Hacker News Reader

Comment by cnity | Hacker News Reader

This must have been a painful engineering effort that I bet absolutely consumed the backlogs of at least tens of teams. Usually business assumptions about user accounts have their tendrils deep into the architecture and services that presumably many many years of code sits on top of.

View on HN

> presumably many many years of code sits on top of.

Not so many, since they tried to link all 3 only few years ago

https://www.theverge.com/2019/3/6/18253472/mark-zuckerberg-f...

That may be the case for Instagram, which was developed separately and then acquired, and which still uses separate accounts that AFAIK can be created without a Facebook account, although they can be connected to one.

Messenger though has always just been the chat function on Facebook, which can nowadays also be used via a dedicated website/app if you like. It doesn't even have separate account infrastructure on the backend, unlike Instagram. Looks like they're getting around that by essentially creating a second Facebook account, with social media features disabled.

Many years ago when I disabled my Facebook account I noticed that Messenger continued to work, so there was definitely some level of separation.

But can you really disable a Facebook account?

Disabling merely means just making yourself invisible, and the Facebook profile unusable, but all the data stays there. If you delete it though, your messenger account is no more.

Even for EU citizen with GDPR?

Disabling is what it says on the tin, giving you the chance to re-enable the account later. Nothing GDPR-violating with that. As long as you are also given an option to actually nuke all your PII.

Anonymize data with a restore capability. Maintains historical continuity for never ending total user awareness.

There has been an option to create messenger only accout (so you could do that for your grandma who would not have figured facebook anyways, but you can send her photos now)

That’s a ridiculous use case, only grandmas are on Facebook these days.

Messenger was moved into its own product for growth reasons (and app size reasons initially), it’s been separate for a long time

> Messenger though has always just been the chat function on Facebook, which can nowadays also be used via a dedicated website/app if you like

I would venture to say that messenger as a separate service/app has been a thing for at least a decade now.

Back in the day I had a messenger account without a Facebook account, you used to be able to create one with just a phone number

The challenge isn't unlinking accounts in the database, that's just a simple copy command. The challenge is in all the metadata that is used for account A (Facebook), and account B (IG) that can no longer share any downstream metadata.

So when you have to split the two apart, it's likely a hard legal requirement that there's no way account A can know anything about account B anymore. This means, countless metrics and logs and whatever has to be thrown away. So I imagine, there's lots of auditing of systems and every single property that is stored somewhere was scrutinized in long meetings.

Less an engineering burden than a policy and legal burden.

A burden that is proportional to the amount of personal data the corporation collects sounds excellent.

The compliance burden is proportional to the complexity of the architecture. You could have vast quantities of highly invasive personal data written to a monolithic RDBMS, and it would be simple matter of following foreign key relationships. Or you could have a very minimal set of entities & transactions actually collected from the customer via the edge, but propagated through so many microservices, queues, logs, warehouses, pipelines, and derived tables that it's infeasible to comprehensively trace all the scraps. The latter is more typical of a consumer internet company AFAICT.

I have a feeling a lot of HN devs overvalue the value of old data... probably because they have adblockers and dont know what ads they are targeted for. Youtube's algorithm seems to forget my interests after a year (or less), I often have totally new feeds than I did 6 months ago. When I got back into music production and also watched some airplane crash videos my entire feed became music + "dark stories" related content bringing non-stop music gear + engineering related education sites. Almost all ads I see on my phone via Google properties are related to the current thing I care about.

Beyond biographic details which are 99% disconnected from my old individual instagram/fb data (FB can just buy some correlation between email/phone/IP from my credit card or private postage company or whatever) they probably only profile IRL off the last 1-2yrs of your browsing behaviour in most cases.

The classic privacy invading ads usecase is a woman who is pregnant suddenly getting ads for kid stuff before other people they know they are pregnant. They probably won't be getting those ads a year later. At most they are now labelled as potential mother in some macro profile, but for day-to-day targetting it's all about the current thing she's looking at online.

I'm not defending this stuff and macro details matter for privacy at the nation-state and higher level, but my general point is that it's a living machine, constantly adapting with a short timeframe of data to maximize utility, not one that cares much about what you googled a few yrs ago 99% of the time.

Going through something the same, can tell you the people process and collaboration across teams (engineering, warehouse, legal and front end/backend) is the complexity as it takes time and then all downstream events are not synching in same paradigm.

Really requires a huge effort to pull together the right people and get fast feedback loops to stop inertia.

