4 ms·

Short term this may be a problem, but long term it's probably a good thing. Hopefully once people become aware of what they're exposing they'll become more caut

Short term this may be a problem, but long term it's probably a good thing. Hopefully once people become aware of what they're exposing they'll become more cautious. Complaining about News Feed and Graph Search is basically saying you're ok with "security through obscurity". If I understand correctly, all of this information is already available to those who want to dig deep enough.

misiti3780 14y ago
spot on!
troymc 14y ago
While it's (probably) true that the information is already available, it's not easily available. If it's going to take me 25 days of tedious profile reading to find people who I seek (e.g. "Lesbian women from Greece who like Doritos"), I'm not going to do it. It's not practically available. Graph Search changes that. Obscurity vanishes, along with any security it provided.
- Aissen 14y ago
  By 25 days of profile reading, I think you mean 2 days of writing a scraper and 10 days of tuning it? The rest being spent letting it run, reading hacker news, reddit, and your friends' facebook updates.
  - deleted 14y ago
    [deleted]
  - troymc 14y ago
    Facebook doesn't let any random bot crawl Facebook with scrapers. If you go to: https://www.facebook.com/robots.txt https://www.facebook.com/robots.txt it says: # Notice: if you would like to crawl Facebook you can # contact us here: http://www.facebook.com/apps/site_scraping_tos.php http://www.facebook.com/apps/site_scraping_tos.php # to apply for white listing. Our general terms are available # at http://www.facebook.com/apps/site_scraping_tos_terms.php http://www.facebook.com/apps/site_scraping_tos_terms.php (Then there's a bunch of "Disallow:" statements for Baidu, Google, etc.) If you follow the link, you can apply to Facebook for permission to do "automated data collection." Even if you do get permission, Facebook is very restrictive with what you're allowed to do with the scraped data.
- tlrobinson 14y ago
  You might not do it, but the organizations with resources and power to actually harm you certainly could.
flyinRyan 14y ago
> is basically saying you're ok with "security through obscurity". You already said you were ok with "security through obscurity" when you logged in with a password.
- tlrobinson 14y ago
  Huh? Passwords aren't considered "security through obscurity". http://stackoverflow.com/questions/4486171/isnt-a-password-a-form-of-security-through-obscurity http://stackoverflow.com/questions/4486171/isnt-a-password-a...
  - flyinRyan 14y ago
    The very first answer to the question you posted seems to disagree. They poster basically points out that when people say "security through obscurity" they don't mean passwords. Well, of course they don't or they'd realize that security by obscurity is valid and used successfully every day. You just need more than one layer of protection. Passwords alone aren't enough, trying to obscure the port number of your service isn't enough, etc.
    - tlrobinson 14y ago
      By your definition basically all computer security is security through obscurity. After all, crypto keys are really just obscure numbers that could be guessed. The only exception would be an air gapped network. But wait, what if someone figured out the passcodes and physical keys to enter the building?!

misiti3780 14y ago

spot on!

troymc 14y ago

While it's (probably) true that the information is already available, it's not easily available. If it's going to take me 25 days of tedious profile reading to find people who I seek (e.g. "Lesbian women from Greece who like Doritos"), I'm not going to do it. It's not practically available. Graph Search changes that. Obscurity vanishes, along with any security it provided.

Aissen 14y ago
By 25 days of profile reading, I think you mean 2 days of writing a scraper and 10 days of tuning it? The rest being spent letting it run, reading hacker news, reddit, and your friends' facebook updates.
- deleted 14y ago
  [deleted]
- troymc 14y ago
  Facebook doesn't let any random bot crawl Facebook with scrapers. If you go to: https://www.facebook.com/robots.txt https://www.facebook.com/robots.txt it says: # Notice: if you would like to crawl Facebook you can # contact us here: http://www.facebook.com/apps/site_scraping_tos.php http://www.facebook.com/apps/site_scraping_tos.php # to apply for white listing. Our general terms are available # at http://www.facebook.com/apps/site_scraping_tos_terms.php http://www.facebook.com/apps/site_scraping_tos_terms.php (Then there's a bunch of "Disallow:" statements for Baidu, Google, etc.) If you follow the link, you can apply to Facebook for permission to do "automated data collection." Even if you do get permission, Facebook is very restrictive with what you're allowed to do with the scraped data.
tlrobinson 14y ago
You might not do it, but the organizations with resources and power to actually harm you certainly could.

flyinRyan 14y ago

> is basically saying you're ok with "security through obscurity". You already said you were ok with "security through obscurity" when you logged in with a password.

tlrobinson 14y ago
Huh? Passwords aren't considered "security through obscurity". http://stackoverflow.com/questions/4486171/isnt-a-password-a-form-of-security-through-obscurity http://stackoverflow.com/questions/4486171/isnt-a-password-a...
- flyinRyan 14y ago
  The very first answer to the question you posted seems to disagree. They poster basically points out that when people say "security through obscurity" they don't mean passwords. Well, of course they don't or they'd realize that security by obscurity is valid and used successfully every day. You just need more than one layer of protection. Passwords alone aren't enough, trying to obscure the port number of your service isn't enough, etc.
  - tlrobinson 14y ago
    By your definition basically all computer security is security through obscurity. After all, crypto keys are really just obscure numbers that could be guessed. The only exception would be an air gapped network. But wait, what if someone figured out the passcodes and physical keys to enter the building?!