Yes. Really.
>Sandy Parakilas, the platform operations manager at Facebook responsible for policing data breaches by third-party software developers between 2011 and 2012, told the Guardian he warned senior executives at the company that its lax approach to data protection risked a major breach.
Parakilas, whose job was to investigate data breaches by developers similar to the one later suspected of Global Science Research, which harvested tens of millions of Facebook profiles and provided the data to Cambridge Analytica, said the slew of recent disclosures had left him disappointed with his superiors for not heeding his warnings.
“It has been painful watching,” he said, “because I know that they could have prevented it.”
Parakilas said he “always assumed there was something of a black market” for Facebook data that had been passed to external developers. However, he said that when he told other executives the company should proactively “audit developers directly and see what’s going on with the data” he was discouraged from the approach.
He said one Facebook executive advised him against looking too deeply at how the data was being used, warning him: “Do you really want to see what you’ll find?”
https://www.theguardian.com/news/2018/mar/20/facebook-data-c...
That seems a common way of thinking. I have seen people argue against pentesting because they didn't want to know about vulnerabilities.
> the Gell-Mann amnesia effect defines the idea that "I believe everything the media tells me except for anything for which I have direct personal knowledge, which they always get wrong."
My intuition says the latter because time is money and journalists are rarely experts in the fields they cover.
Even supportive facts/quotes can cause concern. Subject matter experts have a reputation on the line, while the journalist is often just looking for a story.
I wrote, "they were significantly more likely to become defensive when I checked facts and quotes with them."
We check facts and quotes to ensure that we are being accurate and fair.
Would you prefer being misquoted? Or would you prefer having improper contact assigned to your words?
Nobody ever called me, my boss or my friends to verify this summer has been extremely hot or what my favourite food is.
Also: just getting the words correct doesn't help if you cut the part where I explained what happened.
Exactly. I'm very aware of that.
The problem is both good journalists and bad journalists call to do fact checks, -good journalists to verify they got the facts correct, bad journalists to provide legal cover before they quote you out of context to build the case they want to build anyway.
So, when someone call you and want to verify what you said I'll recommend being very sure that you get it exactly right and so clear that they cannot misunderstand you.
Defending yourself against a journalist might easily become a case of "have you stopped beating your wife? How hard can this be, yes or no?"
When people get defensive with me for being conscientious, my instinct is always to dig deeper. I'm sure that holds true for many others.
You might get them to publish a retraction (since it wasn't true) but hasn't the damage already been done?
What when those same papers write stuff that is technically true (but leave out why it was done)?: "founder sends millions to foreign bank account." "Founder declines to comment." ?
When you get negative coverage, accept it as the other side of the earned media coin. It is more effective than advertising because it has the potential to be negative. If there was never negative coverage, earned media wouldn't be worth pursuing. And, if you dig into the negative coverage, you'll often learn a lot from it. So, when you get negative coverage, email the journalist, thank them for writing about you, reaffirm that you're always available to talk, and then ignore it.
If an outlet has a history of attacking you, consider why they are attacking you and if the attacks have merit. If it's because you've been difficult in the past, you need to find a good PR person and get some media training in a hurry. You specifically want a PR person who entered the field through journalism, not marketing. Your PR person will be to work with the initial storm. If you caused the mess, you likely need to be hands off during this stage. And then, you need media training so that you don't offend a media outlet again.
It sounds like you have a rough time with media. Do you use the word 'exclusive'? If so, are you sure that you know what it means? Aside from lying, or being evasive, the best way to offend an outlet is to misuse the word.
Retractions don't happen very often, and unless you have very serious evidence, they aren't even worth going for. In the absence of serious evidence, a crafty editor will use your quest for a retraction as an excuse to keep writing about you. The goal is always to get them to stop writing, not give them reason to write more.
And frankly, publications will always write things that are technically true without adding any context. Never assume that this is because of malice because truth is, they likely don't care enough to be malicious. The sooner you get over this idea of a big, bad malicious media, the sooner you will learn how to work with them.
That is quite a misunderstanding of my position. What do you take me for?
They don't need to be all positive at all. My point just shouldn't be actively lying or misleading.
> If an outlet has a history of attacking you, consider why they are attacking you and if the attacks have merit.
Done. (And it is not about me, and I'm in a position where it would be useful for me to know if there was something.)
> It sounds like you have a rough time with media.
Personally? Not at all.
> And frankly, publications will always write things that are technically true without adding any context. Never assume that this is because of malice because truth is, they likely don't care enough to be malicious. The sooner you get over this idea of a big, bad malicious media, the sooner you will learn how to work with them.
My question is rather: how long should we accept this (i.e. baseless smear campaigns agains companies and/or individuals)?
Mostly media does a great job and I respect and actively (i.e. by donating or keeping subscriptions I don't need) support great journalism even if I don't agree with everything they write.
