Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook has sent a cease-and-desist letter to researchers

twitter.com

Post reply on HN
Print view View original

111–120 of 201 posts

Re: Facebook has sent a cease-and-desist letter to researchers

#111

Post by xg15 »

an_opabinia wrote: post #25
ethanwillis wrote: post #2

It's well within their rights as a private company, right? We need to have a serious discussion about the power these FAANGs are exerting and we need to stop making excuses for them.

It's interesting. What would be an "acceptable" mix of demographics for political ads recipients? That is to say, what is the answer to that question where there is no PR story, where Facebook doesn't look bad? If the answer is, none at all... I'm sure we can see where they are coming from. In my opinion you don't really need to do the NYU study. Intellectually honestly, many political ads will disproportionately app…

> That is to say, what is the answer to that question where there is no PR story, where Facebook doesn't look bad?

How about don't have political ads at all, if this question is so difficult to answer...

Re: Facebook has sent a cease-and-desist letter to researchers

#112

Post by nickff »

xg15 wrote: post #103
nickff wrote: post #74

Earlier quoted context omitted.

They might be willing to partner if NYU is willing to indemnify Facebook against any and all liabilities which may result. How likely is NYU to take on that risk? Why should we expect Facebook to take on the risk for NYU?

Hang on. The whole chain of reasoning started with FB protecting users' interests through the permission system, which NYU ostensibly circumvented. How is it in the users' interests to indemnify Facebook?

If NYU internalizes the cost of all breaches (by indemnifying FB against harm), they will be very careful with the data, and prevent another Cambridge Analytica problem.

Re: Facebook has sent a cease-and-desist letter to researchers

#113

Post by adtac »

xg15 wrote: post #107
Permit wrote: post #46

Earlier quoted context omitted.

If I’m your friend on Facebook should you be allowed to go to my page and give all the information I’ve shared with you to another 3rd party? You trust NYU, OK fine. Can I give the same information about you to pro-Trump researchers?

By that logic, why is it ok for Facebook to have that data? Why is it ok for Facebook to scrape my address book?

Not that I want to defend Facebook, but that person entered into an agreement laid out by Facebook's terms of service and privacy policy (lol), not the privacy policy set by this plugin.

Re: Facebook has sent a cease-and-desist letter to researchers

#114

Post by nickff »

MAGZine wrote: post #98
nickff wrote: post #74

Earlier quoted context omitted.

They might be willing to partner if NYU is willing to indemnify Facebook against any and all liabilities which may result. How likely is NYU to take on that risk? Why should we expect Facebook to take on the risk for NYU?

So is your opinion just that facebook just shouldn't be researched?

I don't really have a view on that, but I think researchers and universities should be held fully liable for the harms they cause, that way, they'll be more careful.

Some research just isn't worth the risk, but as an outsider, I'm not in a place to make that judgement. NYU could also insure against data breaches; in that case, we might get some good security audits.

Re: Facebook has sent a cease-and-desist letter to researchers

#115

Post by filoleg »

CivBase wrote: post #106
filoleg wrote: post #62

Earlier quoted context omitted.

>Why shouldn't they be allowed to share it with other people? >What legal obligation do they have to keep the information you shared private? Those exact same questions can very well be asked of the whole Cambridge Analytica scandal, and yet some people will give different answers to those two scenarios. Cambridge Analytica app was explicitly asking users for permission to access their data and data their friends pub…

> However, Facebook does have the obligation to not share info of users who didn't explicitly consent to it with third party apps But Facebook is not sharing info of users' friends. Users are sharing information about their friends. If a user should not be able to access particular information about their friends, then the onus is on Facebook to restrict that access. It was Facebook's fault for exposing excessive dat…

>It was Facebook's fault for exposing excessive data to users' friends during the Cambridge Analytica scandal

I don't follow this logic at all. The data shown to users' friends is the same data that is shown to them now. Which is usually all their public photos (nothing from private albums), the friend list (if they didn't make it private), etc., only the stuff that friends are expected to be able to access (and still can). And on the list of permissions on the permission request page, the app had a separate line for "friends' info" specifically (just like it has for every single permission requested), so there was nothing sneaky about it. The CA app asked users to provide them the same data about their friends that they can see in the browser by visiting their friend's page (and page only, nothing private or your messages with them; basically, only the info that everyone in the same security group that you are in sees). The exact same set of data that the browser extension this whole thread is about is accessing.

