Hacker News Reader

Comment by SimonPStevens | Hacker News Reader

I'm the first person to hate on Facebook, but for once I think this is hugely overblown. They didn't sell peoples data, that made it possible to voluntarily connect accounts.

It's the equivalent of complaining that hotmail sold your private email data to Thunderbird when you used Thunderbird as your desktop email client. No. They didn't, you gave them access to it because that is what connecting the accounts does.

If should be fairly clear to anyone that if you connect accounts you are exposing data between the accounts. The debate about the granularity of permissions is neither here nor there, everyone should have a clear expectation that connecting accounts = sharing lots of data. Unless it is explicitly stated what is excluded the assumption should be that everything is shared.

View on HN

> everyone should have a clear expectation that connecting accounts = sharing lots of data.

That's amoral bullshit and we must demand better. It should be expected that that connecting accounts means sharing little more than the subset of data required for the integration. Companies that violation this expectation must face consequences.

GDPR takes a step in this direction, prohibiting retention of PII for longer than necessary for business purposes.

im going to take this a step further and say connecting accounts means sharing _no more_ data than is required for the integration.

I don't understand why netflix gets to see all your DM's when all you want the connection to do is send a message to a person you choose. The connection doesn't need to give netflix literally any data besides maybe the fact that a message was sent. why do they need to know who it was too, and any other messages surrounding it?

Because the recipient could see the message and respond to the message inside the Netflix UI.

I am about to change my mind on the GDPR. If Spotify and Netflix are legally obligated to not store any data they do not need, then Facebook can actually make an additional argument that it is ok to give them wider access; after all, the law will ensure they have to handle it properly.

> If Spotify and Netflix are legally obligated to not store any data they do not need, then Facebook can actually make an additional argument that it is ok to give them wider access; after all, the law will ensure they have to handle it properly.

That seems like a huge perverse incentive. Companies will start constructing systems so that more data is "required" so they can legally collect and share more of it. Then convincing them to collect less would require not just convincing them not to collect the data but convincing them to undergo the expense of redesigning all their systems to not "require" it anymore.

> Companies will start constructing systems so that more data is "required" so they can legally collect and share more of it.

This is exactly what companies do. They decide what data they want, and then set out to find a way that each of those data elements is necessary.

You make a lot of claims without providing reasoning.

> That's amoral bullshit and we must demand better.

Why is this amoral bullshit? It seems like a lot of the outrage around this topic is born out of a 'feeling' that you have an instrinsic right to online privacy. But, I don't see this right clearly defined in the constitution, so where does it come from? Are you sure it exists?

> It should be expected that that connecting accounts means sharing little more than the subset of data required for the integration.

I think it's unrealistic to expect FB to expend resources to determine what subset of data is 'required' for every app in its ecosystem. When inspecting the utility/privacy frontier, the current model of requiring users to grant permission to an app makes the most sense to me. The problem in this case is that the permissions modal may not have been clear enough.

With a name like "smallgovt" I would expect you to be pro-privacy in the real world as well as online. Most people on this forum would likely agree that privacy is a right (just because it's not defined in the constitution doesn't mean we don't have that right. Did people not have the right to life, liberty, and the pursuit of happiness before the constitution?). Also, it is entirely realistic to expect Facebook to at least do a cursory look-over of the types of data app developers are requesting while running on their platform. No reason every app needs access to every piece of data on its users.

I agree that we have a right to privacy, but to what extent?

When it's not defined by law, it's up for debate. And, my main point is that in such a scenario, I don't think calls for moral condemnation are in order.

I think you have your dependencies muddled.

Why? I’d like to be corrected if so.

Laws generally follow the calls for moral condemnation or the relaxation of those calls. And those calls are part of the debate on what should or shouldn't be law. Asking for moral judgment to be removed from discussions because those things are legal, is putting the cart before the horse.

I see your point. I'm not calling for the removal of moral judgement from the conversation. I'm calling for the removal of moral condemnation. That is, we can have a discussion about what is right and wrong based on your value system, but condemning someone is a destructive act which is harmful and unnecessary.

