Hacker News Reader

Comment by orijing | Hacker News Reader

"This extension can access: Your data on all websites"

This part made me chuckle a bit. We are so afraid of Google and Facebook tracking our searches/web pages, yet we freely install plugins from 3rd party developers that can easily gather everything that Google and Facebook can get, and more. In theory, I could make a Facebook Disconnect 2, which secretly sends data back home about what pages have been visited, and nobody except the most vigilant (enough to read the source of the plugin) would know.

Why do we not trust large corporations who have billions of dollars at stake, but trust independent developers who have little skin in the game? Is it because we are those developers, so there's some form of camaraderie?

View on HN

My first thought when I saw this was: "I should check out the source first and see what it does". Here is the source:

  const DOMAINS = ['facebook.com', 'facebook.net', 'fbcdn.net'];

  /*
    Determines whether any of a bucket of domains is part of a URL, regex free.
  */
  function isMatching(url, domains) {
    const DOMAIN_COUNT = domains.length;
    for (var i = 0; i < DOMAIN_COUNT; i++)
        if (url.toLowerCase().indexOf(domains[i], 7) >= 7) return true;
  	  // A valid URL has seven-plus characters ("http://"), then the domain.
  }

  /* Traps and selectively cancels a request. */
  if (!isMatching(location.href, DOMAINS)) {
    document.addEventListener("beforeload", function(event) {
      if (isMatching(event.url, DOMAINS)) event.preventDefault();
    }, true);
  }

I am not concerned with this plugin. It may break websites, but it does nothing malicious. It is no more dangerous than any other chrome plugin.

Yup, until the author uploads a new, more 'clever' version and chrome auto-updates your browser, without you knowing it (since permissions didn't change).

It looks like we need another plugin which will track the source changes of other plugings and report them.

Who will watch the watchmen?

You already trust Google to not do bad things inside Chrome; why not trust this guy, as well?

Because if google doesn't something that people find out about, there will be a firestorm. If this guy does... will it rise in the headlines anywhere? I doubt it.

You can copy the source code and make your own plugin from it ;)

If you want to shut down facebook on your computer without a plugin just put those domains in your /etc/hosts:

    127.0.0.1  facebook.com
    127.0.0.1  facebook.net
    127.0.0.1  fbcdn.net

Not quite. That won't block www.facebook.com or static.ak.fbcdn.com

Yeah, [unfortunately?] wildcards don't work here, so you can't do something like *.facebook.com.

You could either list out all the domains or use something like dnsmasq or another DNS proxy that lets you define more sophisticated rules.

Edit: the advantages of the /etc/hosts approach are it's simple, and it works without additional software.

I thought the goal of this plugin is to neutralize Facebook Connect (i.e. facebook on 3rd party websites), not to disable Facebook altogether?

Indeed, but my view is that if you don't trust Facebook, you don't trust Facebook.

If you want to avoid facebook completely, why not just deactivate your account, or completely log out and clear all cookies, then never log back in on your machine? I thought that point of this plugin was to let you use facebook normally without worrying that another site would post on your wall.

Thumbs up. That's exactly what I did. It seems innocuous enough, I thought, but it's still interesting that we trust fellow developers so much. I just wanted to point that out, in case people missed it.

People don't trust Facebook because they don't know what we (fellow Facebook Engineer[0]) know about what it's like on the inside. They don't believe that people are just legitimately interested in making stuff that people will like and use, that we obsess over the stats to make sure that we're making stuff that people and use (they think it's tracking them), and that ultimately, we just want to give people ads that they don't hate (for some reason this is called "selling data to advertisers").

Ultimately though, the opinions of Hacker Newsers (a group with which I've proudly associated for ~3 years now) are only a hint at how much we're helping (or hurting) the world, and while we should always keep it in mind, we need to recognize that this is a group which is accustomed to the IRC style of social networking.

I don't blame anyone at Hacker News for thinking "we" are evil, because we do a shitty job at communicating what we're actually doing and why[1] (and we can't really communicate everything anyway). Instead, we've just gotta try to address the problems that are legitimate and be as transparent as possible.

Shortly, if you call tin foil hat theories tin foil hat theories (even with sound logic as to why they are tin foil hat theories), all you're going to do is convince the tin foil hat theorists that it's yet another elaborate step in manipulating them into believing The Corporate Directive.