With that error corrected, it sounds like you are arguing for the case that FB was not at fault during the CA scandal because of all those logical reasons you brought up, and then conclude that FB was at fault and CA was in the clear.

I am reserving my own judgement on who was at fault, but I hope you can see why your reply left me (and likely some other people) confused.

As a cherry on top, CA didn't acquire the data directly from the app, as it wasn't their app. They got the data later on from a research team at Cambridge University's Psychometrics Center, which was the one originally collecting it. Sounds eerily similar to the scenario at hand.

Re: Facebook has sent a cease-and-desist letter to researchers

#116

Post by warkdarrior »

cronix wrote: post #45
2arrs2ells wrote: post #33

Don't miss Alex Stamos (former Facebook Chief Security Officer's reply): https://twitter.com/alexstamos/status/1320006154424967170 If I'm understanding Alex right, he's saying that Facebook's 2019 FTC consent decree requires them to limit the personal information collected by apps on the platform.

It's a browser plugin, not a facebook app. Why should facebook have a say on what plugins I have installed in my browser that did not come from facebook? Should they be able to have a say about ublock origin or other apps I have installed on my computer/browser?

Is ublock origin allowing you to scrape data from their platform? Then they may want to block that.

Re: Facebook has sent a cease-and-desist letter to researchers

#117

Post by ahupp »

okennedy wrote: post #93
edouard-harris wrote: post #58

Earlier quoted context omitted.

The point is that CA's data harvesting looked like it was transparent to users at the time they were doing it — which is precisely the appearance you'd expect a malicious app to try to convey. The NYU project is probably on the level, but "they're probably on the level" isn't a very good security model at Facebook's scale. More to the point, the FTC's 2019 Consent Decree [1] makes it fairly clear that FB is responsib…

For a project like this to happen at a major US university (especially once outside funding is involved), it needs approval of the university's Institutional Review Board. Getting IRB approval entails researchers proposing a strict set of guidelines for how the data will be collected/used/stored, examining the potential for harm to participants, and convincing a room of very very risk averse individuals that the proj…

The data CA used wasn't collected by them. They got it from a research project at Cambridge University's Psychometrics Center. This is exactly the same situation.

Re: Facebook has sent a cease-and-desist letter to researchers

#118

Post by kinkrtyavimoodh »

Not sure why people are angry at Facebook for this.

Cambridge Analytica was very similar—it was a third-party using an API for its intended purpose (with the user's consent) and then doing questionable things with the data, yet that did not stop the world from raking FB through the coals.

And it does not matter that CA was using FB's API and platform. In both cases there was user consent to provide the data.

Re: Facebook has sent a cease-and-desist letter to researchers

#119

Post by maest »

jandrese wrote: post #6
ethanwillis wrote: post #2

It's well within their rights as a private company, right? We need to have a serious discussion about the power these FAANGs are exerting and we need to stop making excuses for them.

Is it within the rights of a company to dictate what software I have installed on my personal machine? If Facebook wants to ban every account using the software that is within their rights, but they don't get a say in what I have installed.

Different field, but GeForce Now received a lot of cease-and-desist letters from a bunch of game publishers for allowing people to run games on their platform.

For context, GFN lets you essentially rent a virtual machine in the cloud, where you can log in with your own Steam account and play the games that you've already purchased. For whatever reason, game publishers saw it appropriate to demand GFN to stop offering this service. And, more baffling, some users actually suported the publisher's actions. Just to make it clear, GFN is not letting you play games you do not own, they're simply letting you rent hardware on which to play games you've already purchased on Steam.

Here is one of the game devs explaining why they asked GFN to remove the game from their platform (and subsequently getting slammed by gamers): https://mobile.twitter.com/RaphLife/status/12341813158402293...

Re: Facebook has sent a cease-and-desist letter to researchers

#120

Post by kinkrtyavimoodh »

patja wrote: post #102
ponker wrote: post #85

Good. I didn't agree for NYU to have my Facebook data and for them to operate a plugin at scale which crawls my data (if anyone with permissions to see my profile installs this plugin) is a violation of my rights.

How do you feel about it when anyone who has you in their phone's contacts list hands over all that personal information about you when they install WhatsApp or any other app that requests contacts data? Seems like the same thing.

Yes, it is objectionable, and ordinarily people here would agree it is objectionable.

The wrongness doesn't change just because in this particular case the framing is "poor researcher vs evil Facebook"

Post reply on HN