There's a popular idea that it is bad to judge others. I disagree. I think we will judge others whether we like to admit it or not and also that many of the people I have met who claim not to judge anyone have also happened to have been some of the most hypocritical people I have ever met. I think the important thing is to judge yourself and your own judgements on other people, at least as harshly as you find yourself judging others. Put your own opinions of other people up to the coldest possible light. Judge more, not less.

I disagree with that popular notion also. We're entitled to our opinions and it's natural to judge others, but I think it crosses the line when that judgement turns into action, and that action is net harmful.

In outrage scandals like this, we're so quick to condemn the actor and demand punishment. I think the more constructive action is to condemn the action (not the actor) and demand regulation (not punishment). Condemning the actor may quench our thirst for justice, but I think it's often net harmful.

I get that calling for punishment is a good disincentive for future immoral, unregulated activity, but the punishment has to fit the bill. FB lost, what, $30B of value over this 'scandal'. Is that not a big enough fine?

FB lost, what, $30B of value over this 'scandal'. Is that not a big enough fine?

Isn't that like when a rich/famous person evades punishment for a crime that the average person would get a long jail sentence for, because from loss of income etc they'd already got 'a big enough fine'? i.e. effectively only the non-rich are punished for crimes.

Well, I think you have bias on this 'scandal', or should I say scandal. It is a scandal and also to claim loss of market value from the scandal is equivalent to some sort of fine or other legal punishment is beyond ridiculous (and kind of shows your hand a little).

> Did people not have the right to life, liberty, and the pursuit of happiness

These rights have routinely been taken from people with or without their consent throughout history.

EDIT: What I mean to say is having it spelled out can only help, and if we cannot make an argument based on existing legal constructs we might need to spell it out.

A name like "smallgovt" should've made it clear that they would be pro-corporation above all else :)

The enumeration in the Constitution, of certain rights, shall not be construed to deny or disparage others retained by the people.

> When inspecting the utility/privacy frontier, the current model of requiring users to grant permission to an app makes the most sense to me. The problem in this case is that the permissions modal may not have been clear enough.

Requiring permissions is a good step, but an auditable history would be a huge gain for users world-wide.

In other words, I would like to make an api call or visit a facebook page and see what data was requested by and sent to every third party with which I have shared data. I could then use that data to see if I'm comfortable sharing that information. Automation could also be undertaken by facebook to weed out obviously malicious actors.

So everything has to be on constitution or American companies who don't have any ethics by the way, will abuse as much as possible for profit. Actually that's the message we are getting from silicon valley for some years.

> Why is this amoral bullshit?

Because

> But, I don't see this right clearly defined in the constitution, so where does it come from? Are you sure it exists?

It comes from morality. Some people think it's immoral to defraud people, whether that is money or their private information.

Some people don't want to live in immoral societies and want the government to enforce some level of moral behaviour amongst it's subjects.

> I think it's unrealistic to expect FB to expend resources to determine what subset of data is 'required' for every app in its ecosystem.

How? They have billions in profits and are in the process of hiring thousands of people to help get their news curation/reporting systems upto scratch. Why can't they setup a process where people have to justify to facebook what they would use the data for?

I could easily argue it would have been in their financial interest as it's quite possible we wouldn't be here talking about facebook if they had taken this approach.

But no, im supposed to believe it's unrealistic to have such simple process.

If I connect my Facebook account to a music service like Spotify I would NOT expect them the make my private messages available to that service.

It's absolutely nothing like your Thunderbird analogy because Thunderbird exists to present you email but Spotify has absolutely nothing to do with messaging.

Facebook should have given Spotify the bare minimum they needed to make me an account and play me music. Anything else is gross incompetence at best.

> Facebook should have given Spotify the bare minimum they needed to make me an account and play me music. Anything else is gross incompetence at best.

And how did you think they were monetizing in the first place? When I read all the outrage here, it’s almost like I’m reading comments from an alternate universe where nobody knew Facebook’s business model. On top of that, I find it even more amusing that lawmakers are up in arms over this, when they were the ones who passed the Patriot Act in the first place, destroying the Bill of Rights and desecrating the Constitution.

I would expect them to monetise through advertising and increasing engagement on the site by using linked services to make the whole site experience richer, thus leading to more ad views.