And, everyone else, for what it's worth, I'd much prefer it if we could just go back to hacker news on here. I'm a C Hacker first (before being assimilated, I contributed to open source projects like Chromium and Mongrel2, because I loved the problems (coincidentally the same reason I allowed myself to become assimilated into facebook -- I work on code that's hit my millions of users billions of times a day[2])

[0] Cache Infra in 1050 B2

[1] We've enabled applications to write to our network as they wish without introducing much friction or overhead (a single approval), but we've managed to communicate that in such a way that instead of leading people to believe that we've put the onus on developers (and users, as they must ultimately know which apps to trust), we've instead "put our tentacles" into yet another area and are again sharing without reason.

[2] memcache protocol stack stuff, we issue lots (and lots and lots) of requests per page load :)

> People don't trust Facebook because they don't know what we (fellow Facebook Engineer[0]) know about what it's like on the inside.

Bull. We don't trust Facebook because of its actions. Beacon, account deletion, random modification of privacy settings and policies. Facebook has done virtually nothing to earn trust, and taken several clear, conscious actions that violate trust.

Your perception of Facebook's intent does nothing to change what Facebook has actually done to its users.

I bet - as someone that respects what Facebook has crafted but really has no vested interest in their long term success - that Facebook internally feels that it has done a ton at demonstrating it's awareness and empathy towards users and their privacy and has concluded that actually, users as a meaningful percentage, do not give a crap about what Facebook does or doesn't do wit their data.

Also, it's not just what Facebook is currently doing or has done, but also what it _can_ do with my data.

Many of my friends trust Facebook.

I'm starting to think that those smug bloggers are in it for the traffic.

It all depends on your perspective I suppose.

A few weeks ago a close friend sent me a message on Facebook asking what I've been up to, and I told him about the startup I am working on.

As soon as I hit send I was hit with the impulse that I shouldn't have sent those kind of details over FB messaging -- thinking back to warnings such as (http://www.youtube.com/watch?v=2cdrCYrZIvI).

And sure enough a day and half later I received an email from a Facebook recruiter wanting to talk to me about a job.

Normally that would be fine, but the timing is so suspect. I asked around if anyone had heard of FB mining/reading users messages, and no was certain but reminded me that the FB privacy policy states that they own your data and an ex-FB employee said that many engineers have access to the DB.

Does FB mine or read user messages, and why doesn't it do more to prevent so many engineers from having access to the DB?

There's no chance that the recruiter contacting you had anything to do with the message you sent.

I have some insight into the safeguards in place to prevent any abuse of any access that an individual might have due to the nature of their work, and the character of the people who maintain them, and if I had any issues with either of them, I would not still be working at Facebook.

What type of safeguards? And are you saying Facebook messages are off limits from data mining?

Unfortunately, I don't feel I'm qualified to represent Facebook on this beyond what I've said (don't want a tech news article/blog post misconstruing something I said into something bad about the company).

> people are just legitimately interested in making stuff that people will like and use

Even the best intentions won't help when FB is hacked, sold out to idiots or forced to hand out data to your gov't.

> and that ultimately, we just want to give people ads that they don't hate (for some reason this is called "selling data to advertisers").

As an aside: I'm happy with ad supported stuff. I never run any ad-blocking extensions or hide my data. But still many ads are lousy.

Any chance of a HN karma style thing to vote up / down ads? ("I hate this ad, it makes me want to leave the page -1", vs "I don't hate this ad, whether I click it or not +/- 0" vs "I like this ad whether or not I click it +1")

And I always like websites that allow paying members to turn off ads.

I'm guessing a -1 button would be only as attractive to FB as a dislike button.

With a -1 and dislike button comes a visible downside to being present on FB, especially for organizations, the potential to be unpopular in a tangible, measurable, way. Organizations would then think twice about being on FB when before it's might have been a no-brainer. Even if the number of dislikes is not publicly visible, it may be to the owner of whatever it is being unliked, or owners may request for it, and when an owner sees that number, may decide that it's bad to have a FB presence.

Considering the downsides of a -1/dislike button, why would FB want it from a revenue and growth point of view?

You simplify a complex situation into "good" and "evil" and characterise those suspicious of you as tin foil hat wearers.

Way to win our trust.

