News for hackers. Stuff that matters.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by josefresco on Tuesday October 30, 2018 @02:59PM (#18340191)
"In announcing new transparency efforts or tools to combat foreign influence, Facebook included a caveat. “These changes will not prevent abuse entirely. We’re up against smart, creative and well-funded adversaries who change their tactics as we spot abuse,” Leathern wrote. But we believe that they will help prevent future interference in elections on Facebook. And it is why they are so important.”

But posing as 100 senators didn’t require being smart, creative, or even particularly well-funded. "

Ouch.

"There was one “Paid for” disclosure that Facebook didn’t approve in our latest test. They denied, just a couple minutes after we submitted it: Mark Zuckerberg."

Double ouch.

Re:We posed as 100 Senators to run ads on Facebook. Facebook... by gcb0 on Tuesday October 30, 2018 @08:25PM (#18342421)
and after having the "paid by Zuckerberg" confirmation that this was a malicious account, they didn't revoked approval of the other ads.

Triple ouch.

Re:We posed as 100 Senators to run ads on Facebook. Facebook... by FussyZeus on Wednesday October 31, 2018 @02:47PM (#18348264)
Tech company doesn't give a f#$% what it's advertising as long as it's getting paid. Film at 11.

I mean props to them for doing this to show it so blatantly, but is anyone really surprised? Nobody cares, and why should they from a business standpoint?

The only way to make something a priority is to make the consequences so harsh that you'll catch the attention of upper management.

Re:We posed as 100 Senators to run ads on Facebook. Facebook... by dragonwriter on Wednesday October 31, 2018 @02:56PM (#18348338)
> Nobody cares

Obviously, FB thinks someone cares, otherwise they wouldn't be selling a tale about their efforts to improve validation of campaign ads.

Re:We posed as 100 Senators to run ads on Facebook. Facebook... by camillomiller on Thursday November 01, 2018 @09:38AM (#18353737)
I keep getting ads in my feed disguised as CNBC ads. The image they show has a cnbc logo. If you click on them you get to a fake news website disguised as CNBC with some bogus story about criptocurrency. I reported them 3 times to Facebook and I keep seeing them.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by mrguyorama on Tuesday October 30, 2018 @03:32PM (#18340504)
I wonder how many times "Zuckerberg" is in the code verbatim
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by lozenge on Wednesday October 31, 2018 @04:27AM (#18344058)
I wouldn't be surprised if it were verboten. The leaked Windows NT source code had plenty of swearing, no references to Bill Gates.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by warent on Tuesday October 30, 2018 @06:52PM (#18341930)
I imagine one time. Then everything else imports the `MZ_CONST` file which then references the `MK` or `ZBERG` variables.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by babypuncher on Wednesday October 31, 2018 @02:15PM (#18348027)
I didn't realize Facebook only hired software engineers from the '80s who are allergic to coming up with good identifiers
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by evgen on Tuesday October 30, 2018 @07:17PM (#18342062)
Nah, things just refer to him as fbid 4.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by Implicated on Tuesday October 30, 2018 @08:04PM (#18342301)
Who are 1, 2 and 3?
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by tylerhou on Tuesday October 30, 2018 @09:54PM (#18342773)
Test accounts which ended up getting deleted before (presumably) auth worked.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by hawkice on Wednesday October 31, 2018 @07:21AM (#18344758)
Holy smokes I just had flashbacks to working at a place that tested things in production and ended up with a couple of these production-db IDs in the code. Shudders
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by pavel_lishin on Wednesday October 31, 2018 @09:31AM (#18345475)
Your codebase only has a couple?
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by hawkice on Wednesday October 31, 2018 @06:48PM (#18349856)
You're already hitting a database, you can add a column for whatever information you want. I've heard people are spooked by having too many columns, but more spooked than having essentially untestable production IDs in their code? No thanks.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by beobab on Thursday November 01, 2018 @06:36AM (#18352564)
I remember one place I worked, someone released code which only returned data permissions for the test user (id 5).
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by anticensor on Wednesday October 31, 2018 @08:52AM (#18345208)
fbid 1 is former zuck. fbid 2 is Facebook itself (the software, not the Facebook's own page in FB). fbid 3 is yet another former test account.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by valarauca1 on Tuesday October 30, 2018 @07:38PM (#18342168)
dog it’s a PHP shop, nobody re-uses code
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by jjeaff on Wednesday October 31, 2018 @01:48AM (#18343604)
PHP's Packagist disagrees with over 1.4m packages and around a half billion package downloads a month. (More than NPM FYI)

https://packagist.org/statistics

Re:We posed as 100 Senators to run ads on Facebook. Facebook... by sah2ed on Wednesday October 31, 2018 @10:35AM (#18346007)
> (More than NPM FYI)

I found your claim hard to believe so I went digging but couldn't find any recent resource on the total number of downloads npmjs.org handles per month.

