Hacker News Reader

Comment by CapitalistCartr | Hacker News Reader

Orin Kerr is the country's leading attorney on Computer Crime Law(1) and The Volokh Conspiracy writers are a powerhouse in Constitutional Law generally. Its almost certainly too late for Vachani and Power Ventures; Facebook have destroyed them, and any ruling is only symbolic, but for the rest of us, a correct ruling is essential for the future of a free Internet.

Here is Orin Kerr writing about Power Ventures: https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...

1) https://www.washingtonpost.com/news/volokh-conspiracy/wp/201...

View on HN

After Power's IP addresses were blocked by Facebook, couldn't Power use the user as proxy to access Facebook instead? In other words, have the user (through some Power provided tool I suppose) access Facebook and feed Power the information it wants to send.

You could probably do so with a browser extension.

I made a quick hack to demonstrate this a few years ago. I didn't maintain it and couldn't find another developer to take over, so it doesn't work anymore. http://devesh.github.io/SuperShareBox/

The problem is that this probably violates Facebook's TOS. Enabling a TOS violation for users as a business model would make for a pretty easy tortious interference lawsuit by Facebook against Power.

It seems like it would be pretty hard to draft TOS that prohibit the user from running a program on their own machine that requests, processes, and outputs data on the user's behalf without banning more traditional user agents like web browsers and proxies.

If I remember correctly, Facebook prohibits users from supplying third parties with their Facebook Login credentials for the purpose of that third party logging in on their behalf.

Edit: From Section 4(8) of the Facebook TOS [1]:

"You will not share your password (or in the case of developers, your secret key), let anyone else access your account, or do anything else that might jeopardize the security of your account."

[1] https://www.facebook.com/legal/terms

How does that apply to the suggested workaround of the user running the necessary content scraping on their own machine and pushing the results to Power?

To be specific, we mean like a chrome plugin or something at that level, right?

Such a tool wouldn't need to provide the FB credentials to the third party, only in the application, or as-mentioned a browser itself, with an extension.

Usually the trick is to add in something like "...at Facebook's discretion...".

What would be at Facebook's discretion? Are you suggesting that their TOS could dictate what web browsers you're allowed to use to access Facebook, or whether you're allowed to store and make other personal use of the information they send you?

It's impossible for something like Facebook to use a whitelist model for determining what you use to interact with their service, and they can't retroactively add things to their blacklist. They usually have to rely on generic rules about causing harm to the service, but then it's no longer a pure whim.

No, I'm suggesting that the TOS could dictate that whether you are allowed to do it or not is entirely at Facebook's discretion, and they could choose to say that it isn't okay.

A lot of software licenses have a clause that basically allows the licensor to revoke the license on a whim.

Facebook can always give themselves the option to unilaterally decide to no longer serve you going forward. But that's not the same as Facebook being able to declare that arbitrary behavior is retroactively in violation of an open-ended clause of their TOS and therefore grounds for lawsuits and CFAA prosecution.

Power Ventures could probably start back up from the payout that will be coming from FB when things are resolved.

Uh, what payout? The 9th circuit essentially ruled that his attempts to access Facebook servers after the cease-and-desist letter were illegal. Unless I'm reading this wrong, he lost, and is criminally liable.

Its resolved when SCOTUS rules, but I don't hold high hopes. I think a payout is unlikely, and anything much beyond legal fees is in lottery territory.

Facebook brought a malicious action under the CANSPAM act when it had no basis for doing so. That action, in part, resulted in the loss of Vachani's business and livelihood. Facebook will need to compensate for the loss they caused.

> it had no basis for doing so

Several lower level judges disagreed with you. Although I think that the CANSPAM act ought not apply, there is no basis to claim that this was clearly settled law being ignored to make this into a malicious action.

And high judges agree.

Facebook claimed[0] that emails it sent to its users were misleading, partly, because Facebook inserted "Thanks,\nThe Facebook Team" into messages it sent out as a result of Power.com's actions.

Facebook claimed[0],

    64.    The message, drafted by Power.com, is signed by "The Facebook Team", which is both misleading and false.

If the findings [1] of the higher judges are correct, then it appears that Facebook previously argued that it constructed false evidence against Power.com -- and used it in a legal attack that destroyed Vachani's life.

[0] http://graphics8.nytimes.com/packages/pdf/technology/2009010...

[1] https://cdn.ca9.uscourts.gov/datastore/opinions/2016/07/12/1...

The message is at page 10 of the PDF on link[0] above, page 12 of the complaint. (pdf and complaint page numbers don't match up)

It's clear to me that this was a spam/phishing message.

1. Comes from @facebookmail.com

2. Signed "The Facebook Team"

3. Includes only links to facebook.

4. In the footer, "Want to control which messages you receive from facebook..." facebook link.

--- Now, they obviously created a facebook event as a promotion and invited people on facebook to that event in order to generate those messages, so there is a bit of a grey area, but it's clearly a power.com email and there's no message of power.com other than:

Event: Bring 100 Friends and win 100 bucks

What: Reunion

Host: Power

Start Time: date

End Time: date

Where: Power

--- It's an unethical use of Facebook's systems at the very least, and spells out a pretty big hole (hopefully filled by now) that opens facebook users up to scams because the originator is obfuscated.

The message was determined not to be spam, but regardless, Facebook constructed and sent that message.

As far as I can tell from these documents, Power setup a Facebook event, then Facebook added it's own text (eg. "The Facebook Team") to the event message and sent it as an email to its own users. Then, Facebook took down Vachani based on those emails.

"Will need to be persuaded to compensate," i.e., sued, which will take probably 2-5 years to complete because it will be cheaper to bill lawyers than payout potentially millions to Vachani.

A big problem with our legal system is that it favors those with more money in every way - the rich can lever more cases, better cases, more often. They can afford to appeal at every level, to pay lawyers to look for hundreds of little loopholes. And they are essentially immune to being sued because not only can nobody afford to even begin procedures, once they do, all the more enriched party needs to do is fend off attacks long enough for their opponents' funds to run out.

> A big problem with our legal system is that it favors those with more money in every way - the rich can lever more cases, better cases, more often.

The legal system is not the only institution affected by this.

Yes that is and has been the way of the world. But we at least like to pretend or want that to be not the case. Also legal system was suppose to be the place to go when in other system (administration and such) fails to protect the poor and weak.

I guess the question will be can Facebook block a user if they act on the behalf of another user. It seems unlikely.

Reply on news.ycombinator.com