Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

nytimes.com

Post reply on HN
Print view View original

321–330 of 331 posts

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#321

Post by beat »

UncleMeat wrote: post #209
jyrkesh wrote: post #193

Earlier quoted context omitted.

There might not have been a large-scale public data dump of passwords, but if 20,000[1] employees had access to logs with plaintext passwords, there is no guarantee I could ever accept that zero of them read or used customer passwords for personal purposes. What's to stop a malicious ex-lover from grabbing a FB password and reading that person's private messages? If FB didn't even know there were passwords in plainte…

Malicious insiders don't need your password to access your data. If you are concerned about malicious insiders then plaintext password logs don't matter.

I'm more concerned with plaintext passwords because most people use the same passwords over and over, so if you can break one system, you can break others.

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#322

Post by ok_coo »

blihp wrote: post #18
oh_sigh wrote: post #7

Earlier quoted context omitted.

1 month of revenue is how many months of profit?

That misses the point: it's effectively a (cheap) speeding ticket for bad behavior over the life of the company. It would be a bargain at twice the price from their point of view.

Even worse, in this model they can effectively just build in the cost of the fines in the business model. It's just a cost of doing business at this point.

I'm sorry, but this shit isn't going to end until the U.S. actually punishes white collar crime. Fines _do not_ work.

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#323

Post by tripzilch »

beatgammit wrote: post #164
scotchmi_st wrote: post #112

Earlier quoted context omitted.

Not to contradict your overall sentiment, but people often focus on intention with these issues. I think that's wrong. Like, if someone treads dog poo into my house on their shoes, it doesn't really matter if they did it by mistake, or spent ages walking around town trying to find some dog poo to step in before coming to my house; the effect is that there is now dog poo on my carpet. We need to be more dispassionate…

There definitely is a difference between someone accidentally tracking dog poo into your house vs someone doing it intentionally; in the first case, you all them to clean it up, and in the second case you break the friendship and/or seek criminal prosection. Likewise for big companies. If a company is acting badly, you need to figure out if it was intentional. In both cases you seek damages, but your approach to maki…

> Likewise for big companies. If a company is acting badly, you need to figure out if it was intentional.

I disagree that it's likewise for big companies. Corporations like that don't really have intentions; every intention is fundamentally about profit. Profit is in fact both its intention as well as its reward/punishment.

It's really the only way to properly "communicate" with an entity like that. A corporation is not a human being. And just like it's not useful to try to reason with (or attribute human-like intention to) a cat, it's basically futile to do so with a corporation.

Any time that human-like reasoning seems to apply with a corporation, it really only happened because the reasoning happens to align with its profit intentions.

Edit: this is less true for smaller companies, but for a multinational it's pretty much a given.

Also, there's something in the way that large companies are structured, that actual accountability (like you'd find with humans or small groups) seems to disappear and slip between the gaps of hierarchy. Lacking accountability, attributing intent becomes guesswork.

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#324

Post by misterman0 »

modriano wrote: post #314
misterman0 wrote: post #270

Earlier quoted context omitted.

I think it's not wrong to treat an adult exactly like you would a child if he's acting like one. I interpret parent poster as trying to make a point about how we cannot tell anything about intent so we should judge on the action, solely.

> I think it's not wrong to treat an adult exactly like you would a child if he's acting like one. So, are you saying that the malicious adult poo-tracker is being childish and should be treated with the leniency we afford to children? > I interpret parent poster as trying to make a point about how we cannot tell anything about intent so we should judge on the action, solely. Why on Earth do you think we can't deduce…

>> ...

No, I'm not saying that. Take it easy bro. Why you all angry and shit?

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#325

Post by dplgk »

beatgammit wrote: post #164
scotchmi_st wrote: post #112

Earlier quoted context omitted.

