3 years later, Facebook still can't delete photos correctly

Its simple. Minority concerns like this don't upset enough of their users to impact their bottom line in any meaningful way so they don't do anything about it.

Facebook may have set near-infinite Expires/Cache-control headers on their static content, since it never gets overwritten. In that case, the CDN never goes back to the origin to check if the file is still there. The CDN they are using probably does have the ability to explicitly remove files (e.g., to respond to DMCA take-down notices), but probably doesn't have the ability to do this at Facebook picture deletion scale.

In other words, Facebook probably can't do much about it unless they get the CDN provider to make a big investment, build their own CDN, or switch to another provider that does support it (usually a costly decision).

#2) Anyone with access to the link to the CDN had access to the original photo. So this really doesn't protect someone from viewing your photos you wanted to delete - since if they wanted it before they could have had it.

So ultimately this should not bug you the greatest of all the bad things they have done. The ultimate blame belongs to the person who uploaded the photo to Facebook and then later wanted it deleted.

Not to imply they shouldn't do it, merely that they have little motivation to do so, aside from it being a good thing they should do.

Please don't make this about PHP and technical competence :-( This is clearly not a technical problem (deleting a file is pretty easy in PHP to, y'know?).

    -- Phil Karlton

Don't get me wrong, I still believe that posting ANY picture on Facebook you don't want the whole world to see is just plain stupid.

Tell that to MySpace.

http://www.wired.com/politics/security/news/2008/01/myspace_...

Not only that, there are potentially legal differences between publishing a link to an embarassing photo and actually sending the photo itself. After all, it's common on this site to draw the distinction between linking to content and the content itself.

There is still very much value in these photos, and a great chunk of it can be unnervingly personal.

Keep in mind, that when the photo features of Facebook were added, they probably didn't do it while thinking about half a billion users or whatever gazillion terabytes of photos they have to operate with. Heck, they may have even started out with simply storing photos on disk in their servers where deletion was easy as opposed to on a CDN.

They could very well have never thought of deleting a photo; it doesn't seem that there is much interest in information removal there, and I could easily see if being a very ugly manual process that no one wants to spend time doing and as such it never gets done.

Note that the delete operation merely marks the data deleted - they don't actually purge or overwrite it. Perhaps there's some kind of bug in this deleted-marking system? Kind of weird they haven't been able to fix it yet though.

Sometimes a hacker is one who is expert at programming and solving problems with a computer.

Sometimes a hacker is someone who hacks particularly, one who cuts with rough or heavy blows.

In the race to the deadline, the next release, the IPO, a lot of good engineering fails by the wayside.

-- Phil Karlton

This is a cache invalidation problem. Now, I don't mean to say that this is acceptable, but it is hardly simple. In the general case, it's unsolved.

Sure, deleting a file from a single datacenter is easy. Verifyably deleting it from an infrastructure the size of Facebook's is not.

Don't worry a few years in Industry and you'll learn what things are really like.

i.e. There is no end of shite software that wasn't developed. Yes you can make lots of money with hodgepodge software. Welcome to Industry :)

1. For content that is covered by intellectual property rights, like photos and videos (IP content), you specifically give us the following permission, subject to your privacy and application settings: you grant us a non-exclusive, transferable, sub-licensable, royalty-free, worldwide license to use any IP content that you post on or in connection with Facebook (IP License). This IP License ends when you delete your IP content or your account unless your content has been shared with others, and they have not deleted it.

2. When you delete IP content, it is deleted in a manner similar to emptying the recycle bin on a computer. However, you understand that removed content may persist in backup copies for a reasonable period of time (but will not be available to others).

From their Data Use Policy[2]:

When you delete an account, it is permanently deleted from Facebook. It typically takes about one month to delete an account, but some information may remain in backup copies and logs for up to 90 days. You should only delete your account if you are sure you never want to reactivate it.

And, finally, from a Facebook employee here on HN[3]:

Maybe that was true in the past, but today when you delete your data it is gone. Trust me, I wrote it myself. The law enforcement guidelines that have been circulating recently corroborate this.

I believe the above quotes demonstrate that Facebook, at least, do have a legal reason to delete their copy of your media when you no longer want it hosted there -- and that they actually do so. Maybe that will change in the future, but I hope not.

Personally, I think it is dishonest to use the term "delete" when you simply mean "remove this reference to", and I appreciate Facebook distinguishing between account deletion and deactivation. To most computer users, delete implies that the thing is gone and can't come back. Using that term to mean something else is deceitful. As such, I believe sites that allow users to "delete" their content do have a moral obligation to actually go through with that and delete it entirely, not just make it invisible to the user.

It is my view that once a service becomes culturally entrenched, it becomes accountable/responsible in many ways to its users. This attitude of "well, if you don't like it don't use it" is an interesting one (and it's something I adhere to for the time being), but I wonder how long it can last. Recent SOPA outrage demonstrates that people generally don't have this sort of attitude towards governments. The differences between the two are clear, of course, but there are similarities too. I find it interesting that people[4] will condemn, for instance, full-body scans at an airport as being an invasion of privacy but then have this cavalier attitude towards corporations like Facebook - hey, you agreed to the terms and conditions! At what stage does that agreement become entirely meaningless?

[1] http://www.facebook.com/legal/terms

[2] http://www.facebook.com/about/privacy/your-info#deleting

[3] http://news.ycombinator.com/item?id=3320240

[4] Not you, dotBen, but people.

EDIT: I'm sorry to see you've been downvoted. I hope people aren't doing so just because they disagree with you.

I don't think any other countries have anything like the DMCA with it's safe harbour and take-down requests.

I'm also pretty sure that once you upload a photo to facebook, you give them copyright on the image, and hence you are unlikely to be able to claim copyright infringment,

Except Facebook is one of the places where your software work has the most impact on the world.

Also if you don't want people to think it's sour grapes than don't even mention the word.

Where is the evidence?

Social networks are the definiton of a network effect. They are boring and simple technologically, but are phenomenally valuable when lots of people I care about use them aswell.

You cannot beat facebook with technical solutions, only social solutions.