We know what you're doing | Hacker News Reader

We know what you're doing

weknowwhatyouredoing.com

408 pointsKenan114 comments

I'm surprised there isn't a column for people who are reading Hacker News.

This guy for example:

http://www.facebook.com/profile.php?=743264506

or this one http://www.facebook.com/gmcbay

His username is his full name and its in his profile with his real email... thats not exactly noteworthy that you managed to find it.

It's kinda scary to see your own facebook profile being posted on HN out of nowhere... =\

That's because you're being redirected back to your profile since the URL the parent posted is incorrect.

yeah, but why doesn't it respond with 404 as would be appropriate?

"You want to see a page we don't have? Let me show you some ads instead!"

Technically, a 404 page with ads on would be fine too ..

Most web sites don't 404 when fed unrecognized get params.

While that's true, I would kind of expect Facebook to do better than most sites. Oh, well.

Facebook tries to do whatever maximizes engagement. Technical correctness only matters when it serves that primary goal.

Some times a benefit can be indirect and hard to see immediately. Being "technical correct" reduces complexity, which again reduces costs down the road. For example, it makes it easier for third parties to integrate with your service, to name one benefit.

It may never be clear for each individual feature, but violations compound to form a mess of unpredictability. Facebook generally appears to me as being a company with a very strong engineering culture and so it surprises me a bit that they would let something like this slip. Maybe I'm just not seeing the whole picture and it is a clearly thought-out tradeoff and not simply negligence.

Just to set any minds at ease after the initial shock:

The link I posted is just a generic bad id link that ends up redirecting to your own Facebook profile if you are currently logged into Facebook. Anyone logged into Facebook will see their own profile.

The link joering2 posted OTOH is actually to my Facebook profile. But:

A) I don't really care (anything I put on my Facebook profile is assumed to be 1000% publically available information anyway).

B) Turnabout is fair play

Didn't know that one :)

Um, your goat is trying to eat your head or something.

That said, nice goat!

I don't want to sound gay or anything, but you're handsome... Oh and the guy who's neck your kissing looks okay too.

Interestingly, the string of numbers is a real user id. I presume it defaults to your own profile because facebook.com/profile.php goes to your own profile, and fb simply ignores the malformed parameters.

Nope, the trick is that he's skipping the "id=" part between the '?' and the user ID, so the param is not being passed properly and thus the link is processed as just 'profile.php' without params. The link https://www.facebook.com/profile.php?id=yaddayadda would work propperly.

I was confused at first because I use Facebook in a different browser, so it just gave me the login screen.

Haha, my heart momentarily jumped out of my chest when I clicked that.

This is a neat trick and reminds me of MCI codes from the BBS days. Basically, for a lot of BBS software (and usually enabled by default) visitors to your BBS when posting in discussion threads could insert escape characters (like "%UN") which at runtime would be replaced with metadata related to the person viewing the post at that time.

So, if I were to post "%UN's mother was a hamster and father smelled of elderberries" as part of a thread when I viewed it it would say "gfodor's mother..." etc. You could have first name, last name, etc, so with some creative thinking you could post fairly convincing posts that would trick people into thinking you were actually legitimately mentioning them.

I can remember many posts filled with angry replies from random users who went off the deep end when seeing that some random person on the BBS was trash talking them personally. Oops.

Edit: And for the curious, the purpose of these codes was usually for people creating assets for the BBS. For example, when designing your home screen (an ANSI text file, basically), inserting the codes made it so the home screen would reflect information on the logged in user. Usually when enabled the interpolation happened anywhere, not just in user defined assets. (Of course as BBS software got more mature these types of pranks were not possible with default settings.)

My favorite BBS hack was that on some standard RA configs, unless explicitly turned off by the sysop, you could save received messages to disk even if you were just a normal user. This meant that you could send a message to yourself, i.e. 'del . /q /s' (or whatever zapped your dos disk, I can't really remember.), and then save it to 'c:\autoexec.bat' ...

Other fun things where nailbombs, small .zip files that would expand to multiple gigs. When you uploaded those to early RA systems the virus scanner would attempt to unpack them and quickly fill up the entire disk, causing the BBS to grind to a halt.

Kids these days have no idea what they missed :3

Kids these days improved on the old pranks: http://research.swtch.com/zip

Haha, oh wow, thanks for that :)

Something like this?

http://news.ycombinator.com/item?id=259458

Funny thing is that when you try to post it on your facebook wall the preview shows your profile. But when somebody else clicks it it takes them to their profile

Previews on FB are loaded and processed in your own browser, and then results are uploaded to FB (to spare server load, I assume).

