Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

nytimes.com

Post reply on HN
Print view View original

161–170 of 331 posts

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#161

Post by munk-a »

fuzz4lyfe wrote: post #140
noselasd wrote: post #123

Earlier quoted context omitted.

Until someone turned on logging of the full request body on the load balancer/proxy or otherwise unknown-to-you middlebox that was the TLS termination point in production that you did not know about

So their incompetence lies in lacking configuration management in production as opposed to a lack of testing? Why are they manually configuring production servers anyway at that scale?

They are managing a lot of things, they have full responsibility to be aware of these things as a company but I'd guess that with the scale of ops Facebook has regular developers never interact with the team that's managing their attempt at high availability by scattering servers across different hosts, data centers, legal jurisdictions etc. in fact I'd imagine at a op the size of Facebook that sort of problem has a dedicated department.

That said, someone should have been watching for this stuff and failed to do so (or to exist), so I'm not excusing them - but this is not a trivial thing to protect against.

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#162

Post by wavefunction »

_cs2017_ wrote: post #157
monsieurbanana wrote: post #42

Earlier quoted context omitted.

I'm ashamed to say that up until now, when I saw Facebook (or similar) acting evil I thought about the quote, "Never attribute to malice that which is adequately explained by stupidity". Well, fuck that and fuck me, those people are not idiots, they're criminals.

Maybe I misread, but none of the articles linked above suggest any malicious intent. Could you clarify what specifically you're referring to?

Making money off "mistakes" that keep happening, darn it!

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#163

Post by ALittleLight »

mnm1 wrote: post #82
monsieurbanana wrote: post #42

Earlier quoted context omitted.

I'm ashamed to say that up until now, when I saw Facebook (or similar) acting evil I thought about the quote, "Never attribute to malice that which is adequately explained by stupidity". Well, fuck that and fuck me, those people are not idiots, they're criminals.

Except the quote is generally wrong when it comes to issues of profit. It's simply backwards. People are fucking evil when it comes to money, profits, power, status, pleasure, and generally getting ahead of others. Considering those are the main motivators for almost all human actions, Hanlon's razor is clearly a bunch of bullshit that people spread around to end actual debate and discussions they don't like.

I don't think the quote is wrong, it's just that some things aren't well explained by stupidity. "Oops, we accidentally stole your data and used it" isn't explainable by stupidity but is explainable by malice.

In other words, Hanlon's Razer doesn't say that there is no such thing as malice just that you shouldn't default to assuming malice.

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#164

Post by beatgammit »

scotchmi_st wrote: post #112
monsieurbanana wrote: post #42

Earlier quoted context omitted.

I'm ashamed to say that up until now, when I saw Facebook (or similar) acting evil I thought about the quote, "Never attribute to malice that which is adequately explained by stupidity". Well, fuck that and fuck me, those people are not idiots, they're criminals.

Not to contradict your overall sentiment, but people often focus on intention with these issues. I think that's wrong. Like, if someone treads dog poo into my house on their shoes, it doesn't really matter if they did it by mistake, or spent ages walking around town trying to find some dog poo to step in before coming to my house; the effect is that there is now dog poo on my carpet. We need to be more dispassionate…

There definitely is a difference between someone accidentally tracking dog poo into your house vs someone doing it intentionally; in the first case, you all them to clean it up, and in the second case you break the friendship and/or seek criminal prosection.

Likewise for big companies. If a company is acting badly, you need to figure out if it was intentional. In both cases you seek damages, but your approach to making sure it never happens again will be very different.

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#165

Post by wavefunction »

munk-a wrote: post #47
wnevets wrote: post #38

Earlier quoted context omitted.

> 3) Storing said passwords and others in plaintext. [2] in logs.

If you're a small business - I get it, it's good to whitelist whatever information you're logging explicitly, but for smaller teams a hard to diagnose issue might lead the team to "log everything so we can sort it out later". Facebook is Facebook, whether this decision was the product of the corporation as a whole, a small dev team, or a highly paid consultant/third party, Facebook is a big enough company that they d…

I'm on a small team (5 engineers) that is GDPR compliant so no PII is logged. It's not hard if you care.

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#166

Post by tempestn »

beat wrote: post #75
munk-a wrote: post #47

Earlier quoted context omitted.

