Facebook doesn't receive nearly enough scrutiny and criticism. Western governments have been completely blindsided by the immense power that lies in the hands of Mark Zuckerberg. Facebook have a near-monopoly on social media in many countries. They have an incomprehensibly vast archive of personal data, alongside a EULA that allows them to do nearly anything with that data. Their algorithms profoundly influence how two billion people perceive the world, with practically no transparency or oversight.
Facebook are a hair's breadth away from any number of dystopian scenarios. We should be extremely nervous about the unchecked power that Facebook wields. We should pounce on any dubious decision that Facebook makes, but we should also be asking some serious and fundamental questions about the position of Facebook in our society.
Look at Zuckerberg's recent manifesto. He fully understands how powerful he is, and he has a clear vision of how he intends to use that power to shape the world. It's time that we (and our elected representatives) woke up.
https://www.facebook.com/notes/mark-zuckerberg/building-glob...
Chicken little. That's what came to mind when I read your reply.
If FB OR ANY other entiry gets you so upset then stop using it.
We all make choices. I always give this example.
My grandmother could have voted for every losing president during her lifetime but because of other more important choices like who to marry, whether to work hard or not, what people she associates with, when to have sex and if and when to create life her life became a function of those choices.
Why in anyone's name would a person by choice use or contemplate FB or any other entity if it makes you upset.
I just don't get it.
I posted this in another reply, but that's effectively impossible. Facebook collects data on you from friends and family that use it. How do you suggest I stop that? What about Facebooks's tracking code all over the internet? Know a foolproof way to block that too?
I think it comes from growing up in the USSR, where the threat of the government showing up at your door because of something you said was very real. What no one in the US seems to appreciate is that even a stable country is only one or two major crises from being in the same situation. This is surprising because McCarthyism[1] happened a mere 70 years ago - a blink of an eye by historical standards.
Do you really think that under a Neo-McCarthy government any information Facebook has about you would be kept private? That Facebook's precious social graph or Google's archive of your search history wouldn't be used against you? I think that's naive.
That's not a valid comparison since Facebook doesn't publish their own content. It can promote unfiltered news (that often turn out not to be true) but it's not as if the same news story would be read by 1bn people each day.
My wife and I were talking about celebrating my kids birthday party at Arcade Foobar. A day later she started seeing ads on Facebook about Arcade Foobar.
It's grotesque and one of the many reasons why my wife and I no longer have facebook accounts.
https://www.facebook.com/business/help/164749007013531
Arcade Foobar want to draw in new customers, and so generate a lookalike audience based on data they have from existing customers. The modelling algo then compares data points for people who 'look like' their customers, and those people can then be targeted with a high probability that they will also be interested in the same thing.
This is a perfectly plausible explanation that doesn't require FB to be listening to you through your phone mic.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=786909
https://www.cnet.com/news/samsungs-warning-our-smart-tvs-rec...
https://www.washingtonpost.com/news/the-switch/wp/2017/03/09...
https://www.charlesproxy.com/documentation/faqs/using-charle...
http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/Conf...
You could probably also do it with the emulator. You may need to do something like https://www.bettercap.org/blog/sslstripping-and-hsts-bypass/ or it could be even harder: http://docs.mitmproxy.org/en/stable/certinstall.html#certifi...
There are of course ways around this: https://serializethoughts.com/2016/08/18/bypassing-ssl-pinni...
If you need some more hints: https://github.com/ac-pm/SSLUnpinning_Xposed
https://forum.xda-developers.com/showthread.php?t=3034811
https://eaton-works.com/2016/07/31/reverse-engineering-and-r...
If you do this, please write it up. I'm sure that many people would be interested in this research if it hasn't already been done.
EDIT: In the spirit of POC||GTFO, I got curious and did it myself. I don't see any evidence of any mic uploads. The worst thing I see is it posting your current location. Here's a screenshot of the typical stuff I was seeing (this particular one is for the messenger portion of the app, and it looks like it's pulling in assets for stickers. I have the Pusheen pack because it's hella adorbs): https://i.imgur.com/dVekldx.png
It's POSTing to graph.facebook.com as you scroll to get more data. It's just JSON and pretty easy to figure out what's going on. I just followed http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/Conf... . I guess they're not pinning their certs, at least on my Nexus 7 and the version of the FB app that I used (v26.0.0.22.16 on Android 5.1.1 on the 2012 Nexus 7, since that's what I had laying around to mess with easily).
