No, you are wrong, this is a pretty egregious mistake. They defined device makers as service providers, and then allowed them to do things that even third parties weren't allowed. Yet they claimed they shut that stuff off to third parties (so they lied by omission). "No, we don't allow third parties anymore to do that kind of stuff" (but there's this large group that can do it, but we aren't calling them third parties). This wasn't just another way to get at the data. The NYT article goes into some detail about what they allowed them to do.

This is like saying that Chrome, Edge or Firefox are “third parties”.

Embedding user agent functionality into the OS is not the same as third party access.

Talk to me when a device manufacturer is caught exfiltrating this user data off the phone and then aim your pitchforks at them.

Google, Firefox, and Edge are not Facebook so yes they are third party.

And does it upset you that when a user signs into facebook in one of these browsers, facebook allows the browser access to that user's data and even data of that user's friends? Even when those friends have explicitly disabled sharing of facebook data with third parties?

HN has reached a level of popularity where its attracted too many non-engineers that love jumping into these threads with ignorant, reactionary, hyperbolic responses. every post on uber/tesla autopilot has at least a few people calling for elon to be tried for manslaughter for car accidents. really shows the stupidity of the mob. this thread is another great example. if only it were benign and didn't have real, foolish policy implications like the GDPR

That’s not what the term means. User agents which render Facebook UI components are not “third parties” to my Facebook data anymore than my monitor manufacturer is a third party to my Facebook data while I am viewing the pixels in the screen.

> my monitor manufacturer is a third party to my Facebook data

It actually is. Your monitor, on the other hand, can be considered a part of yourself for the purposes of viewing the data.

If it somehow sends sensitive information back to its manufacturer, thought, that would be a new, different can of worms.

They are the second party -- the user.

Facebook never has any interaction with the human user, they only interact with the user agent.

So they basically relied on us not reading the small print. And we didn't. There should be laws against small print technicalities like that.

>They defined device makers as service providers, and then allowed them to do things that even third parties weren't allowed.

Because they're not third parties. Third parties are anyone off the street that meets some minimal requirements. It's like the distinction between third party and second party releases on video game consoles. Second party releases are extensions of the first party publisher because of the special access and extra scrutiny they get. The difference in this case is that this "special access" is apparently no different than what you get from the website through scraping HTML, just in a more convenient manner.

The user is the second party dude.

The user doesn’t manipulate the EM spectrum with his mind, but through user agent hardware, firmware, and software. The client stack necessarily has the same access he does.

Yes, so it might be OK for software written by a third party to access FB with the second party's authentication and privileges, when running on the second party's device.

But that doesn't make it OK for that data to be stored on the third party's servers or be otherwise available to the third party.

That's not what third parties means. Third parties means parties other than the service provider and the user.

Third party has never meant anyone who is not the first party. Special agreements between companies alter this status.

You're conflating the issue of informed consent with access ubiquity.

Simply because the data was gathered in a way not unlike most apps, doesn't make it a non-story. In fact, the lack of informed consent and the very misleading statements to Congress make it a huge story.

User data is a commodity, and is worth far more than money. Considering how easily manipulated large portions of the Facebook community can be (e.g. Facebook mood studies, election-year propaganda, etc.), giving access like this to large tech companies - third parties - absolutely needs to be well regulated and come with the informed consent of it's user base.

Not to mention that the policies around turning this data over to other parties -- namely law enforcement -- is different between most of these companies.

The objection is not non-facebook code accessing facebook data. The objection is that, once again, powerful information is being traded and used as leverage to drive profit, with the intent of the buyer or receiver largely unclear, and the impact yet to be seen.

There is no issue of informed consent here. When you upload data, you consent to your allowed friends being able to view that data in whatever manner they see fit. These device specific interfaces to facebook is just an example of this. FB themselves took reasonable steps to ensure the device manufacturers adhered to the consent that users give when adding data to the site (i.e. only use the data in service to displaying it).

>The objection is that, once again, powerful information is being traded and used as leverage to drive profit

There's no evidence of any of this.

>There's no evidence of any of this.

I disagree. I think Facebook, driven by ad dollars, is attempting to secure as many users as it can. Part of that is to make it as seamless and convenient as possible.

Data as currency is a given at this point. Facebook ensures longevity through ease-of-use. Service providers secure further assets, and are in a position to use it.

>> There's no evidence of any of this.

> I disagree. I think ...

I think you misread "no evidence" as "no one believes".

If these people are so easily swayed and manipulated, what exactly is informed consent supposed to cure?

Informed consent is simply that -- being able to consent without missing a piece of knowledge.

