Hacker News Reader

Comment by stickfigure | Hacker News Reader

Are you suggesting that there be an API to access social network information?

That is literally what Facebook had, and what people excoriate them over thanks to Cambridge Analytica. The Facebook haters are driving social network data into a silo; how else are you going to "keep control of your data"?

You can have privacy (or at least the illusion of privacy), or you can have access. You cannot have both.

View on HN

Specifically here you're right, but the hypothetical that came to my mind when reading GP was in similarity with email.

I want to reach my friend Pete through "media". But I don't really care about his ad-relevant personality matrix, I just want the endpoint. The profile metadata is the aspect created and mistreated by FB, and abused by CA. I suppose scraping the proposed hypothetical API would be akin to getting a large list of valid emails, but it's not as useful for targetted agitprop.

And let's not forget the controversy from just five months ago where the nytimes reported (and dozens of other media outlets blindly re-reported) that facebook allowed companies like spotify, netflix, and the royal bank of canada to read, write, and delete our private messages. All because the nytimes's tech reporters don't understand how an API works. Or maybe they do, but the nuance doesn't fit with their current agenda.

The mass media is there to damage Facebook as much as they can, because Facebook is taking them out of business. Never forget that.

This sounds to me like a backwards argument. The Cambridge Analytica scandal revolved around unsanctioned access to data. I don't think the premise of having an API was the problem, it was the lack of transparency and control offered to Facebook's users.

Does your data about your date of birth belong to you or to both you and your friends? Ostensibly, it's very personal information, hence only to you. Right now you can set the visibility of your birthday on facebook so you control exactly who sees it. If you set it to private, no one can see it. But supposing you set it to "Friends", would you be ok with your friends downloading this data and keeping a copy for themselves? They'd do that because they'd think it's "their" data, which should remain accessible even if they left Facebook.

I can see arguments both ways. Some folks would be ok with it (they're your friends) and others wouldn't (you can't change the privacy setting on data that's already been downloaded).

Similarly with friends list. A person's list of friends is probably "their" data, even if it has your name on it. Would you be ok with them downloading this information?

The trade-off between control of some users and the privacy of other users is a complex issue. Let's not pretend there are simple answers to this.

There's a social norm aspect to this. It would be nice if you were notified when your data or your data residing with your friends propagate to other parties, a paper trail if you will.

unsanctioned access to data

You misunderstand what happened. 1) Users installed a quiz app, 2) Users explicitly accepted a permission dialog that included "information about your friends", 3) The quiz app saved this data, 4) Cambridge Analytica bought the app (and data).

If CA got your data, it's because one of your friends sanctioned the critical link in this chain.

Facebook at least provided this level of security, however illusory it may have been. In a decentralized system, anyone who touches a piece of data can pass it on to whoever they want. There is no way to enforce "my friends can look at my data but it's my data and they aren't allowed to pass it on".

Privacy advocates and decentralization advocates are mortal enemies; their only common cause is that it's popular to hate on Facebook these days.

How is that not unsanctioned access? I can't get a mortgage in your name just because we're friends.

Correct, but your friends are more than capable of backing up their log of emails with you and handing it over to someone else. How is it not your friend’s fault?

And CA “leak” was way more tame than this, just the information displayed on your profile for all of your friends.

I think you are taking an example of a very dark pattern to say that we can't come up with reasonable rules.

The Facebook haters are driving social network data into a silo; how else are you going to "keep control of your data"?

The implicit assumption here is that the only people who can control your data are big, centralized organizations. Instead of big companies making little people subject to DRM, what if we turned it on its head and gave control to the people? What if we made big companies subject to Digital Human Rights Management? Basically, we legislate that social media, tech companies, and government organizations use Trusted Execution engines to handle private/personal data, and the user gets the keys and gets to revoke access from those organizations.

???

Let's say I put all of my friends' birthdays in my calendar. Now the data has left the silo and I can reshare it with whoever I want. Just how is anyone going to revoke that ability?

This particular use of Trusted Execution is meant to be used against Large Organizations, not individuals. No one is going to revoke that ability in your example in the context of what I propose.

Also, it's not meant to be a complete solution by itself. It's meant to be a tool supported by other legislation. So it would totally be possible for Facecorp to crawl the web and put together a non-revokable database of private individual's information, outside of Trusted Execution engines. But to do so, they have to go to that effort, instead of just sweeping user data.

The problem is that Facebook controlled access to the API, not users. Given me the ability to control access to my social network information could be a good idea.

In the Cambridge Analytica Case users where asked "do you want to share your data with that Game/quiz?" And users agreed. For average users understanding that control is hard, especially if people with bad objects are on the other side.

Not just your (user X) data, but your friend's (user Y) data. What if the API had sent user Y a confirmation, like "User X just installed CAapp and wants to access your information. Allow or Deny?"

If you take the "social" part serious frind's data is essential. When playing a game it should compare to your friends on the high score list. When using a birthday calendar you want to see birthdays.

Having to ask the friends for approval doesn't scale.

There is the fundamental conflict between a social network platform and privacy.

Facebook should have to access my API to display anything about me as a member. An API where I decide to whom and how much what data is shared.

One would still need authorization to view a private profile...

Reply on news.ycombinator.com