed view. But, agreed on the horrible reading experience though, the only thing worse is A | C B | D style that academic papers still use. Edit: the above style is worse when reading on a screen of any sort, on paper fine, but screen inevitably leads to scrolling around and doing quite a bit of context switching
  - agscala 14y ago
    How is that worse? That is only 2 context switches whereas the facebook one requires 4
    - aw3c2 14y ago
      Websites are generally exceeding the screen space vertically. So when you scroll B and D suddenly have new content.
- bradwestness 14y ago
  Although each status update is a discrete element, so it's not as if the dual column layout really matters. I mean, you're not reading a book-- it's more likely you'll read a status update and then expand and read the comments directly below it rather than reading a large number of statuses in a row. The news feed is still in a single-column format because you might actually read quite a few in a row of those. At any rate these extensions seem like an exercise in futility as Facebook will surely completely remove the non-timeline functionality sooner or later.
- lotharbot 14y ago
  A lot of people have a problem with timeline selecting stuff from years past and making it more easily discoverable, or more "in your face". Those who've recently divorced don't really want to look at their own timeline and see a bunch of stuff with their spouse 2 years ago. Those who have grown in maturity or changed religious/political views don't really want some stupid thing they said 5 years ago to be a mere one screen-length from the top of the page. I personally am irritated with the "curated" experience. It ties in with sorting wall posts to "top stories" instead of by date. I know there was a discussion last month I want to get back to, but FB has decided it doesn't show up on my timeline or my friend's timeline, because it only gives a selection of posts from that month.
- rhizome 14y ago
  The thing that gets me is, what's behind that? FB has many many well-paid designers and interface people...how did that flip model come to be? Is that really the best they can do with the resources of Facebook? I'm reminded of Microsoft (yet again)...
  - drcube 14y ago
    My guess is getting people to scan left to right rather than top to bottom increases ad views.
    - rhizome 14y ago
      By that token I would think that it's more like "a disjointed reading experience will allow for more cognitive 'slots' in which to place advertising."
  - leviathan 14y ago
    I had a phone interview for a engineer position at Facebook, and the interviewer told me that the timeline project began as an internship project that got traction.
    - rhizome 14y ago
      As I get older, one of my most peevish interpretations of some companies' development models is "putting their student loans to work."
- mortenjorck 14y ago
  To reframe that question, who wants to read straight through someone's timeline like it's all a big blog post?
slig 14y ago
There's a Chrome extension to change the FB color with 600k users. There're things that normal people care that we, on our bubble, will have a hard time gasping.

goatslacker 14y ago

The funny thing is that people probably think this plugin will revert their timeline back to old facebook profile. Most users I know who dislike Timeline do so because they don't want you to see their timeline, they had no problem viewing other people's timelines.

xSwag 14y ago

Nothing new, a worm similar to this called LilyJade got a few million installs (using crossrider - a cross-browser extension thing) by spamming users facebook effectively bypassing csrf because they can read the webpage and spreading itself and banking the spammers a few hundread thousand dollars with CPA (survey scams - "please do this survey to unlock the content")

malenm 14y ago

I'm a little surprised that after inspecting each plugin and finding: "the first 3 plugins work well and do remove the Timeline after the user logins to Facebook. There is no suspicious activity." that the final conclusion is: "In conclusion, we would like to warn all Facebook users to not try any Facebook Timeline Remover apps or plugins." Why take issue with an unsuspicious app that works as advertised? It's a little unfair to the people who built these apps. Aside from the general privacy concern presented by every single FB / smartphone app which has access to some level of your personal data, it seems like this is being too specific in its claim that "Timeline removal apps are scams."