> Usually business assumptions about user accounts have their tendrils deep into the architecture

If their business assumptions are "users will never have a choice about how much we track them", they deserve what they got.

"They" being Meta, yes.

"They" being engineers, eh?

It's a tough sell to justify greenfield dev effort when there's a BigCorp paved road laid out for you.

> "They" being engineers, eh?

If you’re a volunteer Roman legionnaire don’t be surprised when you are ordered to march on Gaul.

Fair! I took the original question in the vein of "Who is to blame?"

I feel like IC latitude isn't usually sufficient to say "Do we really want to require the identity our platform is based around?"

ICs (at least the people good enough to pass a Meta interview) have a choice of where they work though. I've quit a job where I had an ethical issue with what the company was doing with the code I wrote. When Company X does something naughty, the individual developers need to at least share blame with the managers making the decisions. After all, whose fingers are typing the code in and hitting submit?

I haven't worked for a company as large as Meta but we encounter these issues on smaller projects too: should the unique identifier for an account be their email? Or a UUID? If your business only uses SSO, should you use the [Google/Microsoft/whatever] ID as the identifier for that user on your database?

I personally wouldn't think that Facebook engineers would have had their hand forced on something like this.

Oculus engineers apparently did.

So I'd imagine the internal pressure over something closer to main products would be the same or worse.

Centralizing identity was (prior to the EU) a core moat for Facebook/Meta.

And it’s good for consumers and Facebook can afford to do it, I wish the UK was still in the EU and I would be extremely happy about unlinking Instagram from Facebook just to avoid their notifications for it that pop up on Instagram never mind the ease of spying this creates.

Isn't the UK GDPR basically the same as the EU GDPR?

Different sized teeth.

Same size teeth, different inclination to bite.

Those are all acquired services, so the opposite is likely: they were linked together through the number of ugly hacks.

That was a very long time ago though, so I could imagine that there's not much left from the original code base after it was moved onto Meta's infrastructure.

> That was a very long time ago though, so I could imagine that there's not much left from the original code base after it was moved onto Meta's infrastructure.

They only linked them a few years ago, in anticipation of an antitrust battle. They are now unliking them because they have lost/ceded that fight.

Could you elaborate on that?

yea sf companies are definitely known to cleanup their hacks to go to market at any cost w a barely working thing later

isn't that done naturally when they rewrite it the trendy language of the day?

And I bet management asked: what can be so difficult about decoupling the accounts? Just set coupling=false somewhere or something, okay?

At least they have a choice to unlink accounts, which probably makes the overall DMA compliance much easier. For Google, it's just been an engineering nightmare, cross-cutting across the entire stack :D

Could be that they have not been entirely consolidated yet as they all previously were individual products.

From a user perspective is appears like the users have been relatively loosely coupled.

True, in which case it might be even more painful: imagine ending a year long epic to consolidate user account logic only to have to reverse it.

Instagram might have been a separate product, but Messenger was just Facebook’s built in chat feature.

> This must have been a painful engineering effort

It would be less painful if it were a universal option, and they didn't have to test with a bunch of geo-linked options.

Probably not, if it was painful they would have done it everywhere. Since now they have to maintain two configurations, linked and unlinked.

It also highlights how much revenue is tied to this bundling of service since it's probably very expensive to maintain this dual configuration.

It’ll save them a good chunk of time when they eventually get split off like Baby Bells

Sounds like a them problem not an us problem. Nothing they couldn’t afford „tens of teams”. It’s a nice moment living in the EU, knowing that common sense policies like GDPR and anti-trust can be enacted and enforced.

Could the limited EU accessibility to this engineering feat be broadened by users identifying as living out of Europe?

Given that the people on these teams are reaping stock from the efforts of mining personal data for people over decades I have a very strong “not sorry” feeling about any sort of negative anything that employees of Meta might experience. I would even go so far as to say, fuck these people, I have no empathy for you. You decided to be a part of the problem, and sucks to suck

I guess part of karmic consequence of "move fast and break things" motto - especially when it comes to not caring to develop or have forethought on security-safety concerns for what such a system, a digital version of The Facebook, could have on society; Harvard was planning to launch a digital version of their print version of The Facebook - and part of Mark's history he's quoted as saying, along with lying to the ConnectU twins he was hired to develop, that he didn't understand why Harvard was taking so long to get it going - that he could do it way faster; the externalized costs/harms are practically incalculable - all for that sweet sweet cheap-shallow-manipulative advertising revenue.

Reply on news.ycombinator.com