> Almost any barcode is assumed to be private information
I don't think that's really the case, I've deliberately embedded QR codes in images on Facebook. Your feature would be very annoying if it could not be toggled off.
I don't think that's really the case, I've deliberately embedded QR codes in images on Facebook. Your feature would be very annoying if it could not be toggled off.
Something like “This image contains the following info: <Sensitive info you didn't mean to share>. Would you like us to blur that out? (Y/n)”
User: srsly fb? OK
[0] https://www.iata.org/whatwedo/stb/Documents/BCBP-Implementat...
Case in point: app sandboxing. I, for one, don't want it, but it's everywhere.
Stuff like this should be configurable or over-ridable, especially when it has legitimate uses.
There will always be a balancing act between features, security and usability, to ram the needle one way and to say 'tough luck' to everybody else is not a solution because then people will try to find ways around the block.
For one feature that means we have
1,0 states (two states).
1,0/1,0 (four states).
1111111111 (1024 possible states).
Now as a programmer that frightens me because the possible paths through the system has become incredibly large for us to handle and it's a UX/UI disaster unless handled very carefully, you end up with features that interact with other features (set a do not back up flag on a file, then a different flag for always back up all files) in unpredictable ways for us and for users.
You see this complexity in things like hierarchical role based permission systems and the like.
Not sure what the solution is but I can understand why programmers and users push back on adding features (not least because as a programmer I know that doubling the complexity for 1-5% of users just seems like a poor trade off in general - there are of course specific cases where it makes sense like the 5% of users is roughly the percentage who are paying for your product etc.).
Thank you for pointing this out, it is a very important thing to realize and it applies to configurables, global variables and feature switches alike. The more you have seen of the guts of complex systems the more amazed you will be that they work at all.
You're basically evaluating the cryptographic merits of CSV.
I am not. I am weighing features vs unintended harm. Yes, the airlines shouldn't be including this data in the barcodes. It is improper to expose end users to this liability. And simply telling them not to expose them isn't a solution.
But if FB can detect harmful barcodes in an image, by all means they should remove the photo.
This is no different than Github scanning for AWS creds or MongoDB passwords in repos.
But Github doesn't do that either.
Amazon pays a contractor to scan Github repos for keys.
Facebook already scans the image, probably even for QR codes, they could prevent users from harming themselves. And airlines shouldn't expose this info in the first place.