I could have sworn they used to publish aggregate stats prominently on their home page somewhere ... but can't seem to find it.

Anyway, aggregating* the download numbers of just 12 of the top npm packages comes to about ~504.4m, or half a billion package downloads a month.

*: using September 2018 numbers.

1: https://npm-stat.com/charts.html?package=express - 21m/mo

2: https://npm-stat.com/charts.html?package=body-parser - 24.4m/mo

3: https://npm-stat.com/charts.html?package=lodash - 64m/mo

4: https://npm-stat.com/charts.html?package=async - 64.7m/mo

5: https://npm-stat.com/charts.html?package=debug - 87.6m/mo

6: https://npm-stat.com/charts.html?package=request - 50.8m/mo

7: https://npm-stat.com/charts.html?package=chalk - 64m/mo

8: https://npm-stat.com/charts.html?package=commander - 61.8m/mo

9: https://npm-stat.com/charts.html?package=underscore - 21.5m/mo

10: https://npm-stat.com/charts.html?package=babel-core - 17.8m/mo

11: https://npm-stat.com/charts.html?package=webpack - 16m/mo

12: https://npm-stat.com/charts.html?package=react - 10.8m/mo

Re:We posed as 100 Senators to run ads on Facebook. Facebook... by PunchTornado on Wednesday October 31, 2018 @12:23PM (#18347044)
it cannot be more than npm.

npm is basically 1 line of code = 1 package

Re:We posed as 100 Senators to run ads on Facebook. Facebook... by Bluestrike2 on Thursday November 01, 2018 @10:49AM (#18354381)
Don't forget the dependencies :).
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by osrec on Wednesday October 31, 2018 @01:11PM (#18347482)
lol, made me chuckle!
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by jjeaff on Wednesday November 07, 2018 @02:30PM (#18401579)
I was referring to the number of packages available as being more. It wouldn't be very useful to compare number of downloads since php does need an entire package to do things easily like check if something is an array.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by woadwarrior01 on Wednesday October 31, 2018 @02:36AM (#18343742)
Facebook recently became the principal sponsor of the Python Software Foundation[1]. Although I don't have any concrete numbers to cite, there's a lot of Python code at Facebook. Calling it a PHP shop would be highly inaccurate and myopic.

[1]: https://www.python.org/psf/sponsorship/sponsors/

Disclaimer: I work there on python runtime optimization, which mostly involves writing C (and C++) code. Also, I've never had to write any PHP/Hack code.

Re:We posed as 100 Senators to run ads on Facebook. Facebook... by bigiain on Tuesday October 30, 2018 @07:10PM (#18342013)
a:1:{s:4:"name";s:10:"Zuckerberg";}
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by andrewflnr on Tuesday October 30, 2018 @07:01PM (#18341973)
That's probably one of the only people they could actually be sure wasn't buying Facebook ads. Whereas a senator buying Facebook ads is, in itself, quite likely. Not really a fair comparison.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by eridius on Tuesday October 30, 2018 @10:51PM (#18343001)
So what you're saying is, because a senator could conceivably be running ads, then any ad that claims to be by a senator should be approved without scrutiny?

Besides being preposterous, that same argument applies to literally anybody in the world except, I guess, Mark Zuckerberg.

So it sounds like Facebook's algorithm for detecting abuse is `if submitter == "Mark Zuckerberg" { reject(); }`

Re:We posed as 100 Senators to run ads on Facebook. Facebook... by sebcat on Wednesday October 31, 2018 @02:19AM (#18343690)
> So what you're saying is, because a senator could conceivably be running ads, then any ad that claims to be by a senator should be approved without scrutiny?

That was not said in the message you replied to.

Re:We posed as 100 Senators to run ads on Facebook. Facebook... by Angostura on Wednesday October 31, 2018 @08:21AM (#18345021)
Its not entirely clear what the message was saying, in my opinion
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by glorious on Wednesday October 31, 2018 @08:09AM (#18344961)
They were using the Cathy Newman method.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by gideon_b on Wednesday October 31, 2018 @01:41PM (#18347738)
Facebook has strict controls against impersonating Zuckerberg in ads for a very good reason. Facebook has had those controls for years and they have nothing to do with politics. This is the reason you can't impersonate Zuckerberg in ads:

https://www.nytimes.com/2018/04/25/technology/fake-mark-zuck...

