Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Tries To Silence Blogger To Cover Up User Data Scandal

readwrite.com

Post reply on HN
Print view View original

21–29 of 29 posts

Re: Facebook Tries To Silence Blogger To Cover Up User Data Scandal

#21

Post by louwrentius »

diego wrote: post #7
louwrentius wrote: post #3

Read nothing scandalous about Facebook's behavior. This HN headline doesn't deliver. There is nothing wrong with the request to keep this quiet for a bit so you can investigate. This is not uncommon in the security world where vendors get some time to get their stuff together and release a fix. Depending on the severity of the issue and the risk of abuse.

“Oh and by the way, you are not allowed to disclose any part of this conversation; it is a secret that we are even having this conversation” If this is true, it's practically begging for the blogger to research the law, and publish the whole conversation because FB has no right whatsoever to make such demand. I wouldn't call it scandalous, but it would certainly be a pretty dumb thing to say. If I had to guess, I wou…

I did not read the 'mixed feelings' blogpost with that quote.

If that quote is genuine, it still reeks of a stupid statement of an individual working for Facebook than a deliberate policy of Facebook to silence such people who find security issues. It's such an obvious dumb request. Don't attribute to malice what can be attributed to incompetence. Facebook is not incompetent, but it's not infallible either.

I'm withholding judgement here. I'm not sure all info is available.

Re: Facebook Tries To Silence Blogger To Cover Up User Data Scandal

#22

Post by tlrobinson »

unreal37 wrote: post #5

I don't even trust the original blogger is being completely up-front and honest with us. He was going for the sensationalist angle from the start, and to have Facebook call him and ask for his help was just too rich for him to handle. Ack, coverup! Ack, censorship! FB needs to find out which app did this. Give them a chance.

That should be easy, right? Just cross reference the list against every app's users (and their friends?)

Re: Facebook Tries To Silence Blogger To Cover Up User Data Scandal

#23

Post by ftwinnovations »

unreal37 wrote: post #5

I don't even trust the original blogger is being completely up-front and honest with us. He was going for the sensationalist angle from the start, and to have Facebook call him and ask for his help was just too rich for him to handle. Ack, coverup! Ack, censorship! FB needs to find out which app did this. Give them a chance.

I completely agree with you. From the getgo, he said things like the Facebook "policy" department is basically the "police." Yes, there is a tasty similarity in spelling and overlapping meaning there, but if that's not sensationalist, I don't know what is. The guy sure knows now to write something that will get to the front of HN though!

Re: Facebook Tries To Silence Blogger To Cover Up User Data Scandal

#24

Post by beagle3 »

diego wrote: post #13
beagle3 wrote: post #11

Earlier quoted context omitted.

I have no specific knowledge of this case, but ... > Perhaps a polite request to keep quiet. Who knows, Facebook is still a teenager in many respects so it's anybody's guess. My experience with just about any company is that they would state their hopes as facts, and expect you to accept that as a fact. And it works with the vast majority of people. Case (from outside the US): Credit card got a fraudulent charge. Cal…

I understand. However, this is a savvy blogger who is looking for publicity. Facebook contacted him to defuse a potential PR situation, he didn't call them. You'd imagine they would be smarter than that, after all they are the world experts in virality and social media. Like I said, it's anybody's guess.

> Facebook contacted him to defuse a potential PR situation, he didn't call them

From the description, it sounds like the security department called him, not the PR department. And sounds like they're sort of OK as a security department, but that they DID need to coordinate with the PR department in this case, and they didn't.

> You'd imagine they would be smarter than that, after all they are the world experts in virality and social media

Their product people are experts in virality and social media. Their PR people - I don't know, I guess they're ok. Their security people? Obviously not. They just moved quickly and broke things for the PR department to fix.

If the blogger is lying, I'm sure facebook will shame them publicly - they have a recording, after all.

Re: Facebook Tries To Silence Blogger To Cover Up User Data Scandal

#25

Post by jrockway »

biot wrote: post #18

The title "Facebook Asks Rogue Blogger to Adhere to Responsible Disclosure Policies" would present a completely different viewpoint while not requiring that the body of the article change at all.

"Responsible disclosure" is like the expression "digital rights": something that makes the opposite meaning so ridiculous that you sound like a looney if you dare disagree with it. ("Why would anyone want irresponsible disclosure? Why would anyone not want rights?")

In this case, the original blogger did not follow "responsible disclosure" practices (which means "don't tell anyone about this, we want our PR team to spin the news first") but what he did was not irresponsible. He told the users whose data has been compromised that they should be careful with Facebook until the investigation is complete and details are disclosed. Now the user has the ability to make a rational and data-driven decision rather than hope Facebook will make the right one for them.

I'm not saying one way is right or wrong, but coverups rarely cover up good news.

Re: Facebook Tries To Silence Blogger To Cover Up User Data Scandal

#26

Post by smsm42 »

unreal37 wrote: post #5

I don't even trust the original blogger is being completely up-front and honest with us. He was going for the sensationalist angle from the start, and to have Facebook call him and ask for his help was just too rich for him to handle. Ack, coverup! Ack, censorship! FB needs to find out which app did this. Give them a chance.

Facebook didn't ask him for help. Facebook demanded his full submission and demanded him to behave like they want to, even though he has absolutely no obligation to protect the interests of Facebook in this matter or help them hide the fact that it happened. He might choose to do it if they ask nicely, but he has absolutely zero obligation to do it. And from what I read, they did not ask nicely at all.

I'm assuming that approach is working very well in the US where everybody is scared shitless by the threat of very costly litigation that can be unleashed on anybody just by the virtue of Facebook having tons of money and ability to unleash a team of lawyers on anybody and mess up their life, even if they have done nothing wrong.

Re: Facebook Tries To Silence Blogger To Cover Up User Data Scandal

#27

Post by smoyer »

The best part of the article is the irony of Facebook's statement: "Facebook is vigilant about protecting our users from those who would try to expose any form of user information. In this case, it appears someone has attempted to scrape information from our site,".

I read this as "We don't want anyone to potentially profit from the data we're profiting from ... let's squash the competition!"

Re: Facebook Tries To Silence Blogger To Cover Up User Data Scandal

#28

Post by hkon »

There is nothing to investigate, from the screenshot of the excel file I can deduce what has happened.

Someone put up a service/application/website which required facebook login. The user logged in with his facebook account. The service/app/website may request the email address to be part of the authentication information. The user is informed about this before when he accepts the service/app/website into his life. The provider of the service/app/website was dishonest and sold basically the login info for $5. How do I know? I have developed applications with facebook login.

Re: Facebook Tries To Silence Blogger To Cover Up User Data Scandal

#29

Post by biot »

jrockway wrote: post #25
biot wrote: post #18

The title "Facebook Asks Rogue Blogger to Adhere to Responsible Disclosure Policies" would present a completely different viewpoint while not requiring that the body of the article change at all.

"Responsible disclosure" is like the expression "digital rights": something that makes the opposite meaning so ridiculous that you sound like a looney if you dare disagree with it. ("Why would anyone want irresponsible disclosure? Why would anyone not want rights?") In this case, the original blogger did not follow "responsible disclosure" practices (which means "don't tell anyone about this, we want our PR team to s…

I don't see how a warning in this instance is helpful. Knowing that the data was likely scraped somehow from Facebook, what is the rational and data-driven approach to take? Unless there is a specific set of actions known to mitigate the risk of additional information leakage, saying "be careful with Facebook" sounds nice but doesn't help anyone. So why not let Facebook's security team do their due diligence first and then fully disclose the information later?
Post reply on HN