That really makes it worse. If there were some set of cut-and-dried rules (even one that changed occasionally, because of course Facebook is always changing the rules), outsiders could evaluate those rules and have some idea what's going on. If every data release involves armies of NDA-bound lawyers, there's no way to know anything about Facebook data releases in general. It's completely possible that the Cantabrigians negotiated everything they did beforehand, due to some combination of Facebook lawyer variability and the CA lawyers being more aggressive than your firm's lawyers.

Except to say that there were "instances of Facebook releasing data" makes it sound you misunderstand the technical details of what happened, and if so, why would that be? Because despite the media writing half a forest worth on the subject, actually information that would help us understand what took place was exceedingly rare.

I didn't use that phrase. Anyway, don't just make cryptic accusations of ignorance. If anyone had used that phrase, how would it be wrong? Should we say "instance" rather than "instances", because CA was the only party that ever received data? Should we use a different verb, not "releasing"? Help us to understand, rather than complain about the media. We all know about Gell-Mann amnesia.

It was a mistake to put that in quotes; I didn't mean to cite you. I meant to emphasize that the the phrase "every data release" sounds like there were individual, distinct cases where Facebook agreed to release data.

When it comes to the GP that talked about his experience - this was about platform vendors such as Apple or Blackberry having supposed "special access". But Facebook just did not release any data here. It just allowed third parties to write a Facebook app. For the most part, those apps where client-side, so the data did not leave the users device.

Now in the spirit of argument, there are a lot of aspects that can be debated: Is there a meaningful difference between code written by a contractor, but published by Facebook, an app published by a third party, but making it look like it belongs to Facebook, or a third party app without the blessing of Facebook. How does that relate to our ideas about the freedom of the internet (should anyone be allowed to create a Facebook app, without Facebook's blessing, which is certainly a technical possibility? What is the implication of Facebook's support for such an app, or lack of taking legal action against it?). What is the responsibility of companies like Facebook when having an API of the sort that they do, which prima facie allows users to decide which data to share? So about if I agree to share data, but that data is something my friend shared with me? Does Facebook have a responsibility to prevent this? Is is problem the sheer amount of data on Facebook? If I have a small online community forum, can I offer that sort of access, letting my users share their friends list with third party apps? What about apps like Twitter, Telegram asking for your permission to access your phone book. Courts in Germany have said the users agreeing to this are the ones breaking the law. What if I agree to share my contact book with an app, but that app does not upload this data to a server? How does that compare to Facebook asking a third party to provide a Facebook app, but data does not go to a third party server?

It's all interesting stuff. And I don't even ask the media to discuss it in that level of detail. They can give the 5-or-however-many foot view. But don't misrepresent that.

Gell-Mann amnesia doesn't defend the media here, right? The idea is that it is strange that you trust it after their incompetence has been proven to you.

Look, I am not a Trumpian Fake-Newser. I think it's good we have journalists. I am sure the journalists working on those Facebook stories did their best, given limited time, the breath of technical details involved, the pressures of creating content that brings in clicks, and yes, the personal vanity of wanting to uncover a big story. We are all human, after all.

CA is even one thing. But regarding the platform integrations - what GP tells from personal experience is the same thing I got from reading the reporting. It was simply misleading.

Who are you trying to convince? I certainly don't trust "the media" (or as I typically call them "the war media") as anyone on HN who follows my copious commenting can tell you. At this point, I trust Facebook less than the newspapers, just based on my (very) occasional use and actually listening to what Facebook themselves say.

All that is beside the point. The point is that if as 'sonnyblarney indicated there a custom negotiation for every new organization that gets to peak behind the curtain, then the process is not standardized. Normal online firms have TOS and APIs, and it's possible to characterize what user data they release. For Facebook, apparently that characterization is not possible.

I known a few people who gamed facebook's add system to "color" people's profile data into cookies, and also a couple of "quiz" app developers who had access to everything they could ask for at the time, and then some.

Not a single lawyer involved in either.