And I believe that you believe that argument. I believe even that Zuckerberg believes it. Very rarely is there a Gargamoyle sitting in a tower plotting the downfall of the smurfs. Most times it's just someone with the best of intentions.

In this case your argument is that you just want the information so as to provide people what they want.

Okay - fair enough. But there is a very obvious counter-argument - which has already been mentioned many times. It's that you don't make it easy for people to choose not to allow you to track this information if they don't want you to. And you KNOW that most people wouldn't opt-in to let you track them this way. So at best you make it opt-out - if you let people opt out at all. So - assuming that people know what they are doing and are making a rational decision about their choices, then you aren't ACTUALLY serving their desires at all.

And next comes the only real reply that's available to you. Either people are irrational for wanting to block information gathering that would help you satisfy their first order desires, or that facts like people keep using the service without trying to figure out how to opt-out, shows that they really don't have a problem with privacy issues - even if they state they do. And therein lies the paternalist rub of Facebook's decisions.

Now - you don't state anything directly paternalistic in your reply. To be honest - it's not that consistently thought through. But the germ of it is there when you state to the effect that - people can't understand what we do or why we do it. And thus you relegate them as other - as less informed, or less capable of choosing than the mighty facebook crew.

Sorry you need to try harder to see this from the other point of view. That's not going to be easy for you - because working at facebook must be an incredible experience. Who wouldn't want it to be a ethical easy zone. But you exhibit the clearest signs of someone who has too much of a vested interest to be able to critical engage with this ethical conundrum.

The first of these signs is the fact that you don't address the very obvious counter argument I just laid out. No one at Facebook ever seems to. It's such an obvious reply, and is mentioned so often - it appears disingenuous to continue to ignore it. I don't believe that Facebook consciously avoid replying to it. But the fact that they don't - while keeping the assumption that they mean well - suggests to me that their vested interest has clouded their judgement.

The second such sign of critical impairment is the fact that you are marginalising your opponents as "tin foil hat" people - or as ignorants who couldn't possibly understand. When you do this to a group of people who represent a particular point of view opposed to your own - you've ceased to engage with them - you've ceased to listen.

And that's exactly why people have their backs up. And if you can't see the intuitive force behind that - then people are going to start treating you in kind and start marginalising you in return. And of those who do subscribe to the tin foil hat view - that's exactly why they do.

It's a shame because Facebook probably has a lot to contribute. But if your PR folks (including yourself since you've just spoken for the company on HN) can't recognise the degree to which the discourse is becoming poisoned in this way - then things aren't going to go to well for you in the longer term.

People don't trust facebook because they (you) try to tell everyone what we are doing without our permission. It's really that simple. Stop it, please.

Yeah, Google doesn't really get it how to set permissions properly. They do this on Android, too, and freak people out when they see permissions that at least seem so general - like giving a SMS app "full Internet access" or "full SD card access" and so on.

The problem with naming them like that is that showing the permissions becomes pointless, because people will install them anyway seeing how 95% of the apps have that permission, so they might miss the malicious one that has that, too.

In order to block Facebook, this extension is injecting javascript into every page you load. It absolutely should come with a large warning.

I believe this is a problem with the extension API, where the extension needs to request "your data on all websites" in order to be able to run JS code in the context of the page/tab.

Technically if it's able to do this, then it is able to access the data on that page as well, whether or not the extension is doing so.

We freely install these plugins, yet we can't force ourselves to simply log out of Facebook[0], can we.

How ambivalent is that.

[0] http://news.ycombinator.com/item?id=3033385

Upd: They say now logging out is not enough (http://news.ycombinator.com/item?id=3035418), which partly invalidates my point.

He actually is doing this. Take a look at the source code. He has tracking javascript right at the bottom. Its sort of ironic...

I'm looking at the source code, and I'm not seeing what you're talking about. The code is only in content.js, and nothing is being talked to as far as I see. How is he sending out tracking data?

Edit: I'm sorry guys, I guess the file that the install button links to is not the addon itself like the Firefox addon site does, so saving it does not give you the addon. I'm retarded. He does not have tracking cookies, I apologize.

Where? The source is exceedingly simple and there is no tracking JS:

http://code.google.com/p/byoogle/source/browse/trunk/google/...

Reply on news.ycombinator.com