Hacker News Reader

> that was a big mistake

Zeynep Tufecki does a good takedown of Facebook's "14-Year Apology Tour" [0].

It's a long-term, calculated, deliberate strategy to methodically abuse privacy with disastrous consequences, then when caught dead-to-rights, say "oops, sorry, made a mistake, we'll fix it".

This game worked amazingly well for 14 years, will people fall for it again this time?

[0] https://www.wired.com/story/why-zuckerberg-15-year-apology-t...

I love that the URL says "15 years"

Apparently Wired's editors take care to fix even small errors of fact.

Future proof :)

The very idea that Facebook didn't know how their product was being used an that they did not intentionally leave those data policies in place so that companies could take advantage of them is beyond the pale. This is a premier data collection firm whose product is their users. They would have us believe that Facebook is completely incompetent regards to which data is being used extracted or available, or this apology is tantamount to a big fat lie.

> "I hope you understand, this is not how I meant for things to go, and I apologize for any harm done as a result of my neglect to consider how quickly the site would spread and its consequences thereafter,” wrote a young Mark Zuckerberg. “I definitely see how my intentions could be seen in the wrong light.”

More like the Non-Apology Tour.

Here is a humorous and accurate blog post about testimony:

http://neverusefb.blogspot.com/2018/04/accurate-reponse-to-f...

Hopefully the EFF is getting a big surge in donations from this latest outcry over privacy.

You can donate here: https://supporters.eff.org/donate

Worth noting that some payroll systems allow you to set up automatic donations to charities like the EFF. I know Gusto did.

edit: looks like some payroll systems may take a cut. Be wary, or set up recurring donation directly.

I wanted to do this, but 7.5% is taken out before the money gets to the charity. That is more than credit card processing fees! I no longer use that option and donate directly. Doing that does increase the amount of work to do your taxes if you itemize deductions though.

This is not going to gusto, but it taken out as part of the services provided by FirstGiving their partner to handle the donations: https://support.gusto.com/hc/en-us/articles/220929687-Charit....

Oh, I had no idea. In that case no I wouldn't use that, I'd set up a recurring donation directly. (I recently changed payroll processing and haven't transferred the donations yet).

Just got my hoodie.

That being said, I do not think giving money to eff is enough to get the changes necessary to be implemented. I am at a loss for what could be done you actually make change happen and am open if anyone has suggestions or other links to take a look at.

I don't think there's a better group to fund than the EFF. They're just about the only reliable lobbying group out there advocating for users, and considering how small they are, they're doing a hell of a lot of it.

You can call your representative or vote/elect/run for a position.

I admire the libertarian sentiment on HN but I think it would be greatly beneficial to everyone to have more thoughtful, smart and balanced people running our Governments.

Here's my bazillion-dollar question: How do you practically motivate those people to enter and stay in government? The insanity of the system is maddening, and even hard-fought positive progress is glacial compared to the private sector. I know smart, thoughtful people who considered government and finally decided they'd be far happier in the private sector.

Maciej (Pinboard / HN user 'idlewords') has been doing great work finding such people who are running and supporting them to get elected.

The progress is glacial because the private sector wants it to be and can afford to make it that way.

“Smart, thoughtful” people who are happier in the private sector is exactly who currently runs our governments. So your plan is already in action.

Large-scale change is hard, and I don't have good ideas for how to force it -- I'm just some random internet schmuck, not a clairvoyant genius. At a small scale, delete your FB account and install a tracking blocker. Going slightly larger, help your non-nerd friends to do the same. Network effects work both ways.

If you have time and money left over after that, the EFF isn't the worst place to spend them.

Start a local Electronic Frontier Alliance group and work in your local community to build additional support for issues you care about.

https://www.eff.org/fight

I wish the EFF offered guidelines and a certification for companies to show they are following best practices for user data. I guess GDPR is the same thing but it’d be nice if some bucks went into the EFF’s pocket to fund lobbying on our behalf.

I have a data intensive startup and I would love to show we comply.

GDPR only applies in the EU.

Facebook already declared that they won't extend their GDPR compliance globally. So if you're in the US, you're not protected by it.

But it also applies to EU citizens living outside the EU. So the use cases get complicated.

Seriously? I did not know that. How would that work?

Edit: Just read Wikipedia and another source and both define it for people within the EU. They do mention whether the company is outside the EU and how they would need to handle the data for people within the EU.

I don't think this is true. It's not totally clear but GDPR seems to require people to be in the union. I believe that residency is the main requirement, not citizenship (a German person living in the US dealing with a US-only company is not covered).

>The bullet points of "fixes" that MZ outlined don't really address the fundamental problem. Facebook's "data privacy" problem is not fixable if they have to ultimately run valuable ads against that data.

I wholly disagree. They don't have to disclose the data to anyone in order to use it to target ads. Their targeting system works by allowing advertisers to specify targeting criteria, and then using logic on Facebook's own servers to match users to targeted ads. They aren't selling or disclosing the data to anyone. People keep conflating the CA situation with the business of targeted ads. One has nothing to do with the other.