This literally took about 5 minutes to set up and get working. I encourage those curious to try it and see for themselves. I just read http://www.portero.com/blog/a-brief-history-of-gucci-infogra... aloud (I never shop for Gucci handbags, so seeing ads for them would be the tell) to test. I'm not some forensics expert but again, looks like nothing I wouldn't expect, definitely not uploading audio streams to Facebook as I'm speaking or +/- 5 minutes. Again though, check it out for yourself.
EDIT 2: I searched for a few unique strings from some of the decoded JSON my N7 was sending to FB and found https://github.com/macliu010/android_facebook_decomplied , which should be interesting for those following along at home.
> I don't see any evidence of any mic uploads.
... I am somewhat concerned at what seems to be a common assumption that Facebook (or any other remote server) is sending the same software to everybody. I find that unlikely when "AB testing" and similar practices are are commonly used. Facebook is very strongly involved with "targeted" services which suggests they are more likely than most to send different versions to different audiences. Obviously that isn't proof, but it's a good reason to extrapolating from a single example.
Version numbers and hashes of the installer or binaries from all parties would help a lot.
> I encourage those curious to try it and see for themselves
That's always good advice.
My point is that guessing without actual data isn't evidence. It's easy to speculate and guess at what we think is going on, but it's a bad idea to assume any particular speculation is right in the best situations. It's foolish when the subject of the investigation's core business model is based on sending different things to specifically targeted groups.
> just turn on these features
Perhaps. There are many ways a feature like this could be implemented. See the various obfuscated code contests for extreme examples of how functionality can be hidden in a program. This just means network logs from different clients are also needed, in addition to hashes of binaries.
I am pretty sure it would be undetectable if done right, given no access to the source code of the multiple Facebook components running on your device (some pre-installed by the manufacturer and unremoveable).
EDIT: Sounds like they might pin certs on newer versions of the iOS app. https://github.com/Naituw/HackingFacebook might be useful to get around that. I haven't tried it.
There are many reasons why such things happen: coincidence, someone google the topic from the same router IP address, ad tracking on Googled websites, etc etc
The idea that one of the worlds largest companies would risk their entire business by secretly recording their users for ad revenue is absurd on almost every level.
Yet some people on HackerNew, a forum that self-selects to a highly educated/intelligent part of the community actually believes it.
It's mind-boggling.
Right[1]. Nobody makes risky[2], ethically challenged[3] decisions[4] in business[5]. Ever[6]. Doesn't happen[7].
[1] https://www.recode.net/2017/5/11/15628924/alphabet-waymo-law...
[2] https://www.yahoo.com/news/hampton-creek-serves-another-vega...
[3] http://fortune.com/2016/07/08/rise-fall-elizabeth-holmes-the...
[4] https://www.inc.com/business-insider/inside-lending-club-sca...
[5] http://fortune.com/2016/08/14/fraud-allegations-hud-skully/
[6] https://www.nytimes.com/2016/09/01/technology/a-silicon-vall...
[7] http://www.businessinsider.com/fbi-us-attorney-could-look-at...
I'm with you on the skepticism, but they are one of the largest companies in the world because of ad revenue. It's not putting their business at risk, it is their business.
Whether they record ambient audio or not, how is it implausible or out of character with everything else they do? Facebook and many other companies collect countless dimensions of data on users to profile them for marketing. Audio is just one more. It's not even really that disturbing or far fetched. Why would they ignore such a lucrative data source when they've already tapped so many others?
It's a direct business plan with Amazon's echo for christ sake. What is so hard to comprehend about this?
And then we saw ads for the Reds and MLB.
I'm not trying to go full tin foil hat here, but it was a pretty strong coincidence for that to happen.
> Safety Check is a wonderful feature. If I remember correctly, it started off as an internal hackathon project that got turned into a full feature. They get shit if they turn it on (here), and if they don't turn it on (past tragedies where they failed to turn it on).
It's just not the same people doing the complaining. That some people complained about the feature not being on doesn't mean there are no negatives to turning it on, and now people affected by those negatives are complaining.
Or to draw a more absurdist comparison, let's say Facebook had a switch. If they pull it, I get punched in the face. If they don't pull it, you get punched in the face. Now, when they pull it, I'm understandably upset and demand they stop pulling it. When they listen to my complaint and stop pulling it, you are suddenly upset and tell them to keep pulling it. Seems like Facebook just can't catch a break? Or are they simply trying to serve customers with competing needs, something every business has to deal with?
