Live data from Hacker News

Facebook bans KDE application, deletes user photos

networkworld.com

1–10 of 45 posts

Re: Facebook bans KDE application, deletes user photos

#3
I'm going to assume this was a mistake. However, I have been seeing quite a few "mistakes" similar to this from Facebook lately. They have a legitimate problem with application spam, but if they are going to try and fight that by banning applications, they better be damn sure they are getting the right ones. But, they don't seem to be doing a particularly good job of that, at least from what I've seen.

However: maybe they are doing a great job, and it's just the few mistakes we hear about. Or, even — maybe there's a legitimate reason for banning this application (although they could be better at communicating that reason, if there is one). But, at this point, even just the cases I've heard about here on HN don't inspire me (or, it seems, many others) to choose Facebook as the platform to develop upon. And that might be a bigger issue, even more than application spam.

Edit: after reading saurik's post, this seems like a legitimate situation for them to pull it. However, the point still stands: they need to communicate this better to both KDE and the users of the application.

I like Facebook. Just don't like it when stuff like this happens.

Re: Facebook bans KDE application, deletes user photos

#4
post #2

Banning the application could be justifiable (don't know the details), but removing everyones user photos just because they were uploaded with a certain tool, wow, that's messed up. I simply don't have words for it.

Facebook is a walled in garden, they wont let outsiders benefit on their backs. Any app which recieves fame is due for "accidents".

Re: Facebook bans KDE application, deletes user photos

#5
From the error, it actually sounds like the application had an API key distributed inside of it... which means that anyone, anywhere, could pretend to be the application.. and could use its credentials to upload anything they want.

Yeah, right here:

    fbtalker.cpp:    m_apiKey     = "bf430ad869b88aba5c0c17ea6707022b";
    fbtalker.cpp:    m_secretKey  = "0434307e70dd12c414cc6d0928f132d8";
To be honest, as much as I hate Facebook's developer program, sharing an API key in an end-user downloaded application (open source or not: doesn't matter) seems downright inane, and I can easily see circumstances where it looked like the application in general was doing something downright forbidden (maybe uploading porn), and the entire application got banned and all of its content got retroactively pulled.

In fact, I'm a little rusty on this whole Facebook API thing, but I could easily see situations where the application was authorized to access peoples' photo galleries, then allowing anyone with those API keys to upload photos /as other people/. This likely went unnoticed for a while, but eventually someone figured it out, uploaded porn to /someone else's account/, and then the only feasible way to fix the situation (assuming a person even bothered looking into it, and I wouldn't blame Facebook much if no one did) was to just pull all photos that had been uploaded.

Seriously: this is not a situation of "do not use Facebook": this is a situation of "do not use insecure applications".

Re: Facebook bans KDE application, deletes user photos

#6
post #2

Banning the application could be justifiable (don't know the details), but removing everyones user photos just because they were uploaded with a certain tool, wow, that's messed up. I simply don't have words for it.

Content from spammy apps are hidden when the app is disabled. If you think about this it sort of makes sense: if the app is sending lots of crap without user consent, merely disabling an app does not remove all the crap it has already sent out.

I don't think the posted content are actually deleted though, they should be unhidden when the app is unblocked.

Re: Facebook bans KDE application, deletes user photos

#7
post #5

From the error, it actually sounds like the application had an API key distributed inside of it... which means that anyone, anywhere, could pretend to be the application.. and could use its credentials to upload anything they want. Yeah, right here: fbtalker.cpp: m_apiKey = "bf430ad869b88aba5c0c17ea6707022b"; fbtalker.cpp: m_secretKey = "0434307e70dd12c414cc6d0928f132d8"; To be honest, as much as I hate Facebook's de…

How exactly does one solve this issue?

Facebook's auth/app system makes a whole lot of sense for web sites but zero sense for desktop/mobile apps.

The app is not insecure, how does exposing two keys endanger ANY user data?

iPhone apps have the EXACT same issue, as this application, give me an IPA file and I'll give you the app's keys. Look at Facebook's official docs and they recommend embedding the keys into the app in this manner.

Re: Facebook bans KDE application, deletes user photos

#8
It's simple, you get your own site, which you pay for if you have to, then add one of the countless plugins that automatically share you content to Twitter, Facebook, etc.

If all you do is upload your primary content directly to Facebook and nowhere else, you're just asking for trouble.

Re: Facebook bans KDE application, deletes user photos

#9
post #7
post #5

From the error, it actually sounds like the application had an API key distributed inside of it... which means that anyone, anywhere, could pretend to be the application.. and could use its credentials to upload anything they want. Yeah, right here: fbtalker.cpp: m_apiKey = "bf430ad869b88aba5c0c17ea6707022b"; fbtalker.cpp: m_secretKey = "0434307e70dd12c414cc6d0928f132d8"; To be honest, as much as I hate Facebook's de…

How exactly does one solve this issue? Facebook's auth/app system makes a whole lot of sense for web sites but zero sense for desktop/mobile apps. The app is not insecure, how does exposing two keys endanger ANY user data? iPhone apps have the EXACT same issue, as this application, give me an IPA file and I'll give you the app's keys. Look at Facebook's official docs and they recommend embedding the keys into the app…

They have a special desktop API that solves this exact issue.

EDIT: they used to, at least. They now want devs to use the web OAuth flow by adding an embedded web view to your desktop app. http://developers.facebook.com/docs/authentication/

Re: Facebook bans KDE application, deletes user photos

#10
post #2

Banning the application could be justifiable (don't know the details), but removing everyones user photos just because they were uploaded with a certain tool, wow, that's messed up. I simply don't have words for it.

If you've been following the recent threads, Facebook has recently started targeting tons of photo apps, often for no visible reason, and many think it's because Facebook is about to get into the game themselves with their own photo sharing apps. Expect an answer within the month or so when they release it.
Post reply on HN