I might also expect Facebook to ask the services for some money to get their faces seen on the platform.

Is that hopelessly naive?

Spotify wanted to provide a Facebook messaging function within the app. That's all the access was for. It isn't as if Spotify employees were rifling through, or even data mining, your messages

> everyone should have a clear expectation that connecting accounts = sharing lots of data

I think this is a common belief in Silicon Valley. It is not elsewhere. This, in a crux, is why decision-making power is being—and needs to be—removed from the former.

I agree that few are behaving in a downright evil manner. (At least according to their own compasses.) But there has been moral drift around when permission needs to be asked, how it needs to be asked, and the degree to which business leaders have a duty to safeguarding their customers’ interests. The same thing happened in the trust-busting era; it’s interesting to see it happen again.

It's not even remotely the same. Thunderbird is a client application that

1) Runs on my own machine, not on somebody else's servers.

2) Is FLOSS so it's actually possible to verify what it's doing.

I think there's a fair debate to be had about what data should be shared when users volunteer to "connect" accounts, but this Thunderbird analogy is horrendously off base.

> ... everyone should...

But everyone doesn't, and lawmakers are, on a good day, when doing their jobs, more concerned with reality than idealism.

Or at least, they "should" be :)

> If should be fairly clear to anyone that if you connect accounts you are exposing data between the accounts.

This is an argument you have to make, but you're just asserting it. If I get pulled over for speeding, I have to show my driver's license, which I also used to open my bank account, which I use to pay my phone bill, which I use to call my mother on her phone, which she pays for out of her bank account, which she used her driver's license to open, which she had to show to get past the security desk at a building downtown to go to a job interview with a business that rents a space there.

Are you saying that I should expect that interviewer to have access to my driving record? If not, to what degree should it be "fairly clear" to me that there is information shared, and why?

OK, now pretend that I used facebook login to periodically read articles about selling fishing gear, at the website for a membership trade organization for fishing gear merchants that I belong to. I set it up (with two clicks) because I was sick of typing my membership number in on the rare occasion I visit the site. It's like 12 digits, and it's like not I keep my membership card in my wallet; I only need it for conventions...

In some states driving records are public info. Also you are conflating government records with corporate info. We have different laws regulating both. By in large corporate data privacy outside of fair credit reporting law is non existent. And where the law has teeth nothing has happened (e.g Experian)... really the issue for Facebook is the political foreign influence on elections. Politicians really don’t like it when they have no control over their electorate.

The challenge though is when my friends connect their account and drag me into things.

>"It's the equivalent of complaining that hotmail sold your private email data to Thunderbird when you used Thunderbird as your desktop email client."

No that's not at all equivalent. If Hotmail were my only email provider, me and hotmail are the only ones who have access to my inbox regardless of what email client or clients I choose to use. That's not "connecting accounts." Thunderbird is not a company. What an absurd statement to make.

>"If should be fairly clear to anyone that if you connect accounts you are exposing data between the accounts."

Except that we don't actually know if FB only gave access to people who had accounts with both FB and the specific third party. Nor do we know who the third parties exposed that data to. FB has very problematic relationship with truth and transparency in general. Nothing should be "fairly clear to anyone" about FB.

>"The debate about the granularity of permissions is neither here nor there ..."

Saying something is "neither here nor there" is a meaningless platitude.

When I deleted my unused Facebook account a while back I found that there were a dozen apps linked to my account (incl. Netflix and Spotify), even though I had never giving permission for a single one.

FB is sneaky and does not have the culture of valuing users' privacy. It is going to catch up with them eventually.

You're not wrong, however the question is, what ethical role does Facebook have to inform their users about how their data is used/transferred, or to educate users on what they are agreeing to?

I don't think there is a "right" answer here that solves all of the problems.

For example, should FB be required to explain to my technically illiterate Aunt how images and text are used to train feature classifiers, which inform the social graph?

It's hard not to think there must be ulterior motives when Equifax basically got away with it even though their data wasn't given freely.

>, but for once I think this is hugely overblown.

its actually just gotten incrementally worse..

So do something about it. Put up or shut up.

Reply on news.ycombinator.com