Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

"Localhost tracking" explained. It could cost Meta €32B

zeropartydata.es

Post reply on HN
Print view View original

51–60 of 286 posts

Re: "Localhost tracking" explained. It could cost Meta €32B

#51

Post by Waterluvian »

brookst wrote: post #37
genocidicbunny wrote: post #21

Earlier quoted context omitted.

> I think it’s just very, very easy to create a system of people collectively doing evil things where no one person carries the burden of evil individually enough to really feel sick enough with what they’re contributing to. Which is why I don't think punishing just the company itself is enough. The engineers, designers, PM's that implemented this should also receive punishment, sufficient enough to make anyone think…

Definitely a good way to drive talent overseas. Get the low level people to assume all of the risk with none of the upsides; ask recent grades and junior people to do E2E ethical analysis on every project in addition to their 60 hour/week job, give the truly evil people convenient, lower-level scapegoats.

Completely agree.

My feeling is that corporate officers should bear the burden that the corporation as a person currently bears. I can only imagine how much better things would be in past experiences if the C-levels felt a personal need to actually know how the sausage is being made.

Re: "Localhost tracking" explained. It could cost Meta €32B

#53

Post by genocidicbunny »

Waterluvian wrote: post #51
brookst wrote: post #37

Earlier quoted context omitted.

Definitely a good way to drive talent overseas. Get the low level people to assume all of the risk with none of the upsides; ask recent grades and junior people to do E2E ethical analysis on every project in addition to their 60 hour/week job, give the truly evil people convenient, lower-level scapegoats.

Completely agree. My feeling is that corporate officers should bear the burden that the corporation as a person currently bears. I can only imagine how much better things would be in past experiences if the C-levels felt a personal need to actually know how the sausage is being made.

I can't fully agree because the way I see it, that is in a way scapegoating the company executives. Are they responsible? Probably, yes, they set the direction of the company and give the orders at the highest level. But we the engineers and designers are the ones actually implementing what is probably a fairly nebulous order at the highest levels into something concrete. They deign that there should be evil created, but we're the ones who are actually making it happen.

Some of the responsibility lies with us, and we need to not pretend that's not the case.

Re: "Localhost tracking" explained. It could cost Meta €32B

#54

Post by Thorrez »

joshstrange wrote: post #49
Thorrez wrote: post #23

>You’re not affected if (and only if) ... >You always used the Brave browser or the DuckDuckGo search engine on mobile How does choice of search engine protect from this?

> How does choice of search engine protect from this? I don’t use android or either of those browsers but my guess is that either block the tracking pixel from loading in the first place or they’re more locked down on what they allow websites to reach out to (aka no Localhost access).

I'm not asking about browsers, I'm asking about a search engine. How could a search engine block a tracking pixel? You click a link in the search engine and go to a website. The search engine can't control the website after you go there, can it?

Re: "Localhost tracking" explained. It could cost Meta €32B

#55

Post by joshstrange »

Thorrez wrote: post #54
joshstrange wrote: post #49

Earlier quoted context omitted.

> How does choice of search engine protect from this? I don’t use android or either of those browsers but my guess is that either block the tracking pixel from loading in the first place or they’re more locked down on what they allow websites to reach out to (aka no Localhost access).

I'm not asking about browsers, I'm asking about a search engine. How could a search engine block a tracking pixel? You click a link in the search engine and go to a website. The search engine can't control the website after you go there, can it?

DuckDuckGo and Brave have browsers on Android

Re: "Localhost tracking" explained. It could cost Meta €32B

#58

Post by disgruntledphd2 »

joshstrange wrote: post #43
frenchmajesty wrote: post #15

Very impressive but not surprising coming from Meta. They have an history of doing this kind of things. Back in the early 2010s, they found a way to spy on HTTPS traffic on the iOS App Store to monitor which apps were getting popular. That's what allowed them to know WhatsApp and Instagram were good acquisition targets. At this point, I think the race for Zuckerberg is, can Meta survive long enough for the next platf…

> Back in the early 2010s, they found a way to spy on HTTPS traffic on the iOS App Store to monitor which apps were getting popular. They had people install a VPN app using enterprise certificate so it was never in the App Store and they monitored all the traffic that the VPN sent. Unlike this case, it required users to jump through a number of hoops/scary iOS warnings. Many still did, for a gift card or less.

> Back in the early 2010s, they found a way to spy on HTTPS traffic on the iOS App Store to monitor which apps were getting popular. That's what allowed them to know WhatsApp and Instagram were good acquisition targets.

Incorrect. An Israeli startup (Onavo) had pivoted into selling data acquired from their VPN got acquired by Facebook. Importantly, they used statistics to estimate population prevalence which is how FB knew that Whatsapp (specifically, this was all post IG acquisition) was super popular outside the US.

> They had people install a VPN app using enterprise certificate so it was never in the App Store and they monitored all the traffic that the VPN sent.

This was (sadly) an entirely different scandal.

Honestly, I generally defend Meta/targeted advertising in these threads, but this one is such incredible, total, absolute bullshit that I can't even begin to comprehend how one could defend this.

I do remember when I joined FB in 2013, how surprised I was that most of the company didn't care about ads/making money (apart from the sales org). That ship has clearly sailed.

Re: "Localhost tracking" explained. It could cost Meta €32B

#59

Post by bsimpson »

ranguna wrote: post #12

Tldr because this article has way too much fillers to my taste (but I'm sure there are people out there that enjoy reading that kind of thing): The native Instagram and meta apps start a server listening on predefined ports when you launch said apps, they eventually run on the background as well. When you are on your browser, whether in private more, not logged, refused or disabled cookies, or anything else that migh…

And according to the article, they're using RTC because Android is meant to be hardened against backdooring localhost, but Meta found a loophole that allowed it if over RTC.

Re: "Localhost tracking" explained. It could cost Meta €32B

#60

Post by drweevil »

DrScientist wrote: post #25
Waterluvian wrote: post #5

Every story like this has me thinking about two things: 1. Companies have no soul. They are, by design, just chasing revenue. Everything else is just a risk to be factored. 2. There are real humans at these companies who choose to take part in the business and design and engineering, etc. I don’t think these humans have no soul (though some won’t), and I don’t think they’re stupid (though some are). I think it’s just…

> Companies have no soul. They are, by design, just chasing revenue. Everything else is just a risk to be factored. I disagree - companies are set up/run by people, and those people define company culture/ company culture reflects those people. Not all companies, even big ones, are the same. To make that concrete - if Mark Zuckerberg found out about the above activity and was appalled and sacked everyone involved tha…

No, companies indeed have no soul. This is all about perverse incentives. While companies are setup/run by people, the (publicly owned) company as a whole only has one incentive: profit. If any person on the inside stands against that, they won't stand long. Investors, executives whose pay depend on it, etc. will make sure of that.

So the problem here is to transform a moral incentive into a financial one. A strong outside regulator who will stand its ground can do this, by imposing a meaningful financial penalty to punish the legal/moral transgression. This is why regulations and regulators with teeth are vital in a capitalist system.

I'm not holding my breath here. Regulatory capture is a thing. OTOH, Trump's undiplomatic approach to the EU may wind up costing Meta. We'll see.

Post reply on HN