Ask HN: So what happened to Facebook "localhost" tracking? • Hacker News Board

Re: Ask HN: So what happened to Facebook "localhost" tracking?

#81

Post by netsharc » Thu, Jun 04, 2026, 10:23 PM UTC

htx80nerd wrote: post #61

applfanboysbgon wrote: post #4

> Meta must face a lawsuit alleging that it secretly tracked Android users' browsing activity on mobile websites that embedded Meta's analytics pixel, and linked that activity to users' identities, a federal judge ruled Monday. > The decision, issued by U.S. District Court Judge Rita Lin in San Francisco, grew out of a class-action complaint initially brought last June by California resident Devin Rose (and later joi…

im failing to see the connection >standard pixel tracking, linked to meta (js , web) >Meta exploited Android's localhost (os level)

- Instagram/Facebook app listening on localhost port X.

- A website running JS on the browser tries to connect to localhost port X. If it succeeds it's now talking to Zuck's app.

- The JS can report whatever it wants to the app, and the app knows the identity of the browsing user, because ~100% of the time it's the user also logged into the app(s).

Re: Ask HN: So what happened to Facebook "localhost" tracking?

#82

Post by Velocifyer » Thu, Jun 04, 2026, 10:44 PM UTC

Retr0id wrote: post #48

applfanboysbgon wrote: post #4

> Meta must face a lawsuit alleging that it secretly tracked Android users' browsing activity on mobile websites that embedded Meta's analytics pixel, and linked that activity to users' identities, a federal judge ruled Monday. > The decision, issued by U.S. District Court Judge Rita Lin in San Francisco, grew out of a class-action complaint initially brought last June by California resident Devin Rose (and later joi…

Not at all to defend Meta but "a feature that allows software developers to test applications" is a dubious definition of localhost. I also can't come up with a better one.

“A loopback network interface” or “A interface that refers to the same host”.

Re: Ask HN: So what happened to Facebook "localhost" tracking?

#83

Post by lelandfe » Thu, Jun 04, 2026, 10:48 PM UTC

pezgrande wrote: post #13

mozvalentin wrote: post #3

Chrome and Firefox have deployed / are deploying local-network-access which prompts the user when apps try this.

I guess that's why I am getting so many "Allow to find devices on your network" alerts. Good feature overall.

I hate that there's no "stop asking me" button.

I get those regularly in Chrome

Re: Ask HN: So what happened to Facebook "localhost" tracking?

#84

Post by Retr0id » Thu, Jun 04, 2026, 11:35 PM UTC

furyofantares wrote: post #80

Retr0id wrote: post #48

Earlier quoted context omitted.

Not at all to defend Meta but "a feature that allows software developers to test applications" is a dubious definition of localhost. I also can't come up with a better one.

It's not a definition, but it is an accurate statement.

It's a true statement but I'm not sure it gives a good impression of what localhost actually is.

Re: Ask HN: So what happened to Facebook "localhost" tracking?

#85

Post by SchemaLoad » Thu, Jun 04, 2026, 11:36 PM UTC

SoftTalker wrote: post #18

pezgrande wrote: post #13

Earlier quoted context omitted.

I guess that's why I am getting so many "Allow to find devices on your network" alerts. Good feature overall.

Only a good feature if users have a clue what that question means. Most will click "Yes" because they want to get on with whatever they want to do. Change it to something like "This website is trying to spy on your local devices, do you want to allow this?"

Most of the time this prompt comes up it's actually for a genuine purpose, like spotify trying to find devices on the local network that can play audio, VLC looking for chromecasts, I saw my DJ app ask for local network and discovered it can discover my decks on the network and stream my library over the local network to it.

The problem is this prompt is new so the software doesn't show the user why it's just triggered the prompt and the user has no info to work with.

Re: Ask HN: So what happened to Facebook "localhost" tracking?

#86

Post by aforwardslash » Thu, Jun 04, 2026, 11:43 PM UTC

woodrowbarlow wrote: post #7

i would love to have a software engineer's union, not so much to get better working conditions but to be able to say stuff like "i can't implement that unethical feature, it's against union rules and i'd lose my membership".

Why not just ask for context and approval of the legal team? That would generate enough trail so some shady requirements get dropped almost immediately; having your superior explicitly sign off in writing a feature you deemed unethical and/or potentially illegal is a great way of actually removing them from the pipeline. You can even frame it as "a good guy" just alerting him/her that there may be a fallback, so make sure it has all necessary elements. Compliance decisions are often above a developers paygrade, and one should squarely document the culprit on any shady decision - and boy, this is very easy in big organizations where no single decision-maker wants to be accountable.

Re: Ask HN: So what happened to Facebook "localhost" tracking?

#87

Post by [deleted] » Fri, Jun 05, 2026, 12:02 AM UTC

lukan wrote: post #65

SoftTalker wrote: post #18

Earlier quoted context omitted.

Only a good feature if users have a clue what that question means. Most will click "Yes" because they want to get on with whatever they want to do. Change it to something like "This website is trying to spy on your local devices, do you want to allow this?"

Since I can see legitimate use case (complex web apps, one sharing data with another) - I would not use the word spying. But still make it clear what can happen. "Attention! This website wants to get access to other web apps running on this device, do you want to allow this?" And then a link explaining some more. But better words are surely possible.

[deleted]

Re: Ask HN: So what happened to Facebook "localhost" tracking?

#88

Post by rambojohnson » Fri, Jun 05, 2026, 12:23 AM UTC

Retr0id wrote: post #84

furyofantares wrote: post #80

Earlier quoted context omitted.

It's not a definition, but it is an accurate statement.

It's a true statement but I'm not sure it gives a good impression of what localhost actually is.

If the biggest issue you found in the article is the localhost gloss, Meta probably got off easy.

Re: Ask HN: So what happened to Facebook "localhost" tracking?

#89

Post by lesuorac » Fri, Jun 05, 2026, 12:25 AM UTC

greyface- wrote: post #27

actionfromafar wrote: post #19

Earlier quoted context omitted.

Unions in the US are nerfed, by law.

Collective bargaining is nerfed. Other structures remain viable and legal.

Naw unions are nerfed.

ex. Secondary (Sympathy) Strikes are illegal [1].

[1]: https://en.wikipedia.org/wiki/Solidarity_action#United_State...

Re: Ask HN: So what happened to Facebook "localhost" tracking?

#90

Post by austin-cheney » Fri, Jun 05, 2026, 12:25 AM UTC

Retr0id wrote: post #48

applfanboysbgon wrote: post #4

> Meta must face a lawsuit alleging that it secretly tracked Android users' browsing activity on mobile websites that embedded Meta's analytics pixel, and linked that activity to users' identities, a federal judge ruled Monday. > The decision, issued by U.S. District Court Judge Rita Lin in San Francisco, grew out of a class-action complaint initially brought last June by California resident Devin Rose (and later joi…

Not at all to defend Meta but "a feature that allows software developers to test applications" is a dubious definition of localhost. I also can't come up with a better one.

Here is the explicit definition of localhost.

The term "localhost" refers to the default entry in all modern operating system host files. By default modern operating systems provide a hosts file that provides domain name resolution without reliance upon the Domain Name System (DNS) protocol. By default these host files typically ship with one entry, a domain named "localhost" that points to IPv4 loopback interface 127.0.0.1.