It may cure nothing. But the fact remains that Facebook acted (and continues to act) in bad faith to the user.

Maybe nothing changes, especially now that users are so deeply attached. Real-time targeted advertising has been around since the early 2000s, but explain to the average tech-illiterate user that their phone can hear when a Tide ad is on television and can serve a Clorox ad in their Instagram feed, and watch how uncomfortable they get.

How much of this could be stopped with informed consent.

> Facebook gave some device makers special APIs to access authorized data. This is literally no different than a web API or scraping facebook HTML, just more streamlined.

If I found out that Google was using Chrome during my authenticated Facebook web sessions to scrape my Facebook data, and my friends' Facebook data, I'd be pretty upset too.

But nothing like that happened here... in the slightest?

This was OS chrome integrating Facebook features. An API for Mobile OS UI to integrate Facebook features.

How else do you think the OS provides FB functionality... after you enter your credentials into the Settings screen?!

I think you need to read a bit more carefully. This was not just API calls, these were data sharing partnerships--i.e. the device companies had access and permission to collect, aggregate, and store customer data in one place, like Cambridge Analytica did. Example quotes (emphasis added by me):

> They said its partnerships were governed by contracts that strictly limited use of the data, including any stored on partners’ servers.

> Tests by The Times showed that the partners requested and received data in the same way other third parties did.

Facebook customer data was collected and stored on servers owned by the device manufacturers. This is not analogous to a browser interacting with the Facebook web application.

Did the OS keep the data or use it in any way beyond what the OS needed for display etc?

Hackers proclaiming "but it wasn't technically a breach" or "the API worked as intended" is 2018's edition of Great Recession bankers' "the counterparty should have known it was our business to screw them" or "it isn't our job to diligence the mortgages". There is discomfort associated with any paradigm shift. Particularly when our livelihoods are entangled in them. A good way to stick oneself on the wrong side is to brand change as derangement.

Should that data have been available via a web API or Facebook's HTML though?

>Should that data have been available via a web API or Facebook's HTML though

There is no evidence that these APIs provided more data than a user had legitimate access to.

This is simply Facebook functionality being integrated into parts of the OS chrome.

We trust our devices not to exfiltrate our data every second we are typing on them. Tightly integrating social features into a mobile OS is not third party access unless the device maker in exfiltrating the data for any purpose other than encrypted cloud backup.

If the discussion here is bad, you definitely have played a role in making it so. Claiming people who disagree with your point of view are "deranged" is not constructive.

> This is literally no different than a web API or scraping facebook HTML, just more streamlined.

I see you're using the new definition of literally, the one that means figuratively. In the same sentence you have said it is no different and then said it is vastly different. Your post makes no sense.

Even if you were right that the data is 100% hash-compatible, SHA-1 it and get the same data as the API (you're wrong), it being streamlined is a huge difference and makes this news, in fact.

You surely agree that an individual person walking up to others on the street and asking a question is different than a team of 10M people doing them same thing, right? But there's "literally no difference", just streamlined?

Streamlining something defines patents and makes billions. Streamlining a legal activity can make it illegal.

Your post is wrong, you are using logical fallacies and you are then blaming everyone else with harsh language, while it is is you who seems to have, in your own words, some kind of "facebook derangement syndrome". Wow, those are rude words. Flagged.

FYI

https://www.merriam-webster.com/words-at-play/misuse-of-lite...

Did you actually write this many words based on your disagreement of my usage of "literally"?

Here you've crossed into incivility, which is not ok. Please (re-)read https://news.ycombinator.com/newsguidelines.html and post civilly and substantively, or not at all.

No, I wrote that comment because you are an abrasive member of the community who is writing direct insults to other members, calling them deranged, etc, and doing other things that are against the rules of the site. You are breaking the conversation here. You are distracting. You are lying. You are being abrasive and causing fights. You are calling people names and causing a big scene.

You ignored my entire post, and instead chose to post an off-topic question, further distracting and hurting the conversation. That is also against the rules. I'm responding to you so that others are more aware of the damage you are causing.

We are not "deranged" people for our thoughts on Facebook. Stop it.

Since this is a repeating pattern and asking you many times to stop doing it hasn't apparently worked, I've banned you until we get a commitment from you at [email protected] that it won't happen again.

This is very different than scraping html. Facebook has obviously been lying about 3ed party data access.

This comment is incoherent, at best, and it says a lot about how far the HN community has sunk that it is the top comment. "------ derangement" syndrome is a common phrase used on lots of political blogs that also specialize in nonsensical arguments and don't seem to care that entities in power lie through their teeth.