But sometimes some journalists are really destructive. It is those cases I'm talking about. If the pen is mightier than the sword, then at some point, shouldn't the abuse of a weaponized pen be punishable? That bar should be high, yes, but at some point (inciting hatred against nations or ethnicities using made up allegations should be a good example) I think most people would agree that society should have some way to correct it. The question is just exactly where that bar should be.
And again no, this isn't about me. Personally I never had problems with media going after me, this just happens to have bothered me over years as I've seen certain journalists go after other people for what turns out to be no good reason. I'm luckily not aware of many cases though, but what I've seen has made me hesitant to talk to media (and Gell Mann amnesia also isn't as strong as it used to be anymore either).
This sounds interesting :) any stories you're able to share on this?
News is still good. The HN front page surfaces good tech news, while reputable newspapers are still reputable in their area of expertise. Don't confuse the Gell-Mann [1] effect with Dunning-Kruger [2]
[1] https://en.wikipedia.org/wiki/Gell-Mann_amnesia_effect
[2] https://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect
How is that not true of every single security/privacy incident, ever? If the situation was, "everyone knew 23andMe was storing non-deidentified genomic data on an unsecured S3 bucket, and this was fine until [insert villian] took it" it would be the same, and people would be justifiably pissed off. This feels like a completely correctly handled story in the media, your personal anecdote about working with Facebook notwithstanding.
This is a false equivalence. Hacker News comments are public. (HN also doesn't sell ads.) Facebook messages and private content usually aren't.
Just because "the API's that were used there were available to the entire world" doesn't mean "everyone knew exactly what they were." Everyone didn't know what they were capable of. A very small section of the technologically literate did, and most of them were profiting off the status quo.
Sure, that's not the same as public access, but it's equally blown out of proportion.
Users must be empowered to delegate access to the software of their choosing. Facebook offering read_mailbox as an option on its OAuth consent screen is exactly as evil as Fastmail offering IMAP.
https://www.zdnet.com/article/facebook-instant-personalizati...
Others quoted about screaming foul from within facebook. I was involved with RTB ad exchanges at the time, and everyone knew that the data is available to whomever wants it, with facebook's tacit approval.
Gabriel Weinberg (yegg) founder of duck duck go had a story on his blog about how he targeted his own wife with a facebook ad, and about how easy it is profile/get everyone's FB data, and he wasn't the only one.
Your experience may have been different; it looks to me like you'd rather look at the world through rose tinted glasses and give FB an undeserved benefit of the doubt -- but I'll accept that this was your experience. However, I have about 20:1 anecdata about "improper FB" than "proper FB", so I tend to believe the latter.
If there was one story of patents done right, does that indicate there are no patent trolls and it's all blown out of proportion?
I travel a bit. Facebook, the company, has a disproportionately vocal base of support in Silicon Valley. (This is also where the principal economic beneficiaries of Facebook's status quo live.)
Facebook giving out privileged API's willy-nilly without verifying who the people operating them really are is the issue. If a bank gave the keys to their vault to some shady people then you blame the bank.
My god man, armies of lawyers involved.
When it comes to the GP that talked about his experience - this was about platform vendors such as Apple or Blackberry having supposed "special access". But Facebook just did not release any data here. It just allowed third parties to write a Facebook app. For the most part, those apps where client-side, so the data did not leave the users device.
Now in the spirit of argument, there are a lot of aspects that can be debated: Is there a meaningful difference between code written by a contractor, but published by Facebook, an app published by a third party, but making it look like it belongs to Facebook, or a third party app without the blessing of Facebook. How does that relate to our ideas about the freedom of the internet (should anyone be allowed to create a Facebook app, without Facebook's blessing, which is certainly a technical possibility? What is the implication of Facebook's support for such an app, or lack of taking legal action against it?). What is the responsibility of companies like Facebook when having an API of the sort that they do, which prima facie allows users to decide which data to share? So about if I agree to share data, but that data is something my friend shared with me? Does Facebook have a responsibility to prevent this? Is is problem the sheer amount of data on Facebook? If I have a small online community forum, can I offer that sort of access, letting my users share their friends list with third party apps? What about apps like Twitter, Telegram asking for your permission to access your phone book. Courts in Germany have said the users agreeing to this are the ones breaking the law. What if I agree to share my contact book with an app, but that app does not upload this data to a server? How does that compare to Facebook asking a third party to provide a Facebook app, but data does not go to a third party server?
It's all interesting stuff. And I don't even ask the media to discuss it in that level of detail. They can give the 5-or-however-many foot view. But don't misrepresent that.
Gell-Mann amnesia doesn't defend the media here, right? The idea is that it is strange that you trust it after their incompetence has been proven to you.