If you're a small business - I get it, it's good to whitelist whatever information you're logging explicitly, but for smaller teams a hard to diagnose issue might lead the team to "log everything so we can sort it out later". Facebook is Facebook, whether this decision was the product of the corporation as a whole, a small dev team, or a highly paid consultant/third party, Facebook is a big enough company that they d…

I've worked for multiple Fortune 25 companies, and that excuse does not fly. Not in banking or healthcare, where breaches of privacy/confidentiality are actually illegal, rather than merely distasteful. Small teams and careless devs doing that sort of bad logging will be caught and corrected by strict security oversight. This is the sort of thing that leads the HN crowd to sneer at the old, slow ways of the enterpris…

There's a dead sibling to my comment mentioning that your congruence.io website has an expired SSL certificate, fyi.

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#167

Post by SlowRobotAhead »

robbrown451 wrote: post #156

They should take that $5 billion and use it to fund an alternative to Facebook. (and one that is smart as to how to approach it, given Facebook's network monopoly. I.e. it should allow you to "use Facebook" in the same way I "use Yahoo mail" when I communicate with a Yahoo mail user from my Gmail account)

I want a government run Facebook as much as I want a Facebook run Facebook.

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#168

Post by ummonk »

remarkEon wrote: post #149
scotchmi_st wrote: post #112

Earlier quoted context omitted.

Not to contradict your overall sentiment, but people often focus on intention with these issues. I think that's wrong. Like, if someone treads dog poo into my house on their shoes, it doesn't really matter if they did it by mistake, or spent ages walking around town trying to find some dog poo to step in before coming to my house; the effect is that there is now dog poo on my carpet. We need to be more dispassionate…

> which can probably only be mitigated by breaking it up. I think about this a lot with regard to Big Tech. For some companies it looks easy and obvious (e.g., Amazon spins off AWS). For Facebook is it really as obvious as "spin off Instagram"? I'm not really convinced of that. It seems like their power is so ingrained in Facebook itself that it's not immediately obvious what splicing off Instagram would do. What wou…

AWS + Amazon doesn’t seem obvious to me; would there be much to gain from breaking up a conglomerate into several businesses, when those separate businesses are in entirely different verticals?

I suppose breaking off AWS might lower Amazon’s ability to subsidize an unprofitable retail business in search of market share, though that is probably a moot point now that Amazon is raising its prices in search of profitability and is likely to stop being the de facto online shopping destination now that other online retailers are also standardizing in two day shipping and easy returns (often easier due to providing return labels in the box).

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#169

Post by [deleted] »

slg wrote: post #139
tkxxx7 wrote: post #128

Earlier quoted context omitted.

> Facebook isn't actively trying to harm their customers, they simply don't care about them. That is amoral not evil. Don't bend yourself out of shape. Actively, happily ignoring the evil you have caused and continue to cause is evil.

That isn't evil. You wouldn't call a hurricane or a fire evil. You wouldn't call a person who kills someone in a no fault car accident evil. Evil isn't about results. It is about intent and motive. You can call Facebook a number of things from amoral to negligent or even criminal, but once you start talking about evilness you have to start judging their intentions and motives.

[deleted]

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#170

Post by tkxxx7 »

slg wrote: post #159
tkxxx7 wrote: post #145

Earlier quoted context omitted.

> That isn't evil. You wouldn't call a hurricane or a fire evil. You wouldn't call a person who kills someone in a no fault car accident evil. All of these things are no one's fault. > Evil isn't about results. It is about intent and motive. Exactly. Prioritizing profit at the cost of customers' well-being is a deliberate decision; if not, seeing that customers are harmed by your own, continued actions and doing noth…

I think that is just too broad of a definition for evil. According to that, everyone who isn't carbon neutral would be evil. We are worsening climate change through our "own, continued actions and doing nothing to change it". And if we are all evil then evilness has no real meaning.

> According to that, everyone who isn't carbon neutral would be evil.

While I agree that it's useful to maintain some nuance in our perspectives, generally I think it's better to recognize and realign our actions, not definitions. It's the difference between accidentally hitting someone, and accidentally hitting someone and proceeding to run them over.

And to your example, I think we know most people aren't really aware of what is going on. Another group of people don't believe it at all, a combination of ignorance and poor government. We're all human; that means something.

Post reply on HN