Facebook says new bug allowed apps access to private photos of up to 6.8M users

Post by jdc0589 » Sat, Dec 15, 2018, 4:56 AM UTC

makecheck wrote: post #89

I never assume that “settings” guarantee what they claim. It’s just not practical even with good intentions, for a single non-public code base. As a developer, I know it is hard to implement something once, harder to implement consistently across multiple interfaces, and damn near impossible to keep correct years later after employee turnover and other twists. The sad thing is that it costs a ton more money to do thi…

Post by [deleted] » Sat, Dec 15, 2018, 5:14 AM UTC

newsopt wrote: post #138

eropple wrote: post #101

Earlier quoted context omitted.

Hi. I've worked in medical software repeatedly. I totally want to deal with HIPAA. It's a good idea for clients (the people who actually matter) and it's not nearly as difficult a prospect to work with as people say. The set of demands it makes upon you are small and reasonably constrained and are nearly all process-based rather than technical. Where it is technical, plenty of folks will sign a BAA for you to take bi…

>"But HIPAA" has never, in my experience, been employed except by people who find the idea of doing the right thing inconvenient or inconveniently expensive. (It is virtually never that hard and its benefits are clear.) Thank you for directly attacking my character without even addressing my actual argument. I'm not arguing against HIPAA, I'm arguing against such regulations in spaces that don't require that kind of…

Post by d4l3k » Sat, Dec 15, 2018, 6:48 AM UTC

foobaw wrote: post #68

Where are the technical details on what the bug was and how it was possible? Shouldn't this be disclosed?

Post by WA » Sat, Dec 15, 2018, 7:56 AM UTC

bacon_waffle wrote: post #255

fhrow4484 wrote: post #216

Earlier quoted context omitted.

> If you fine Facebook, you have to fine the small companies too, and even individual developers developing OSS, since the law should apply to everyone equally. I would agree regarding small companies, but I wouldn't put oss developers in the same boat, fining the entity that provides a service makes more sense. It doesn't matter if that service relies on OSS or not. It's the company providing the service to the cons…

> It's the company providing the service to the consumer who is responsible to vet the final product. I agree with your post, but I tend to think of facebook's users as providing the product (their attention). If the consumer is a company buying advertising, then where's facebook's motivation to be careful with a user's "private" data?

Post by jachee » Sat, Dec 15, 2018, 8:11 AM UTC

WA wrote: post #258

bacon_waffle wrote: post #255

Earlier quoted context omitted.

> It's the company providing the service to the consumer who is responsible to vet the final product. I agree with your post, but I tend to think of facebook's users as providing the product (their attention). If the consumer is a company buying advertising, then where's facebook's motivation to be careful with a user's "private" data?

Sorry, but you’re overthinking this. Facebooks product is not advertising. It’s a platform that brings users and advertisers together. Just because it’s free for some or most users of the platform doesn’t mean that only paying people (advertisers) need to be protected. Under GDPR, it actually doesn’t matter if you charge money for your product or not. If you process personal data, you’re responsible for it. This also…