Karunamon 14y ago
>Why take issue with an unsuspicious app that works as advertised? #include <closed_sw_boilerplate_warning.h> Because you can't prove that the app isn't doing something suspicious. You know what it purports and appears to do, and you know that it needs access to your activity on facebook.com. Even then, it has an auto update mechanism, so even if it isn't doing something untoward now, it easily could in the future without you being the wiser. Knowing how much of the average user's life is detailed on Facebook, it's one thing that deserves extra scrutiny when it comes to allowing randoms to have access to it.
- malenm 14y ago
  This was exactly my point - the fact you can't prove that the app isn't doing something suspicious is true of every app. Yes, there are a lot of personal details on Facebook. There are on your phone, too. These are not Timeline-removal app-specific. Yesterday, there was a post on Hacker News about the Wolfram Alpha Facebook Analytics [1] with very little concern about privacy (3 comments out of 104 mention privacy). My issue with this post is that it needlessly targets Timeline removal apps when it just seems to be making a general statement about being careful when installing any app. [1]http://blog.stephenwolfram.com/2012/08/wolframalpha-personal-analytics-for-facebook/ http://blog.stephenwolfram.com/2012/08/wolframalpha-personal...
  - 14y ago

languagehacker 14y ago

What the bloody hell is Google doing with the $5 we're supposed to pay them for review and submission to the Chrome store if they're not catching this stuff? I'm a vociferous Chrome user, but one thing I have to give Mozilla credit for above Google is that their add-on review process is free and quick. The unnecessary cost and additional process (e.g. requiring screenshots) are all reasons LikeBuster (https://addons.mozilla.org/en-US/firefox/addon/likebuster-for-firefox/ https://addons.mozilla.org/en-US/firefox/addon/likebuster-fo...) is available on Mozilla's Firefox add-on site but needs to be manually installed (http://github.com/relwell/LikeBuster http://github.com/relwell/LikeBuster) for Chrome. Knowing that the extra b.s. doesn't actually accomplish anything for user security really grinds my gears as someone who would like to make it as easy as possible for people to download my extension.

quaunaut 14y ago
It's obvious what it's for. $5 keeps people from quickly and easily just spamming the store with thousands of extensions, while still keeping it cheap enough that anyone can afford. It isn't for doing security screening, there's no way $5 would be worth the time of someone professional enough to look at your code for 20 or 30 minutes, God forbid if it's longer than that.
- tptacek 14y ago
  You're obviously right (by approximately a factor of 50) but let me add: There is a way to make app review "for safety" scale at this price point: be ultra restrictive about what apps are allowed to do, and review them not as much for security as for compliance to API guidelines. •Cough•.
  - jaredsohn 14y ago
    >be ultra restrictive about what apps are allowed to do Chrome does this on some level via host permissions (http://developer.chrome.com/extensions/manifest.html#permissions http://developer.chrome.com/extensions/manifest.html#permiss...) and a content security policy (http://developer.chrome.com/extensions/contentSecurityPolicy.html http://developer.chrome.com/extensions/contentSecurityPolicy...) and is setting a more strict default security as manifest v2 gets phased in.

jaredsohn 14y ago

For people looking to greatly customize the Facebook UI using a non-malicious extension, check out Social Fixer (http://socialfixer.com/ http://socialfixer.com/), previously known as Better Facebook. Among (many) other things, it allows you to switch your timeline to show items in a single column. (Unfortunately, it will not disable timeline completely since the author feels the technique for doing that (pretending to be IE7 since timeline doesn't support it) is fragile.)

drcube 14y ago

Fluff Busting Purity, nee Facebook Purity, aka F B Purity (fbpurity.com) has been keeping my feed free of spam and other garbage for several years now. They've got a feature that removes timeline (from your view, other people will still see your profile as a timeline) that works fairly well. Also, I can change colors, so now my Facebook experience is Zenburned. I really can't recommend these guys enough, and it's too bad Barracuda didn't study them.

pohl 14y ago

This isn't what I was hoping it to be. I would love to have a browser extension that would iterate through every item, delete it and confirm the delete action. (In preparation for divorcing from Facebook entirely).

zavulon 14y ago

I've been using Facebook social fixer (http://socialfixer.com/ http://socialfixer.com/) and it's been great, turns Facebook back into a normal clutter-free experience. Plus, it has a "Friend tracker" which lets you see who've defriended you (vain, I know, but can't help it)