If you care about user privacy, don’t use Facebook JavaScript SDK

Most solo bootstrapped projects are not popular enough initially for someone to spend money / effort to hack them. When they do become somewhat popular though (very small minority of course), I suspect most founders bring experts on board, as they absolutely should.

> just using HTTPOnly and DB backend is not a solution at all

My comment was not meant to be exhaustive and does not list all vulnerabilities. Just in context of some of the suggestions in the article. Using a mature framework like Django can protect you from other vulnerabilities CSRF, XSS, SQL Injection to some extent.

With a password manager and careful shepherding of your PII, maybe there's not much risk; if someone takes over the site your account is compromised either way, and nothing else is lost. But most people don't actually use password managers, and lots of sites that accept Google sign-in require lots more data to actually create an account on the site. (Plus, losing password stores is not necessarily the same as losing all control.) Newbies storing creds is a perennial source of leaked credentials that get used to attack more important sites.

You now have an auth system that avoids horrible passwords (no passwords).

The downsides are: 1) Cost to send emails for login, 2) People complaining about it being weird.

Worth it in many cases.

2010s: "We take your security very seriously."

2020s: "We value your privacy."

> What ever they are offering cost them money to develop, but they did not do that as a charity.

True! Yet... I keep thinking about `http` (the protocol), or Apache, IRC, and countless other software techs that were just 'given' to (and are maintained by) the world, courtesy of their makers, and/or bodies like IETF work groups, etc.

Case in point: "social" is basic at an elementary level (it's just CRUD, over-the-network), but at scale becomes insanely costly. The limitation/exclusivity factor thus doesn't seem to be software magic but rather infrastructure, piles of money, before sustainability or profitability come into play. This is what the monopolies stem from, only compounded by some Meltcafe/"network" effect (friction to switch, passive positive peer pressure inwards, passive negative outwards).

So in thinking of an alternative future path for social tools (SDK) and meta-tools (platforms, interop, work groups, etc), I think it's worth considering the infrastructure problem first. My money is on distributed and (partially but 'enough') decentralized systems (think bittorrent, tor, even DNS fundamentally), but regardless it belongs to the wider category of mutualization of resources (cloud vs on-prems debate, E2E crypt, etc). The solution must be preferable in terms of cost otherwise it's just not gonna happen.

Zuck even got asked about shadow profiles in his senate/congress hearing and he meekly weaseled out of answering by saying "I'll get my team to get back to you on that.". Translation: "I know the answer but telling you will destroy what's left of my reputation, and if I lie to you I risk perjuring myself and jail time.".

He also rattled something along the lines of "there's this thing called cookies", and the peanut gallery on Twitter misunderstood that deflection as him explaining to old senators what cookies are...

Let d:(x,y)->n be the degrees of separation between x and y. Since d(x,y)=0 implies x=y, and we know that FB and HN are not identical, we have d(FB,HN)>0.

Then, since d takes integral values we know that d(FB,HN)>=1 in any case.

The problem is practical; do your users want the features or do they care about privacy? Let them make the choice, and don't hide it from them. That's the ethical behavior.

It's unethical to assume everyone values everything the same, including privacy. Some people don't care about it as much as you do, nor should they.

I'm saying give people choice, let them figure out what they care about. Making the choice for them is bad business and bad ethics. You don't know better than your users.