I don't think this situation is special to Facebook, so I think a likely explanation for your initial question(Why does everything Facebook do have to be so heavily criticized?) would be that this is something common to large businesses trying to serve competing interests, and you notice Facebook more because Facebook is very large and has lots of users.
Do you really feel like a non-democratic oligarchy (or more inflammatory language, a dictator) should have that much power?
edit: posted too much to make a proper reply, but China is only at 1.3 billion and is obviously a lot more localized
What you're afraid of is evil CEOs doing mind control, not despotism.
If you were to show people exactly what Facebook knows about you and can figure out about you as well as the practices they engage in, many people would not use the service, but they don't know these things because Facebook keeps people ignorant. It's not in Facebook's best interests to have people know.
I can't blame Facebook for that, but when they are incompetent it impacts everyone else. I didn't opt in to racists getting jazzed up and going on killing sprees that they put on Facebook Live because of feeds that are mostly opaque and first and foremost designed to make money, and I didn't opt in to social media creating a generation of narcissists, but we all get to experience that.
I don't even believe Mark's evil, but when you have that much power, you have a ton of responsibility to use that properly and Facebook's response has mostly been to say sorry when they fuck up. There's nothing you can do to curtail that power because there are few entities that can actually sanction them.
That's scary and it's dangerous for society. It's the biggest social experiment ever conducted and there are no rules other than the ones that Zuckerberg makes.
If human existence is a long series of lucky rolls of the dice, is it really a good idea to roll the dice on a single individual who got lucky at 21, who now benevolently or not decides the algorithms that determine what almost 2 billion people see? That's nuts and it is something of our own making. Nobody did or would opt into that because people ultimately like to have agency over their own lives.
No, it absolutely is not. Facebook creates shadow profiles[1] even if you never use the service based on what your friends and family upload about you. Not to mention that not having a facebook profile is often treated as suspicious[2] by potential employers, landlords, significant others, and now US customs[3].
[1] http://www.zdnet.com/article/anger-mounts-after-facebooks-sh...
[2] https://www.forbes.com/sites/kashmirhill/2012/08/06/beware-t...
[3] https://www.cnet.com/news/border-patrol-agents-checking-face...
It's possible, even likely that FB has 600 million fake accounts, but you didn't even bother explaining yourself.
They have an enormous target on their back and could never do anything right. They got ripped for not enabling safety check recently too. https://techcrunch.com/2015/11/15/facebook-says-it-will-enab...
Them implementing a feature so poorly that it tells people 6 miles away to confirm they're safe from a building fire is a "perfect storm for HN shitposting" because of the success of the company, privacy issues, and the founder? And not because the feature is a failing in ways causing false alarms and unnecessary stress?
I bet if Techcrunch didn't write about it, we wouldn't even have this story. If I posted it on my personal blog, I'd be rightly laughed out of the room.
I am curious why do you feel the need to make a throwaway account because something is a "heated debate."?
I had an account for ten years, my real name from day 1, my real pictures from day one, lots of RL friends plus friends I basically casually made on Facebook. I had a great time posting about whatever and hating on Facebook, until one day it greets me with "we have to confirm your identity", because some people who surely did not show their ID clicked "fake profile" enough to basically shut me up. It's not even paranoia that makes me not upload a photo of my ID (with everything but name blacked out), it's the principle. I do have email or phone numbers of my close friends, I don't need FB, but for pretending to be inclusive it's pretty fucking sinister.
It's like I wouldn't hate a piece of chewing gum per se. But when it's advertised as a full meal it becomes something entirely differently.
For those who can't stand others complaining about FB, strap yourself in, I can't stand you still using it, and unless FB changes drastically, that will remain so. I'm Momo, you're the people who got abducted into day cares. And hey, I even went inside with you just so we could keep playing. What a waste of time that was.
It's just safer/easier to use a throwaway. I have these opinions in real life, but I try not to be too controversial in writing.
As meta comment though, I don't think anything you said is necessarily controversial, it's just debatable. Obviously you need to gauge the potential fallout on your own life, but the comments themselves are fairly innocuous.
It's just a habit of mine to make a throwaway for anything potentially controversial. It really wouldn't be too big if a deal if my identity was connected to any of my throwaways. It just makes me feel safer.
