171–180 of 226 posts
The article skips a lot of context to make it sound significantly worse than reality. Facebook didn't just randomly give Netflix access to everyone's messages. Specific user would need to purposefully log in to the Netflix app with their Facebook account in order to grant Netflix access to the chat functionality (intended to send movie recommendations to Facebook friends inside the Netflix app). https://about.fb.com/…
Earlier quoted context omitted.
"Please don't post insinuations about astroturfing, shilling, brigading, foreign agents, and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data." - https://news.ycombinator.com/newsguidelines.html
The root comment is literally a Facebook employee who is intentionally trying to change the narrative. An employee of a company that has been fined billions for privacy breaches, that was responsible for literal voter suppression https://www.opendemocracy.net/en/dark-money-investigations/t... etc etc HN "guidelines" say "Please don't post shallow dismissals" -- Don't allow FANG to astroturf these forums.
The article skips a lot of context to make it sound significantly worse than reality. Facebook didn't just randomly give Netflix access to everyone's messages. Specific user would need to purposefully log in to the Netflix app with their Facebook account in order to grant Netflix access to the chat functionality (intended to send movie recommendations to Facebook friends inside the Netflix app). https://about.fb.com/…
And if a user consented to Netflix-based chat, Facebook overshared all chat data, instead of only the Netflix chat data, because they couldn't be bothered to build a properly isolated API? That's like asking permission to read and write your entire phone, just to provide the ability to write and read back a file.
Netflix presumably had the same.
As long as that access is audited to ensure it really was being used only for the intended purpose, I'm fine with that.
Inspected 50 messages all from your test account: fine. Inspected messages from an account after that user contacted customer support citing a problem with messages: fine. Inspected messages from an account after that account fired off alerts to the devops team for causing segfaults: fine. Look at a random account: not fine. Dump messages from many accounts with a script: not fine, and rate limits should stop you after like 100 messages.
"Meta said it rolled out end-to-end encryption "for all personal chats and calls on Messenger and Facebook" in December. And in 2018, Facebook told Vox that it doesn't use private messages for ad targeting.1 But a few months later, The New York Times, citing "hundreds of pages of Facebook documents," reported that Facebook "gave Netflix and Spotify the ability to read Facebook users' private messages."" 1. "Does Face…
So they are not exactly lying. just being extremely dishonest.
Earlier quoted context omitted.
> If substantiated, such accusations would be among the most damning in the history of technology. If substantiated? Just search Onavo on HN search - I thought this was widely known for years.
As a former employee until 2018, I heard the words “Project Ghostbusters” two days ago. I was peripherally aware of something called Onavo but I had no notion that anyone was talking about “kits”, we all thought it was some kind of metrics thing that was sort of iffy sounding but lots of iffy ideas got proposed by some PM looking to make a name and shot down by the grownups, what is alleged would have provoked a riot…
The people in targeting/demand/supply knows absolutely nothing about profile building. And there is where all the competitive advantages lies. And also all the shady deals.
We usually keep everything very secret in profile building because that is the knowledge that allows people to leave and start competitors, but we disguise it as the usual think-of-the-children and say that profile building deals with all sort of borderline-PII and only the most vetted people should work on it.
Ask some sysadmin to list the ACL to the main ads profile HDFS or whatever it is today. it will show a couple architects who report to one SVP each.
Earlier quoted context omitted.
Facebook is on both ends of the e2e. e2e encryption means no from client to client can read your messages. Your client certainly can - and Facebook is the client. It would have no problem sending back signals on your messages (or the full message) to Facebook servers. Doesn't mean it's happening. But it's interesting that e2e encryption alone makes you positive it isn't.
Agreed, and that’s how it would work. I was more highlighting the throwaway with comment that had no context or link to sources.
Earlier quoted context omitted.
This isn't how permissions work in most OAuth APIs. When you request permissions on apps like this, you request an "action" on a "subject". The "action" can be read/write/delete, the subject can be "DMs". How does Facebook determine whether a specific DM is a Netflix DM? In the database it's just a message from one user to another, with a certain text content. By the way I'm not suggesting that it cant work this way,…
This is why OAuth is insufficient for privilege management, especially for multi-tenant systems, or what should be segregated data sets. You want to grant access to dataset abc123, but not dataset abc124 belonging to the same user. This leads to an explosion of scopes, or an explosion of API keys, unless you have a policy engine, or resource-based access control. A company as big as Meta should be able to (is able to…
"Meta said it rolled out end-to-end encryption "for all personal chats and calls on Messenger and Facebook" in December. And in 2018, Facebook told Vox that it doesn't use private messages for ad targeting.1 But a few months later, The New York Times, citing "hundreds of pages of Facebook documents," reported that Facebook "gave Netflix and Spotify the ability to read Facebook users' private messages."" 1. "Does Face…
They describe several cases where the E2E means user facebook otheruser. Some examples: group chat. Shared images. Shared Urls with snipets. Absolutely everything involving interactions with a whatsapp "business account". So they are not exactly lying. just being extremely dishonest.
Theyre sooooo dishonest.
Earlier quoted context omitted.
This slippery slope/where do you draw the line argument is very weak. It's like saying me accidentally spilling a bit while doing a oil change in my garage is the same as BP spilling hundreds of thousands of gallons of crude. Scale matters. And "where you draw the line" can be defined loosely to be left up to interpretation at the time.
So you are going to pass a law That says depending on size, American companies can’t create content and distribute it? And then foreign companies are still allowed to distribute thier own content? Are you going to block them from transmitting to the US? If Netflix decides to incorporate in Canada, are you going to stop them from distributing thier own content to US citizens? You really don’t see a problem with the go…
Because otherwise bureaucrates like you would cause everything to stall while looking into every contingency.
I also don't think you have to "pass a law" we already have laws on the book that can do this and, this might shock you, we have already used them to do almost exactly what you are saying here.
https://en.m.wikipedia.org/wiki/United_States_v._Paramount_P....