I use PHP every day. I understand how this happens. I've known about this particular trick for years.

... My heart still stopped.

Searching for '743264506' reveals that it is actually quite an old trick. And the poor chap whose facebook profile number it is doesn't seem to be a geek so he probably didn't invent it

What?

It isn't anyone's profile number. It's a random number in a broken profile URL.

https://www.facebook.com/profile.php?id=743264506

It's a coincidence that any profile exists with that number. It's meaningless too, you could use ANY number.

Sure you could. But do a google search on this one and compare it with a google search for a random number of similar length. Besides you can see from the search that it is this number that is used quite often with this trick

People have copied the URL, that's all. Similar URLs have also been copied.

What is your point?

I was just saying that it's interesting that this number has such a history. I didn't expect it. And from your first reply it seems you didn't either. It is a profile ID not a random number and it has been used multiple times for this exact trick

Oh you sneaky bastard!

I'm also a programmer, and I know how it works but I got to admit you freaked me up for a while :-)

OK, that was disconcerting to click.

Lol

A great example that should remind people that it's probably best to assume that everything they say or do online (offline as well) is now (and forevermore) public. Assume that anything you say or do has the ability to be seen by anyone and everyone around the globe instantly - without any methods of recourse. The genie is out of the bottle.

Hence one should adapt one's own behaviour and act accordingly (that doesn't mean that you should get paranoid - just be more careful :).

Reduce risk and watch what you say from now on.

I've been saying this for a while too.

There's no such thing as online privacy - privacy is dead.

It's better that the default for most things online is public since any privacy setting is just an illusion of security. Of course there are some notable exceptions to this (encrypted backup services that encrypt locally before backup), but for the most part if it's online and at least some other people can see it - everyone can see it.

using encryption it's completely possible to make any information exchange as secure as it can possibly be without accounting for humans on the other end leaking the information.

That's exactly the reason it isn't secure.

Yeah, if you think that, then you should read this :)

http://www.faqs.org/patents/app/20120110469#b

It took me a loooong time to figure out how to do privacy and social networking at the same time, using only web technology. Actually it can't be provably private using web technology because you have to trust the server -- which is why we need this: http://news.ycombinator.com/item?id=2024164

It doesn't have to be that way; it's very easy to lock down your facebook settings to friends-only. I think it's quite ridiculous that that's not the default. This pessimistic assumption you mention where anyone can see everything might be the safest, but it's just not how humans work. When you're surrounded by a bunch of friends (or their status messages), you don't assume the rest of the world is overhearing you as well.

I believe that when people say that everything on the internet is in the public domain they imply that even private data is subject to hackers and such. And if someone got root of Zuckerbergs cellar server (or, wait, somethig) they would be able to do what they wished with our data.

You are right about that option. But I find it prudent to always reduce the chance of a type 2 error and increase the chance of a type 1 error (http://news.ycombinator.com/item?id=4081972). It is best to assume the worst and trust nothing whilst acting probabilistically than to assume perfection/trust and act deterministically.

Hence, in this case, if you assume everything is public, you reduce the harm that can come to you when the trust you have in a service fails you (as it may well do). Just like an investor - take on risk, minimise uncertainty and price catastrophe correctly. This gives you the best of both worlds - risk priced in proportion to reward. You can have your cake and eat it too - if you only take a slice and no more.

As a completely off-topic side note: Since I was introduced to statistics, I always forgot which error was type 1 and which was type 2. I had to read your link to find out.

In code, "int errorType = 1;" would be a badly chosen variable :)

The expressions "false positive" and "false negative" reveal more semantics than "type 1" and "type 2", and are therefore much easier to remember.

You are correct, my apologies for explaining with improper terms - that's the curse of knowledge I suppose.

I quickly forget that the "map" in my brain is about 10 times more detailed than the vector representation I detail in my answer - and it often lacks ideas that may be critical to understanding.

I will use false positive/negative terminology from now on - apologies for the dense language and propagating difficult to comprehend terms - I'll try to stop doing that :D.

While I do agree that false positive and false negative are better names, they do have one shortcoming in comparison:

Classical statistics suffers from the inference problem, where instead of "tested positive for presence" you have to say "tested negative for absence". So a type I error is a false negative as much as it is false positive, which can get confusing.