Not to contradict your overall sentiment, but people often focus on intention with these issues. I think that's wrong. Like, if someone treads dog poo into my house on their shoes, it doesn't really matter if they did it by mistake, or spent ages walking around town trying to find some dog poo to step in before coming to my house; the effect is that there is now dog poo on my carpet. We need to be more dispassionate…

There definitely is a difference between someone accidentally tracking dog poo into your house vs someone doing it intentionally; in the first case, you all them to clean it up, and in the second case you break the friendship and/or seek criminal prosection. Likewise for big companies. If a company is acting badly, you need to figure out if it was intentional. In both cases you seek damages, but your approach to maki…

Seems to be intentional as a system for taking a user's password, scanning their contacts and then uploading them requires specifically built tools with intention. Stepping in dog poo and tracking it into a house requires only shoes that you already wear and walking that you already do. That doesn't require any new intentions or tools to be built

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#326

Post by [deleted] »

perfunctory wrote: post #298
scotchmi_st wrote: post #185

Earlier quoted context omitted.

> There definitely is a difference between someone accidentally tracking dog poo into your house vs someone doing it intentionally; in the first case, you all them to clean it up, and in the second case you break the friendship and/or seek criminal prosection. But the point is that this assumes you're able to tell the difference between the two cases- intent is often a really hard thing to prove. And often discussion…

> hard thing to prove It is and yet the legal system is busy with these sorts of proves all the time. e.g. if you have a professional insurance and caused some damage by mistake - that's covered, if you cause damage deliberately - it's not.

[deleted]

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#327

Post by jlarocco »

noselasd wrote: post #123
jlarocco wrote: post #94

Earlier quoted context omitted.

> I don't think it's trivial to guarantee non-existence. I disagree in this case. Log messages don't spontaneously appear in arbitrary places. If the developers understand what their software is doing and how their systems are configured then they should know where to check for the logging messages.

Until someone turned on logging of the full request body on the load balancer/proxy or otherwise unknown-to-you middlebox that was the TLS termination point in production that you did not know about

And? That doesn't change anything I said. The new logging config isn't magic, either, and the new set of log files can be scanned, too.

With billions of dollars and some the best software developers in the world (supposedly), Facebook should be able to figure this out.

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#328

Post by xvector »

JustSomeNobody wrote: post #217
xvector wrote: post #59

Earlier quoted context omitted.

Equifax needs to be fined until its existence can only be found in the history books, and its negligent management needs to be jailed for the long-term harm that they have caused. Same with Facebook. But OP's point is that the collective has too short an attention span to actually hold any of these actors to the law.

OP Said > Before this thread becomes a Facebook bashing session, It absolutely should be a FB bashing session. Just because some company got away with something doesn't mean they all should.

> Just because some company got away with something doesn't mean they all should.

I totally agree.

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#329

Post by fuzz4lyfe »

hw wrote: post #277
fuzz4lyfe wrote: post #220

Earlier quoted context omitted.

Change requests and a change review board staffed by professionals. Subject: Change Request Body: I would like to log the body of authentication requests in production. Subject Re: Change Request Body: How will you ensure personal data is not stored that shouldn't be? Subject: Re: Re: Change Request Body: I will add configuration Y to logging system X.

Bureaucracy like this is what kills teams and products. There's no guarantee it works, and every change or commit should already have privacy and data protection in mind anyway. You also don't know what you don't know - you could for all your knowledge think that nothing is being logged, when in fact there's a subsystem outside your scope that's actually doing the logging. You assert that it's trivial, yet you're add…

I promise you the productivity loss of sending a few emails is much less than 5 billion dollars.

Re: Facebook Expects to Be Fined Up to $5B by FTC Over Privacy Issues

#330

Post by jokoon »

lordnacho wrote: post #27
jokoon wrote: post #22

Earlier quoted context omitted.

[flagged]

Similar punishment for similar transgressions is how the law is supposed to work.

I think equifax has a "too big to fail" burden, credit scores are part of how things work in the country. And I'm not sure they're directly responsible for the leak of their data.

Facebook is far from being essential, it's mostly a consumer product. There are so many voices against facebook that I don't think there would be enough public support to protect facebook.

Post reply on HN