Hacker News Reader

Comment by titzer | Hacker News Reader

Hey Facebook, if you got nothing to hide, show us the code.

We showed you our friends, our relationships, our interests, our intimate and disarmed states, our rants, and probably half of the websites we visited. (in retrospect, that was dumb)

Oh, your tin can and strings might show? Competitors might get ideas? Please.

Until then, not a fan of you, not clicking on your ads, and generally avoiding your site. In fact I think I'll start deconstructing my profile as soon as I can muster the courage to choke back my gag reflex.

Sincerely, A growing group of mugged social network burnouts.

View on HN

How does viewing the code give you confidence that the app is running the code you saw?

You can pretty easily compare compiled binaries.

That's assuming you can replicate their build process exactly and that process produces perfectly reproducible builds.

Or you could just run the code you compiled yourself?

Can you? I was under the impression that perfectly reproducible builds were still very much a hard and open problem.

Furthermore, I believe that the Facebook app codebase is massive in scope and highly illegible due to most of it being auto-generated from other codebases. It has over 18,000 classes on iOS. The odds of anybody being able to meaningfully audit that are pretty low.

Which code ? Server side code is unreasonable to expect. For client code, you can just use the browser. It may not be as convenient or full featured as the app, but it'll do the job if you absolutely must use FB. The situation is much better with stuff like FB which is not that essential. It's more problematic with Google Maps, where you can't get turn by turn navigation unless you use the app.

> Server side code is unreasonable to expect.

Honest question: why would it be unreasonable for us to expect server-side code to be open-source? Facebook's value lies in its brand and its infrastructure, not in its code, so there's no risk of upstarts taking Facebook's code and standing up a clone (which, even with the code, is way easier said than done).

Because it would highlight all the things they do which users would find unsavory. Rather than e.g. just speculating about what facebook does with our mic, we'd be able to point to where they do it in the code.

Because you have no way of knowing that the server side code you're looking at is the server side code running.

First let's talk about value, because it is relative for different audiences (and my take is obviously not canonical either). For Facebook's users, the value is primarily the network. For Facebook's partners, the value is converting sales from users engaging with advertisements.

Facebook must offer enough to the users that the network is still worth coming back to while still giving advertisers a chance at having their eyes. A major breach could cause user and partner abandonment because of security concerns. Once the genie is out, there is no putting it back in. Their stock will fall faster than they can rewrite the product.

It is unreasonable for us to expect open-source for server-side code because it exposes Facebook (and potentially it's users) to a lot of risk for only a small upside. 1) While open-source software has myriad benefits, those benefits require the public at large to audit their code as it is being continuously changed and deployed. Can we keep ahead of the criminals exploiting freshly merged and deployed commits? 2) Knowing the source code is one half the battle, the other half is knowing what is actually executing at runtime. How would users verify this to get the value of open-source? 3) Open-sourcing server side code of Facebook could have serious negative consequences for users or Facebook in the event of a breach due to intimate knowledge of the system only afforded by being privy to the source code.

Not a point, but a philosophical question: *) Where does this stop being virtuous? Should Microsoft open-source SMB tomorrow? Would you feel comfortable with that?

Edit: grammatical fixes

>Facebook's value lies in its brand and its infrastructure

Isn't code infrastructure?

Agreed. I've only been using facebook through my phone's web browser and (at least for what I do) it's totally fine. Is there something the app gives you? Maybe for folks who use messages or want notifications...?

>Maybe for folks who use messages or want notifications...?

Yeah, at some point they blocked the mobile browser from working with messages. I think you can circumvent it by changing your user agent string to a desktop browser.

Sending a desktop user agent string works. Even easier is using mbasic.facebook.com, which is still available and works with messages.

They are VERY pushy about installing the app which is quite fishy. Now all photos have banners saying "Photos look better in the Facebook app" etc

How is it fishy? Native app delivers a 'better' experience and lets Facebook do the things that make you (supposedly) use it more, like push notifications and location tracking, sharing photos + videos, etc.

I just don't know why it thinks any of this is better.

I also hate the fact to even look at my messages I have to "refresh as desktop site" on iOS

You don't know why anyone would think that a native app can deliver a better feature set than a website?

Why couldn't you decompile the apps to see what it's doing?

Reply on news.ycombinator.com