One word: Equifax

...another word: NSA

And when someone clicks on a targeted ad, is their identity still private? Or does the company get a handy referrer that allows them to correlate that user's Facebook profile (and hence real name) with the specific criteria they paid to filter by?

It seems to me they have quite a lot to do with each other, in that Facebook has an enormous amount of valuable personal information about people (which in many cases was extrapolated without the target's consent, as opposed to explicitly given), and is entirely reckless about where this data ends up, as long as it isn't actually "public" as such.

Yes their identity is still private. Facebook’s referrer policy does not allow the browser to send a full referrer. The receiving site simply sees Facebook.com as the referrer.

Your argument makes sense as long as you consider something “private” if it’s shared with Facebook itself.

You might, if you consider your personal interests to be consistently and permanently aligned with the ToS which best serves shareholder interest of the entity which controls the exploitation of the historical data, and on-going surveillance capability.

The data is pretty much unregulated, and there’s no reason for it to ever be deleted; given it’s size and value it’s likely to live-on much longer than Facebook (the company/legal entity) as we know it today. If they got in financial trouble, the prudent thing would be to flog the lot to a data broker to be resold and repackaged indefinitely.

Facebook themselves have a long established reputation for doing whatever they like and apologizing only if and when they get caught, and doing the minimum possible to ward off regulation or churn.

Just like the use of the term “breach”, there’s a broader use of the term which makes sense given the expectations of a user-base that’s been kept in the dark for years (as opposed to technical people with an understanding of the industry).

For example, my contact list is not “private” if it’s exfiltrated from my phone without my knowledge or consent, to be used for whatever purpose makes most money to whoever controls it (currently Facebook), against a ToS which can change at any time without notice, with almost no legal protection, regulation, or oversight.

Your argument makes sense as long as you consider something “private” if it’s shared with Facebook itself.

If you consider something so “private” that you would be upset that an algorithm on a secure serve might use it to target an ad to you - after you read and agreed to exactly that behavior when signing up - perhaps you shouldn’t have given it to them in the first place. At what point do you take personal responsibility for giving away this information you consider to be so private and valuable?

> At what point do you take personal responsibility for giving away this information you consider to be so private and valuable?

Informed consent seems like a reasonable place to start.

Yes, you were informed when you signed up. Your failure to read TOS, but agree to them anyway, is nobody’s fault but your own. This whole culture of “well yeah, I did it, but obviously that doesn’t mean I am responsible for it” is ludicrous to me. We are all responsible for our own choices in life.

Where is the consent of users that are being tracked outside of Facebook and are not part of it?

I don't understand why nobody is talking about the even bigger issue that Facebook (and Google and every other ad service) gets to see what people are visiting and when (articles, videos, porn, ...)!

Imagine the detailed profiles you can create with that amount of data...

Your conclusion doesn't really make sense. The EFF was talking about this data being shared with app developers, they were not talking about Facebook collecting this data. Facebook only needs to do the latter to run ads against it.

> That goes for [...] data privacy. We didn’t take a broad enough view of our responsibility, and that was a big mistake.

Judging from [1], this wasn't any "mistake":

They came to office in the days following election recruiting & were very candid that they allowed us to do things they wouldn’t have allowed someone else to do because they were on our side.

This was a deliberate policy of allowing people "on their side" to access and use these data. Now, when it turned out people on the "other side" can do it too, it became a "big mistake" suddenly.

[1] https://twitter.com/cld276/status/975568208886484997

> Facebook's "data privacy" problem is not fixable if they have to ultimately run valuable ads against that data.

Do you have a citation for this? I've been trying to clarify the argument recently and am looking for other perspectives.

With up to 2 billion people already profiled by unethical 3rd parties using big data to spot the correlations between likes and behavioural patterns, the privacy ship has in effect already sailed unless all those users delete all the post likes, pages they follow etc. Facebook can’t fix this without throwing the advertising revenue baby out with the micro-targetting bathwater.

There's some irony in the current situation. FB created the Skinner box that harvested the information, then essentially gave it all away to anyone who could write a "viral" app, from Cambridge Analytica to Zynga. The data's out there, and if FB makes changes to let users actually delete their copies, it doesn't matter for anything harvested before 2015 or so.

To use a wildly over-dramatic metaphor: this is what nuclear winter for data looks like. Sure, all the explosions are done, but the fallout will continue for quite some time.

I think your wildly over dramatic metaphor is still wildly optimistic in assuming that the explosions are already done. I agree the fallout will continue, but I seriously doubt we have seen the worst of how bad this can get.

Sadly you may be right, but quite a few of the major surveillance companies have already been looted: Yahoo, then Equifax, then Facebook. Maybe Google hasn't (yet, that we know of), but it's probably just a matter of time. Fortunately, other than the "psychographic" woo-woo promoted by various organizations, that stuff has a relatively short half-life, and it seems like quite a few people are aware of the problem.

Think of it like nuclear power: it has both advantages and problems, and it seemed inevitable until Three Mile Island, Chernobyl, and Fukushima killed it. What if we're watching the general public become aware of the downsides of the surveillance economy?

> It was my mistake, and I’m sorry.

read in the voice of the South Park version of Tony Hayward.