Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Zuckerberg on Cambridge Analytica situation

facebook.com

Post reply on HN
Print view View original

261–270 of 583 posts

Re: Zuckerberg on Cambridge Analytica situation

#261

Post by contextfree »

natural219 wrote: post #34

> In 2007, we launched the Facebook Platform with the vision that more apps should be social. Your calendar should be able to show your friends' birthdays, your maps should show where your friends live, and your address book should show their pictures. To do this, we enabled people to log into apps and share who their friends were and some information about them. Why do we not even have this?! These features sound fa…

I remember Windows Phone 7/8 used to do a lot of that (integrate the built-in apps with Facebook data). It worked fairly well for a time, at least if you didn't have a huge number of FB friends.

Re: Zuckerberg on Cambridge Analytica situation

#262

Post by jd20 »

taurath wrote: post #230

Re: His first "fix": > First, we will investigate all apps that had access to large amounts of information before we changed our platform to dramatically reduce data access in 2014, and we will conduct a full audit of any app with suspicious activity. We will ban any developer from our platform that does not agree to a thorough audit. And if we find developers that misused personally identifiable information, we will…

If they knew about CA obtaining this data in 2015 and sat on it then, no telling what information they may be sitting on now.

Most companies, when they learn of a data breach, they take measures to notify their affected users (whether contacting them directly, or publicizing it). Instead, FB's saying, "Here's a tool at the top of your feed, you can check the safety of our data yourself". (And fat lot of good that'll do people who don't even use FB.) This lets them continue to do business as usual, putting the onus on users to safeguard their privacy, while they can stick their heads in the sand.

Re: Zuckerberg on Cambridge Analytica situation

#264

Post by krelian »

victor106 wrote: post #184

This is such a well crafted statement not from Zuck's heart but from a PR team that has been working over time. Shame on you FB and Zuck you Suck. If they are so honest or like to be honest going forward why can't they make it easy to see all my pics and posts that are public? Why can't they make it easy to see who can see what I posted? Which app or user is using my data. They have billions of dollars and can't impl…

>why can't they make it easy to see all my pics and posts that are public?

Not a FB power user by any means but at least on desktop that's pretty easy to know

>Why can't they make it easy to see who can see what I posted?

Doesn't each post have icon showing who can see it?

Re: Zuckerberg on Cambridge Analytica situation

#265

Post by louthy »

uptown wrote: post #150
louthy wrote: post #80

Earlier quoted context omitted.

> But it was also a breach of trust between Facebook and the people who share their data with us and expect us to protect it. We need to fix that. This is so disingenuous. When almost the entire world has a FB account, ‘fixing it’ now is essentially closing the stable door after the horse has bolted. The data has been harvested, it can’t be unharvested. There is no fix. Personally, I’m disgusted that my data has prob…

"Personally, I’m disgusted that my data has probably been compromised just because I have some less technically astute friends who sign up for these idiotic apps." Now just imagine what happens to your contact info when your friend links their email account or their address book to "find their friends" on all of these services?

Quite. Although it’s not quite as extreme as having access to my timeline (for example). What’s annoying is even now after a week of reporting I have no way of finding out what, if any, of my non-public content has been compromised; or what the scope of the data was available at various periods in facebook’s history.

We need an equivalent of haveibeenpwned

Re: Zuckerberg on Cambridge Analytica situation

#267

Post by maxpert »

So you knew that breach happened in 2015, they might have already handed off data to someone else, and you didn't bother telling people? Quoting:

"In 2015, we learned from journalists at The Guardian that Kogan had shared data from his app with Cambridge Analytica. It is against our policies for developers to share data without people's consent, so we immediately banned Kogan's app from our platform, and demanded that Kogan and Cambridge Analytica formally certify that they had deleted all improperly acquired data. They provided these certifications."

What does banning or disabling app means? If you were responsible enough and you cared about user data you should have made it public right there and then! This is no excuse!

Re: Zuckerberg on Cambridge Analytica situation

#268

Post by jd20 »

__jal wrote: post #95
omarforgotpwd wrote: post #63

I don't agree with people who think these scandals will be the end of Facebook. Instead, Facebook will become more entrenched as it develops advanced features to handle national security issues, allow users more sophisticated control over their data, etc. I like that Zuckerburg explicitly takes personal responsibility for everything that happens on his platform in this post.

FB will be fully integrated as part of the surveillance state soon enough. > that Zuckerburg explicitly takes personal responsibility for everything that happens on his platform Sorry, but bullshit. He may say that, but I'll believe it when he publishes the agreement he signed that makes him personally liable for lawsuits.

Seriously, every CEO is held responsible for the actions of the company he runs. He's just restating the obvious here.

Re: Zuckerberg on Cambridge Analytica situation

#269

Post by aylmao »

hendzen wrote: post #207
aylmao wrote: post #192

Earlier quoted context omitted.

If it were some computation, aggregation or analysis this work, but a lot (I'd guess, most) applications might not fall into this category. How are you gonna present the data in a UI to users, if no data is supposed to leave the server?

The UI could be a web page, mobile app, etc just like FB.com. But to see any user data you would actually have to be authorized as that specific user. I.E. a developer could test their app by logging in with their own FB account and using their own data but would have no capability to look at the raw DB entries of other users. Or perhaps their could be a limited capability for developers to log in to their app as ano…

Hm, the catch here is something like this could happen:

  +--------------+        +----------+        +--------------+
  |              |        |          |        |              |
  | other server |        |  Server  |        | other server |
  |              |        |          |        |              |
  +-------+------+        +----+-----+        +-------+------+
          ^                    |                      ^
          |                    |                      |
          |               http request                |
          |               containing user             | 
          |               data for UI                 |
    http request made          |               rouge http request
    with a legit purpose       |               sending the user data
    say fetching assets        v               to some other server
          |            +-------+-------+              |
          |            |               |              |
          +------------+  mobile app   +--------------+
                       |               |
                       +---------------+
And there is really no way of knowing which requests are for legit app purposes and which would be leaking data. Now, you could require that the mobile app make no requests to any service but Facebook, which brings two questions:

1. can facebook do this? Apple could; they approve apps and get the binary/manifest before the app is released. But how could Facebook enforce this?

2. would developers be ok with this? Relying 100% on facebook?

It is an option, I'm not saying it's infeasible. An interesting idea for sure, thanks for sharing!

Post reply on HN