I guess we don't call it a "0-day" if it's multinational corporation doing the illegal data exfiltration ...
"Localhost tracking" explained. It could cost Meta €32B
171–180 of 286 posts
Re: "Localhost tracking" explained. It could cost Meta €32B
#172This system was designed and implemented by engineers who committed code in a source control system with their name attached, and the changes were requested by product managers in tickets in the ticketing system with their name attached. Those engineers and product managers should be personally liable for an equivalent % of their annual salary as Facebook is liable for a % of its annual revenue.
Its unethical for sure, seems like some engineers will do anything for their salary, but if they don't do it somebody else will and it is an exciting technical challenge. Its better to blame the management and higher ups or zuck himself directly. Blame the people who finance it and profit from it, not the people who coded it. Follow the money
> Its unethical for sure, seems like some engineers will do anything for their salary, but if they don't do it somebody else will and it is an exciting technical challenge.
I remember finding this out as a very junior engineer straight out of university. I was once asked to write code to cheat at a benchmark to make my company's product look better than it actually was. I had deep misgivings about this, but as a brand new junior developer, I was very hesitant to speak up. Eventually I told my manager I didn't feel comfortable with the ethics of working on that project, and he was totally cool with it! He said "No problem, we'll take that task out of your queue and give it to "Jim", he'll do it instead." Jim was thrilled and wrote the benchmarking cheating code himself.
There's always someone willing to do it.
Re: "Localhost tracking" explained. It could cost Meta €32B
#173Earlier quoted context omitted.
AND, whenever you suggest here that engineers should consider the morals or ethics of what they are being asked to work on, you often get lots of push back in the comments. "I just want to work on cool tech! It's my company's problem what they use it for!" and "Hey, I'm just a code monkey, don't blame me! If my manager tells me to build the Torment Nexus, I build the Torment Nexus!"
This is one of the main reasons I’m for licensing software engineers like civil engineers are. You know that without a license, you can’t work in the civilized world. So when your license requires you to not build the torment nexus, and some manager comes and says “build the torment nexus” then you tell them no, knowing that they can’t just fire you and hire someone else to do it. Yes, they might outsource it, but yo…
Yes, they'll just outsource it. Plus, it could be argued that localhost tracking is not actually illegal in the jurisdiction where it was developed (debatable, I know.)
Re: "Localhost tracking" explained. It could cost Meta €32B
#174Remember in 2014 when the Android Twitter app started sending a list of all your installed applications back to Twitter? https://news.bloomberglaw.com/privacy-and-data-security/twit... Ever since then I refused to install native versions of apps that could be used in a browser. I don't use Facebook or Instagram so I don't know if that works anymore, and I recall testing that they were intentionally crippling Facebook…
Web apps have been sabotaged so severely for years now, and it really peeves me. Half the time they bombard the UI with "use the app!!1" popups and the other half of the time they just don't work. The worst part is that a lot of native apps these days are just web views. You can't even be bother to use the native UI toolkit and you expect me to download your app? If this is just safari with extra steps then let me us…
I like using ublock origin since I can create filters for those popups.
Re: "Localhost tracking" explained. It could cost Meta €32B
#175Once again those of us in NA have to leave it to the European government to look out for us.
Yes, I just love all those cookie banners. Thanks!
Re: "Localhost tracking" explained. It could cost Meta €32B
#176What I don't get: - How come Yandex was doing it for years without being noticed. - Facebook must have known about this technique for years as well, why did they only enable it last year.
They knew who was going to be president this year.
The American president doesn't really matter in this case. The EU is where they're going to get destroyed.
Re: "Localhost tracking" explained. It could cost Meta €32B
#177Remember in 2014 when the Android Twitter app started sending a list of all your installed applications back to Twitter? https://news.bloomberglaw.com/privacy-and-data-security/twit... Ever since then I refused to install native versions of apps that could be used in a browser. I don't use Facebook or Instagram so I don't know if that works anymore, and I recall testing that they were intentionally crippling Facebook…
this is still perfectly legal and allowed.
every app can scan your apps and recently opened ones "for security".
same for your contacts.
whatsapp (only meta product i need to touch in our fleet) will do both at very fast intervals, and upload a contact list diff if it detect changes.
the whole issue here was that meta bypassed the user matching on the web without paying google "cookie matching" price
Re: "Localhost tracking" explained. It could cost Meta €32B
#178Earlier quoted context omitted.
Its unethical for sure, seems like some engineers will do anything for their salary, but if they don't do it somebody else will and it is an exciting technical challenge. Its better to blame the management and higher ups or zuck himself directly. Blame the people who finance it and profit from it, not the people who coded it. Follow the money
> Its unethical for sure, seems like some engineers will do anything for their salary, but if they don't do it somebody else will and it is an exciting technical challenge. I remember finding this out as a very junior engineer straight out of university. I was once asked to write code to cheat at a benchmark to make my company's product look better than it actually was. I had deep misgivings about this, but as a bran…
In other more heavily regulated industries, whistleblowers are fortunately compensated and protected for raising such ethical issues. I wonder how far tech can go before we start to see similar government agencies and rules put in place to do the same.
Re: "Localhost tracking" explained. It could cost Meta €32B
#179So I am seeing two issues here. 1. Android allows apps to open ports without permissions. And apps to communicate with each other without permissions. 2. The browsers allow random domains to access services on the localhost. Without notifying the user. We have seen vulnerabilities in the past accessing dev services running on localhost. Something should be done there.
Those are two technical issues, yes. But even with those technical issues present, Facebook shouldn't have done this.
Oh absolutely, we are on the same page on that one. I just think it shouldn't be that easy for them to do it.
Re: "Localhost tracking" explained. It could cost Meta €32B
#180This system was designed and implemented by engineers who committed code in a source control system with their name attached, and the changes were requested by product managers in tickets in the ticketing system with their name attached. Those engineers and product managers should be personally liable for an equivalent % of their annual salary as Facebook is liable for a % of its annual revenue.
Its unethical for sure, seems like some engineers will do anything for their salary, but if they don't do it somebody else will and it is an exciting technical challenge. Its better to blame the management and higher ups or zuck himself directly. Blame the people who finance it and profit from it, not the people who coded it. Follow the money
Or blame them all. “If I don’t do it someone else will” hasn’t been accepted as an excuse historically, I don’t see a good reason to change that now.
(also, is it an exciting technical challenge? It’s a POST request to localhost!)