Banning ads mentioning Zuckerberg is easy, so it makes sense that system works well. Imagine building a review system to combat fraudulent political advertising on Facebook, how difficult and complex that would be.

Re:We posed as 100 Senators to run ads on Facebook. Facebook... by andrewflnr on Wednesday October 31, 2018 @08:23AM (#18345032)
More like "abuse is hard, but let's at least get this super easy case right". Also, yeah, don't put words in my mouth.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by eridius on Thursday November 01, 2018 @12:33AM (#18351480)
Getting the super easy case right doesn't justify completely failing at the entire fundamental premise of the feature, which is to inform viewers that an ad was paid for by a particular political entity. When anyone can buy an ad that claims to be paid for by a senator, this alleged feature in fact becomes misinformation, and quite dangerous misinformation at that as it's got Facebook's seal of approval.

If Facebook cannot get this feature right 99.9999% of the time, they shouldn't be doing it. And it seems they're getting it right literally 0% of the time (barring Zuckerberg of course, but he's not on the ballot this election so that's irrelevant). This is so bad it should be a huge scandal; has Facebook gone back and vetted all of their political ads yet to make sure nobody's been taking advantage of this?

Re:We posed as 100 Senators to run ads on Facebook. Facebook... by narzu on Wednesday October 31, 2018 @06:46AM (#18344605)
Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by eridius on Thursday November 01, 2018 @12:30AM (#18351462)
No. "Iron manning" is stupid, it's just an excuse to dismiss a response because they weren't charitable enough towards your flawed argument.

Strawmanning is bad too of course. But responding to a reasonable interpretation (which is distinct from "iron manning"'s demand of responding to the strongest possible interpretation) is how discourse normally works. If someone's reasonable interpretation of your argument doesn't match what you were trying to convey, then that means you fucked up your argument.

In this particular case, the parent's argument is literally that Facebook is justified in not rejecting the political ads because senators are likely to buy ads. So that's what I responded to.

Re:We posed as 100 Senators to run ads on Facebook. Facebook... by yayana on Tuesday October 30, 2018 @07:41PM (#18342176)
Yes, and it's also always been more important for a publisher to defend more carefully against any misrepresentation relating to their own endorsement or trademarks on their own medium, while punting to take down processes for misuse of other's trademarks, etc is mostly allowed.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by gregcrv on Wednesday October 31, 2018 @09:08AM (#18345309)
Why? I am sure many other humans are named Mark Zuckerberg as well. Their life is probably very complicated now...
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by PurpleBoxDragon on Wednesday October 31, 2018 @08:13AM (#18344983)
Treating names as unique identifiers? Quadruple ouch.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by criddell on Wednesday October 31, 2018 @09:35AM (#18345523)
Maybe they need to flip their process. Rather than default accept, maybe they should have default reject.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by SilasX on Tuesday October 30, 2018 @07:07PM (#18341997)
Why wouldn't Zuckerberg ever buy Facebook ads? I doubt they'd let him run personal stuff for free, and I doubt they'd be sure he'd never want to run personal stuff.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by andrewflnr on Tuesday October 30, 2018 @07:15PM (#18342045)
The simplest way would be for him to say, "hey, I'm never going to buy ads on my own site, so don't let anyone impersonate me." If Zuck wants to tell us something on Facebook, he'll just put a banner at the top of our feed. Or if he does want to run ads as himself, he'll pull some other founder-fiat move. Keep in mind the engineering motto of the company we're talking about. They don't need to stick to the rules.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by SilasX on Tuesday October 30, 2018 @07:18PM (#18342069)
Corporate boards usually have controls against appropriating company resources for personal use.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by jimnotgym on Tuesday October 30, 2018 @08:01PM (#18342289)
Presumably there is a tax implication too? In the UK this would probably be a benefit-in-kind and taxed say it's market value as income.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by jjeaff on Wednesday October 31, 2018 @01:42AM (#18343589)
Yes. Same in the US. Things like private jet use are applied as income. However, I'm not sure you would have to do so at retail rates. For example, you would have to pay taxes on the cost of the private jet use. The marginal cost of something like running your personal ads on the favebook platform is so low as to probably not be considered "material" by the tax man.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by briandear on Tuesday October 30, 2018 @07:48PM (#18342220)
Considering he controls 60% of the company, such controls are meaningless.
Re:We posed as 100 Senators to run ads on Facebook. Facebook... by SilasX on Wednesday October 31, 2018 @12:03AM (#18343260)
The controls would be something agreee to as part of taking the company public or some stage of auditing.

Owning a controlling stake doesn’t mean you can fiddle around with every corporate asset at your whim.