But in general, I don't doubt that these things are well intended and not malicious. In my case, my complaint isn't that Facebook is malicious or intentional. It's more of a negligence or gross negligence point.
[Edited for clarity]
Facebook's history and business model are selling data to advertisers to make money. Locking your data in. Depriving you of ownership of your content.
When the sole source of income for a company depends on duping people into providing free data and content that they can monetize through unbelievably shitty ads, you can bet your ass that there will be some false evil positives. Because why wouldn't they?
Is there anything Facebook wouldn't do to make a buck? I think the answer is no. They have no morals, no ethics, and no values that I can discern. When someone says Facebook is listening to your computer microphone, I think, "Well duh. Of course they would. Anything for another advertising buck." And when I find out they weren't, I think, "Well, it's a good idea for them. They are probably working on it."
Can you name one single thing that Facebook has refused to do in the search for ad revenue? I've never worked there, so I can't possibly know the answer to that question. But based on what I've seen Facebook actually do (false reports not included), I'm pretty sure that no one ever says no to anything if there's a chance at making more money.
Add to that the fact that the company is explicitly against the norms and standards of an open web, and you have a good portion of your answer.
We hate Facebook because it takes advantage of people who don't know any better and subverts the open nature of the internet. And because there is seemingly nothing it will not do, no matter how unethical or awful, to further its own ends above.
It's not about "startups vs. market leading companies." It's this audience knowing the immense power and control companies like Facebook can (and do) exert over us all.
It's compelling to talk about the effects, clearly people care about it, so it will be written about.
Personally I find it offensive that an ad network thinks it has anything to say to me about the safety of my loved ones or that it has pretensions to providing services for the "public good".
If you're going to sell ads, sell ads. Don't pretend that you're not in the psychological manipulation business and you're somehow saving the world.
> After years in the industry, 95% of things that are "bad" that come out of big companies end up being well meaning and just look malicious without context. Hanlon's razor is real.
Intentions don't matter. The negative effects of pervasive corporate surveillance and finely targeted advertising are real and potentially catastrophic. Being "well meaning" just means that the engineers either didn't fully consider the consequences of their actions or acted with enough hubris to think they knew the consequences even though there were many unknowns.
The cost reductions that removed hardware interlocks for the Therac-25[1] were well-meaning. Still killed people.
Just because someone's making money off of something doesn't mean it's inherently bad.
But jumping on a disaster to make money is always bad. There's a reason being a war profiteer was a prosecutable offense (though that seems to have gone out the window in recent decades.)
I'm not sure what your question is; do you mean is there anything Facebook could do when there's a disaster that wouldn't seem like they're trying to cash grab in a very inappropriate way? I don't know. My response would be Facebook is not important when there's a disaster, there's plenty of other forms of communication. If you can use Facebook then you have internet and phone/texting access, so you don't need Facebook. Your loved ones can get a hold of you by more direct methods.
Which is not to say it's impossible Facebook could come up with a useful feature that would be helpful to people during a disaster; but "Safety Check" is not that.
> Which is not to say it's impossible Facebook could come up with a useful feature that would be helpful to people during a disaster; but "Safety Check" is not that.
The top post on this thread is literally someone saying that this feature is the only reason they have kept their account.
Can it be improved? Absolutely. But to say it's not useful in its current form is absurd.
You may like https://news.ycombinator.com/item?id=14456200 which hides your comment scores and scrambles your karma counters.
I find that without the distraction of downvotes, it's much easier to have substantive conversations even on heated topics.
And yet you had to create a throwaway account before you could comment.
How long in the past does something like that need to be before you can start taking other evidence into account?
I'm sure that becoming a billionaire and one of the most powerful men in the world has made him infinitely more humble. But I think it's more likely that he's just gotten better at messaging and spin - especially since he now has people to help him do those things.
> How long in the past does something like that need to be before you can start taking other evidence into account?
What evidence (actions not words) is there that Zuckerberg is any more concerned about people's privacy than when he was 19? Take a look at the WhatsApp fiasco[1] - all I see is evidence that we continue to be "dumb fucks" by trusting Facebook.
[1] http://www.telegraph.co.uk/technology/2016/08/26/whatsapp-me...
Because the dumb fucks comment was in 2004.
Edit: (In case you nitpick my analogy) I guess you would not hire a person that was jailed in the past, because you cannot trust them.