As other readers have mentioned, your data is still owned by Facebook and subject to malicious intruders and the like. I just wanted to add that without any malicious intent, Facebook could intentionally or accidentally change your settings so certain information you had set to private is now public, without your consent and without any warning. Remember when Google exposed everyone's contacts through Google Buzz[1]? It's easy for someone to underestimate the difference between what you consider private data compared to what they do.

[1] www.businessinsider.com/warning-google-buzz-has-a-huge-privacy-flaw-2010-2

In principle it has always been so - whatever you do leaves an permanent imprint in people and things around you. It's just that the Internet is a new, much more efficient way to navigate and explore the Great Web of Causality. So what was true just in principle, now became true in practice.

The other option is to arrange your life such that you don't have to care what other people think about your status messages.

Not necessarily easy for everyone, but much more satisfying in the long run.

I can't believe people are still publicly posting stuff about their bosses. Surely there has been enough press coverage about people getting fired for fb/twitter antics

Most bosses do not have the time, wherewithal or care enough to do this. There is nothing wrong with people blowing of steam.

>>Most bosses do not have the time, wherewithal or care enough to do this.

Agreed.

>>There is nothing wrong with people blowing of steam.

And each to their own, but it's easy to make a post private instead of public, and doing so seems much more prudent to me.

I think this is so naive. Sure a "good" boss probably won't be snooping on his or her employees. However, I'm pretty sure most bosses are humans and humans tend to snoop on each other

Au contraire, regardless of whether or not it's wise to diss your boss online, the last thing we need more of is mass knee-jerk reactions to information over-reported by the press.

> I can't believe people are still publicly posting stuff about their bosses.

It's a free world. People should be allowed to say whatever they want on whatever medium they want (as long as it's not hate-speech etc.)

It's also free in that the boss can fire you if he feels like it in many places.

I'm not saying they legally shouldn't be allowed to (I doubt you will find anybody here that thinks that). I'm just saying it's a stupid thing to do

People said stupid things in public before social media. :)

Well according to the Gervais principle, there are two likely possibilities here. If it's a Loser insulting his Clueless boss then he probably has little to lose and probably enjoys the risk of his boss finding out while sharing a good laugh with his friends. On the other hand if it's a Clueless insulting his Sociopath boss then, well, there's probably a good indicator of why he's stuck in the Clueless caste.

I have some doubts about the site's disclaimer: "I cannot be held responsible for any persons actions as a result of using this experiement."

If someone gets fired upon a comment you took out of context and put under "people who want to get fired" then I wouldn't bet the above statement as your best line of defence in a lawsuit.

Agreed. I up voted the link, but I think the same message could have been conveyed with garbled names and numbers.

That's a terrible disclaimer. You can't just disclaim your way out of statutory liability.

There's probably nothing to worry about with re-publishing an already public fact, but the cases where errors are made e.g "I'd hate to be my boss" filled under "People who hate their boss", the casual reader may be confused (some might say mislead).

The solution is just to keep people informed, so your disclaimer may say something like: "the information on this site is automatically collected from public posts to Facebook. Posts are classified automatically, and as such our classification of their sentiment may be inaccurate."

Also, just in case one of the Facebook posts says something defamatory, hate speech, etc. you can gently remind people that you didn't write, edit, or approve of the content so "are not responsible for the content of messages".

You know what? Use that same GET method from the about page, mine for certain words, display analytics on a dashboard next to a stream and you've probably just put a few social media "consultants" out of work.

/dastardlyGrin

Reminds me on the who-is-not-at-home syndication from Facebook and Twitter. Even so these are scary, I really think they provide excellent privacy teaching moments. Hope you are going to keep this up for some time and enhance it with other categories.

peterwwillis tweets "I LOVE MY BOSS, HE'S THE SMARTEST, I CAN'T WAIT TO WAKE UP EARLY AND FIGHT TRAFFIC!!!"

Am I doing it right?

Sycophancy is more effective in person. You could waste a lot of time like this without getting your nose brown at all.

Another interesting column: "Who's out of town?". I wonder how burglers use social networking.

> I wonder how burglers use social networking.

Allegedly, they do pay attention to tweets from people they can find the home address of.

http://www.telegraph.co.uk/technology/news/8789538/Most-burg...

Sad how most of these people fail to form a coherent sentence.

I find it odd that people are surprised by things like this. The information is very public.

Maybe because they never consciously chose to make it public; that's simply facebook's default and IMO it's counter-intuitive that social interactions are made public.