Look, I am not a Trumpian Fake-Newser. I think it's good we have journalists. I am sure the journalists working on those Facebook stories did their best, given limited time, the breath of technical details involved, the pressures of creating content that brings in clicks, and yes, the personal vanity of wanting to uncover a big story. We are all human, after all.
CA is even one thing. But regarding the platform integrations - what GP tells from personal experience is the same thing I got from reading the reporting. It was simply misleading.
All that is beside the point. The point is that if as 'sonnyblarney indicated there a custom negotiation for every new organization that gets to peak behind the curtain, then the process is not standardized. Normal online firms have TOS and APIs, and it's possible to characterize what user data they release. For Facebook, apparently that characterization is not possible.
Not a single lawyer involved in either.
That was actually the entire point. That Facebook had these overly... generous APIs for anyone to use. That's not a good thing.
Calling them “overly generous” is such a disingenuous statement because it connotes such a clearly wrong historical perspective that the whole statement is a falsehood.
Facebook’s APIs at the time were considered too stingy at the time! So much so it was constantly fending off accusations of being a walled garden taking advantage of an open web. The less than adequate APIs were their attempts at fending off that narrative.
It's worth noting that the context around privacy of generic life information of the kind you post on social media has radically changed in the last 10-20 years.
Back then, the Facebook API gave out personal details of not use the end user, but all the end user's 'friends'. I never gave the explicit opt in for that.
Once someone knows something about you, it's no longer yours; it's that person's to do with as they please.
APIs that allow a user to delegate his access to the software he chooses are essential to the open internet. The evil behavior is not providing them.
I don't know if its different in the US but here in Europe that seems to sum up the "sexist" nature of our industry. Its true that there aren't many females in IT but when I have worked with them they have always been treated fairly and as equals to men. Their sex never seemed to enter into the equation at all.
It displays a hubris and greed that makes the lives of millions of innocent people worse, time after time. Then the tax payer bails them out when that greed backfires, as it does every single time.
It seems like most of the major banks were guilty of obviously dodgy lending and deliberately overly-omplicated financial instruments in the run up to the last recession, and they seem to be back at it again with car loans.
Animosity is to be expected I think.
In addition to willfully misleading Congress it also likely violates their 2011 FTC consent decree[2]. Is this also just part of the 'media narrative' you claim is different from reality? I think these revelations amount to pretty "scammy behavior" as well, to borrow your terminology.
[1] https://www.wsj.com/articles/facebook-gave-some-companies-ac...
[2] https://www.ftc.gov/news-events/press-releases/2011/11/faceb...
Yeah they were, and that's why the APIs were eventually shuttered. FB even secured a promise from CA that they retroactively deleted the data.
That’s the problem. It only takes one bad actor.
It's astonishing how different the 'media narrative' is from reality, and it confirms my belief that the press runs on such narratives (i.e. building up, crashing down) because in both directions the truth is inflated for dramatic, i.e. click-bait reasons.
Our large company built a very good FB app that effectively was 'FB' on our platform. It was FB branded - for users, it was effectively the 'real' (and only) FB. Obviously that app had to have special APIs.
Everyone involved from top to bottom was pro. We didn't store data, nor did we want or need to. The way the tech was setup (data goes to app), we didn't really have the option. Users logged into their own accounts and retrieved their data, it's not like we could just access data arbitrarily.
Everything was pro and above bar - and nobody in the equation - a lot of us regular, conscientious people - thought for a second that anything was wrong or irregular in any context.
In fact - the whole situation could be described as: "FB hired 3rd parties to develop some code", which surely they do in some circumstances.
Nobody was harmed in any way, and there really wasn't risk of anyone being harmed.
I understand that with 2018 hindsight, we might look at things a little differently, but in reality, I think we'd have still done it. Perhaps there would have been more checks and assurances (i.e. FB takes ownership of code and actually publishes the app), but in reality it was (and would still be) fine.
As far as the Cambridge story - this is also misleading because the API's that were used there were available to the entire world and everyone knew exactly what they were. Were there tech people screaming foul? The press? Not really, they seemed reasonable, until it seemed that some bad agents were getting a little unscrupulous, and so FB did the right thing and altered the APIs to make them more secure. Security polices change all the time, in this case they tightened up given some field data. That's it.
It's really a story about Cambridge's scammy behaviour, and possibly lies to FB on where that data was, not about FB.
I don't like Facebook, I don't use it, I don't like being 'productized' etc. etc. - but I don't feel that the information in these scenarios has been properly handled by the media.
Because there are legitimate issues with privacy in the new world order in 2018 that are finally coming to bear, and we definitely want to re-evaluate our situation with FB, basically, we go and dig up 'something that happened 10 years ago in which nobody was harmed' to build a 'kind of misleading narrative' around the the 'legitimate issue'.