Hacker News Reader

Comment by SilasX | Hacker News Reader

Nice, good find. That doesn't give permission to read (or even generate) private messages, unless you interpret "my data" to mean something in the last bullet point that's much broader than the three above.

View on HN

>unless you interpret "my data" to mean something in the last bullet point that's much broader than the three above...

Hmm. It seems this may sound weird to you and many others, but that's exactly how I interpreted it. When looking at that screen I was wondering why anyone in their right mind would grant Spotify these rights?

The only thing Spotify does is play songs for you, right? They shouldn't really need access to any of your FB data to do that.

But, you want a more social experience while you listen to music.

Maybe some people do, but I don't.

Just play "Grandma's Hands" for me while I code. I don't need my friends in Paris to know I'm listening to Bill Withers.

Seriously, why do people think they need this stuff?

I apologize if my tone was not right... to be clear, I use Spotify exactly as you describe (different choices though) and am as baffled as you about people using those other ways.

I interpreted your comment as a joke, but could see how that could be unclear. Tone is hard on the internet, probably best to explicitly say when you're being sarcastic. :-)

Yeah, but that's the thing: even if you do want to broadcast to your friends that you're listening to BW, that doesn't necessitate access to all your PMs! That just means write-to-wall or -to-updates privileges.

That’s fair, but surely the concept of sharing music with friends isn’t so crazy? Not saying it was necessarily handled well here, but it seems like a feature many would and do want.

Copy a link send it as an IM, that already worked with ICQ. Update your status message in your message client, manually or possibly provide a client side API to do that, pretty sure there are scripts that do that for pidgin / Amarok, it also is definitely possible on macOS using Automator. There is no reason to involve a server other than possibly platforms like iOS not allowing interactions between apps in this way, which I doubt.

That is one of their selling point, isn't it? You got a feed of "Friend activities" on Spotify

Alright, I confess, your interpretation was the same as my immediate hot-take reaction, but then I stopped and said waiiiiiit a sec, they can't literally mean, all the data, right? They must mean, like, "my data" in the sense of that stuff above, right?

Only now does FB reveal themselves to the be treacherous jerk they've always been and abuse whatever leeway you give them. Use recovery phone number for marketing? Why not!

Only now!!! Where have you been?

I agreed they’ve always been treacherous jerks, I meant about the counterintuitive broad reading of “my data” on this page.

One not-a-facebook-user data point here, but yeah I would interpret "my data" to mean everything. Absolutely everything.

I interpret that as saying "the data you're granting Spotify access to, they can access while you're not using the app", i.e. not broadening the scope of the data, just when they can use it.

That's not how it works. I've built a FB app in the past and had offline_access permission. It does not expand the scope of what data you can query. It just allows you to use the permissions granted whether the user is logged in or not.

That auto dialog referred to the “offline_access” scope. At the time, most app access tokens would expire unless they specifically requested that the user give permission to access at any time.

It did not expand the permissions of what could be accessed.

That scope was retired in 2012 https://developers.facebook.com/docs/roadmap/completed-chang...

that's weird. It seems very clear to me. they are giving you four distinct warnings: 3 plus my data. I would have immediately interpreted this as its clearly written - Spotify would get access to my data. So I would have never enabled it,

Reply on news.ycombinator.com