Hacker News Reader

Comment by test42 | Hacker News Reader

I feel like whoever wrote this article missed the point completely.

For the internet to function, websites need your information. If you want to log into a website using Facebook login, Facebook needs to know what website you are logging into.

When you watch a Youtube video on someone else's website, in order for that data to be sent to you they need to know what your IP address is and they need to know what website you are viewing the video on.

This is how the internet works. You cannot access something from someone else's servers without them knowing what your ip address is.

Are we invading people's privacy when we log ip addresses when someone visits a website hosted on our servers now?

View on HN

Agreed, I found Facebook’s explanation perfectly adequate and respectable. They are basically explaining cookies and embeds/iframes to a non-technical audience — no more, no less. It makes sense to give other examples like Google ads and Twitter buttons in this context.

> They are basically explaining cookies and embeds/iframes to a non-technical audience — no more, no less.

Right but the main question was whether they were getting data on people from data brokers, and they responded by answering a completely different question.

"If you want to log into a website using Facebook login, Facebook needs to know what website you are logging into."

Agreed. But what if you don't want to log into that website, or maybe that site has no login at all. If it has a Facebook "Like" button, that site still sends a ping back to Facebook, letting them know you were there, and feeding Facebook's algorithm about your interests. Same goes for Google Analytics, a Twitter share button, or the growing list of tracking scripts which get executed upon page load without even showing a visual indicator that they serve some purpose.

I'd guess that the vast majority of visitors have no idea that by visiting a 3rd party site, they're feeding that visit to the list of 3rd party trackers you find on many sites today.

If people were educated with how the internet works they would know that the second you load some piece of content from someone else's servers they have your information as well.

> If people were educated with how the internet works they would now that the second you load some piece of content from someone else's servers they have your information as well

People aren't. That's why we have laws like Lemon laws [1]--so everyone doesn't have to be a specialist.

[1] https://en.wikipedia.org/wiki/Lemon_law

Yes, clearly every website user should have an in-depth understanding of how DOM elements are generated on the browser. Seriously, how can one know how a button is produced on a page without inspecting the underlying source code, or looking at the network traffic on the developer console? Even then, this behavior can be obsfucated in the code, and in order to produce the page to generate the content to inspect, you've already generated the remote ping.

You don't need to do that detailed of an analysis. If you see a YouTube video in a website, YouTube knows you saw the video. That simple.

I'm trying to understand what you people that are reacting to this Facebook incident so emotionally actually want done

Do you want logging ip addresses to be banned? Do you want cookies to be banned? Do you want embeddable html to be banned?

Because all I see is outrage without any real suggestions

HIPAA has IP addresses listed as one of the unique identifiers you must protect in your dataset.

Only when associated with medical records...

I'm the same person as the other account btw, not trying to hide that.

Oh I completely understand that. What I meant to really say is that at least in some realms we already do consider IP addresses as personal information that should be protected.

Sure, when you're explicitly dealing with patient health data... which is not remotely in Facebook's realm.

Are you sure?

"Facebook sent a doctor on a secret mission to ask hospitals to share patient data"

https://www.cnbc.com/2018/04/05/facebook-building-8-explored...

"Facebook held a special breakfast for drug marketers about recruiting people for clinical trials"

https://www.cnbc.com/2017/09/07/facebook-held-a-breakfast-to...

"How Facebook can ‘unblind’ a clinical trial"

https://www.outsourcing-pharma.com/Article/2014/06/09/Pfizer...

Yes I'm sure, your links don't bring up any new points. Facebook does not have my medical records.

> If you want to log into a website using Facebook login

I don't.

Perhaps the internet must know, but must it remember?

Yes absolutely, how do you think you prevent people from ddosing and how do you think we prevent spam if not with logs?

Also I'm surprised how nobody has mentioned how important this data is for AB testing.

Perhaps "using customers as guinea pigs" is not the hill you want to die upon? A/B testing is not a good justification for data collection. It may, actually, be a good reason for condemning it.

Yes. If it can't remember, there won't be progress on anything.

Reply on news.ycombinator.com