People still hire me and trust me because I fucking owned up to my mistake, paid my duty to society, made amends, and have never repeated that mistake.
To my knowledge, Zuckerberg has never so much as apologized for being a stalker or an assclown, let alone done anything to make up for it.
It's one thing to give some support to someone who admits they did something bad. It's entirely different to give support to someone who has never done so.
Most people are not all that inclined to give you a shot after you've done time for a felony and paid huge fines, and done everything in your power to make things better for the people you hurt.
It's hard to get a job. Every application is a ton of effort even more than normal because I have to disclose things, explain the situation, my guilt, my response, and what I've done since to make sure it doesn't happen again.
But I've been, thankfully, able to find people who are willing to trust me enough to keep me employed.
People are even less inclined to cut you some slack when you never even tried to apologize, make amends, and keep acting the same way. If I tried to treat my felony the way Zuckerberg treats his fuckups, no one would ever hire me for anything at all. And rightly so.
There's a lot to be said for admitting that you screwed up and working hard to make things better. Zuck has done neither. And I don't care if it was when he was 19. The prosecutors didn't care how old I was at the time.
Being a fuckhead isn't a criminal offense, but that doesn't mean that there should be a statute of limitations on it. Once a fuckhead, always a fuckhead until proven different. And when your platform is still a privacy fuckhead thing, I'm even less inclined to forgive you and pretend that everything is okay.
2. Has anything really changed?
Otherwise, what is this rehabilitation you speak of? Two parties are required, someone who forgives, someone who seeks forgiveness. To turn not seeking forgiveness into being unforgiving is just projection, and to give forgiveness where it is not sought would make a mockery of the whole effort, and of those who actually do reflect and repent. People who are the bottleneck don't get to hold the rest hostage. If he is too fucked up, then he's too fucked up, then that's sad but true and I'm not his brother or son or father to pour resources into him when there are far more worthy recipients. At the very least, he queued himself in the back as far as I'm concerned, correctly so.
Zuckerberg could live out the rest of his live just from his current wealth, and you're still white knighting using some poor Schmuck who made a misstep that could ruin his life unfairly as an example? Just step back and ponder that.
What about potential social networks made by people who are more grounded? Who don't exploit their fellow men? Those don't get a chance because we can't damn Zuckerberg for having been back then who he still is today, or what? Don't just think "what if this billionaire was my starving little sister", also think of the opportunity costs.
There's little forgiveness to be sought here. He said something stupid once, as a teenager. Here we are, 13 years later. If someone thinks he is the same person, with the same beliefs, so that one off-the-cuff comment is of any value in evaluating his thinking and behaviour, then frankly, this someone is dumb.
As for the rest of your comment, it all sounds like "let's hate him because he's rich". Your parent talks about basic principles that apply to everyone regardless of their status.
> it all sounds like "let's hate him because he's rich".
Oh, so it sounds like that. To you. That says more about you than about what I wrote.
My position does ignore the positive aspects of Facebook like finding old acquaintances, coordinating social events etc, but then even cannibalism has its bright sides.
> is not your problem
You're wrong on both counts. Having an opinion regarding a social media platform, particularly one that can affect the fabric of society, is totally reasonable on a discussion forum hosted on Y Combinator.
It's no more living the life of others than having an opinion on war, politics or famine.
Proof?
Why does everything Facebook do have to be so heavily criticized?
Safety Check is a wonderful feature. If I remember correctly, it started off as an internal hackathon project that got turned into a full feature. They get shit if they turn it on (here), and if they don't turn it on (past tragedies where they failed to turn it on).
Why does everything Facebook do turn into a riot? After years in the industry, 95% of things that are "bad" that come out of big companies end up being well meaning and just look malicious without context. Hanlon's razor is real.
Yeah, Facebook has to fund all this somehow. Yeah, they are going to make their ad space extremely valuable with all the information they have. They don't sell your raw data. They sell access to you like the rest of the industry.
Those creepy ads that you saw based on some conversation you had? Turns out that they're NOT listening to your mic or whatever. It's either confirmation bias or something you're not thinking about.
Those friends that they suggest with a new account? Turns out your friends posted pictures of you on Facebook, and Facebook knows how to do facial recognition.
It feels like everything Facebook is overblown on HN. What am I missing?
Edit: I should have said this originally, but I'm a former Facebook employee, now at another big tech company. I try not to be too controversial in writing, which is why I made a throwaway.