> Organi-cultural deviance is a recent philosophical model used in academia and corporate criminology that views corporate crime as a body of social, behavioral, and environmental processes leading to deviant acts.
> This reflects the view that corporate cultures may encourage or accept deviant behaviors that differ from what is normal or accepted in the broader society.
https://en.m.wikipedia.org/wiki/Corporate_crime
In other words, whether or not what Facebook is doing is a crime, they are doing it because their corporate culture fundamentally believes that it is okay and acceptable for them to do it, even though wider society doesn’t agree.
And that’s the justification for filing criminal charges against organizations. It is the culture of the organization that encourages criminal acts, so the organization itself should be charged, and dissolved (the corporate death penalty) if necessary.
* Apps can open local TCP/UDP ports on the device to talk to each other. That's good, often. It's a valuable capability, just like access to shared storage is. And it doesn't leak any info the app doesn't want to leak.
* Apps can get a reasonably unique fingerprint for the device they're running on. Again, that's desired: backends want to know who they're talking to, and that it's not a MitM or hijacked account.
* Browsers can talk to those local servers too. Again, this seems useful to me, as long as native apps have capabilities that web apps lack, they should be able to offer them as extensions to the web API.
So basically we have a situation where Facebook's native app tells Facebook's web app (or rather Facebook's web code being distributed by Facebook's partner sites) what machine it's operating on (and maybe some more details about the history, like user account cookies, etc...), in contravention of the user's expectations about what they told the partner site to store about them.
It's that last bit that's the bad part. But it's not really about device security as I see it. Facebook broke the spirit of the cookie tracking rule, but not the letter.
Not sure if I agree on that one... at a minimum I think that should be behind a user consent prompt.
The reason they didn't do that is pure obscurity: if they blasted a tracking cookie over the internet they would have been caught faster. Trying to design "security" features by pushing the "obscurity" boundary around is usually wasted effort.
* App-to-app network communication really only seems sane between apps from the same vendor.
* Unique fingerprinting of the device is explicitly not desirable. They should have access to a unique anonymous identifier for the device, which cannot be compared between apps from multiple vendors.
* Browsers talking to native apps again seems like something that should only be possible if both the web domain and the app belong to the same vendor. I don't have a huge problem with Facebook.com talking to the Facebook app - I do have a problem with random 3rd-party sites talking to the Facebook app.
Case in point, FTC did start an antitrust lawsuit against Facebook in December 2020 and the trial finally started last month. Hence, Zuckerberg being at the inauguration, getting rid of fact-checkers etc.
EDIT: well, that's probably not true, there are probably many people working for e.g. the FTC that would love to go after big companies. This is certainly true for the CFPB. But collectively, there's very little will from either party to do so. I mean, a large portion of congress holds Meta stock; some got rich off it.
Why won't Meta be punished for this? Because they won't be convicted.
Why won't they be convicted? Because the court system is corrupt, trials are expensive, and Meta has more money to throw behind lawyers than anyone who cares to sue them.
Why is the court system corrupt? Because corruption is spreading through every aspect of the US government, as corruption, like black mold in a kitchen sink, tends to do when not actively fought.
Why are trials expensive? Because the law is complicated and there isn't much support for privacy, so this isn't open-and-shut like a murder case, it would be a long drag-out fight between the few people with little money who care about privacy, and a huge corporation powered by the fear and apathy and helplessness of billions of people.
Why does Meta have so much money? Because nobody stopped them when it would have been easy. Because corruption of democracy and erosion of privacy have been ongoing for decades, maybe forever.
Why isn't corruption being actively fought? The working class (Net worth under say 5 million) are on back foot against it. Nobody has time to vote, protest, organize, unionize, run for office, fix things, help the homeless, when you can't afford a damned thing, when a pregnancy is a career-ending problem, when you can't even get an abortion safely in many states, when you're one ambulance bill from a "not a debtor's prison" constructed debtor's prison.
Why isn't there much support for privacy? Same reasons, plus public education lags behind on this issue. Tech moved very fast the last few decades, and there's no public education for adults, so people don't really get sat down and told what the risk is of mass surveillance. The stories get written, sometimes, but not listened to. Nothing very serious gets done when you can always flip channels and see something funny, which is what Meta and TikTok sell to people. You can always flip channels and tune out, and it might take years to say to yourself "I think I have a crippling Internet addiction".
What's the actionable?
1. Always fight anyway. Get stuff off of Meta. Publish Own Site, Syndicate Elsewhere. Help friends get away. Do what you can.
2. Do things in physical reality.
3. Vote in every god-damned election you can vote in. Vote blue even if it's a shit sandwich, because most Americans are stuck under FPTP voting, and life is better under Democrats, do I need to explain the word "gradient" to a website full of startup hackers?
Every working system vulnerability is explicitly allowed by the code, or else it wouldn't work.
Do you mean that the OS provides for this possibility in a technical sense?
Or do you mean that the OS explicitly gave them permission to do this exact thing (and that permission was from the user?).
That something is technical possible isn't what makes something not a violation of the computer fraud and abuse act. Similarly, leaving my front door unlocked doesn't mean you aren't trespassing.