Easy.

The engineers who built it care mostly about their total compensation and getting promoted. They therefore gleefully implement the product requirements.

The PMs behind the idea also care about the above, except they are held to account by business objectives. By narrowly optimizing for a particular objective (reducing account fraud) in an unprincipled manner, they come up with an insane feature idea like this.

The lowly L3 engineer fresh out of college understands how crazy this is and speaks up, but is hammered down by the culture. The decision is quite literally above their pay grade. They begrudgingly fall in line as they have the most to lose in this situation.

Finally a story like this breaks and upper management realizes the contradiction with the narrative that they're trying to create - that Facebook really does care about your privacy. The whole project gets scrapped, and by the time it's all said and done, over $1M is wasted.

Welcome to life at a big tech company.

I find it fascinating how big tech companies are intent on spending enormous sums of money seeking out the top tech talent in the world. Then rather than listen to them when they voice concerns they try to beat them down into submission. I get that if you worked at a company whose core mission is evil that you just have to accept that when you sign up, but there's no reason facebook needs to be make these active moral choices to pursue things in the worst possible way and yet they consistently do.

I think you misunderstand the real purpose of these major companies fighting to hire as much talent as possible. Anyone in the Bay Area that cannot afford FAANG total comp knows how hard it is to hire top engineering talent. This is the end goal of these companies hiring policies: to remove talent from the market.

Before these companies where FAANG most of them were small, crazy startups that were able to easily acquire talent because tech was pretty boring at the time. You could pay market rates, but give someone an exciting project and they'd join you. That allowed all of these companies to completely disrupt the market. Having disrupted the market they are no longer interested in this happening again.

The current hiring practices are to basically drain talent from the startup pool. Paying an engineer 500k is much cheaper than acquiring the new darling startup they ended up creating (DeepMind), which is much cheaper than acquiring the now large company that is threatening you (instagram), which is still much cheaper than allowing existential threats to you to eventually IPO.

There's the added benefit that you now have a bunch of great engineers on your team, but this isn't the real purpose. The tech giants of the past, IBM, Oracle etc all failed to realize how important it was not only to have good engineers, but to also remove great engineers from the market.

It is an authoritarian mentality fundamentally of "social order" - that they are beneath them so it is the "proper order" to obey. Above profitability even. You can see that bit of outright sadism with retail in particular but the pathology exists elsewhere. Rivals of Costco are angry with them for paying their employees more to get better motivated ones and less shrinkage - when if they think it is a waste of money be happy about it. Instead irrational rage because they transgress their precious social order.

It is part of the norm but the norm is horrifying and stupid yet you are the crazy one for suggesting something different like actually listening to the people you pay to think.

> Rivals of Costco are angry with them for paying their employees more to get better motivated ones and less shrinkage - when if they think it is a waste of money be happy about it

Do you have a citation for this claim?

I don't have a citation, but I have read repeatedly that stock analysts cite "overpaying" their workers as a place where they could cut costs and boost short term profits.

Stock analysts is not the same thing as rivals, though. If people think it's needlessly costly, competitors would cheer because their competitor is pricing themselves out of the market. As for stock analysts, if it turns out Costco gets more efficiency out of their better-paid employees because they're better, more motivated and less likely to leave, then that will eventually reflect in profits and stock price.

Amazon is know for a large capital investment and their stock has gone up even though they could cut costs and increase their margins.

Capital investment != labor costs

That's exactly why they spend that much money. They know you can be submitted. They want tech talent. Not revolutionists. It's a rough world out there and it's better to get in line than lose your pot of gold.

Doesn't make it right at all. But if you were that engineer, it's easier to say to yourself that you'll work your way up and change things the day you are in charge.

It's not revolutionary to say that asking for user passwords is stupid and dangerous. Nothing good will come from giving your email account password to Facebook (or any company). It's also a basic human rights violation. We all have a right to our passwords. We do not have to share them with organizations seeking to exploit us and our information. It's just basic common sense, not revolutionary.

> Nothing good will come from giving your email account password to Facebook (or any company).

To clarify: nothing good for you. Ignoring ethical issues, Facebook certainly benefits.

It's "revolutionary" to try and defy your bosses who tell you what code to write. Get back to your keyboard, serf.

When someone still works for such a company after an announcement this, they are part of the problem!

There's a book about the process by which this happens: https://www.goodreads.com/book/show/558867.Disciplined_Minds

> Many professionals set out to make a contribution to society and add meaning to their lives. Yet our system of professional education and employment abusively inculcates an acceptance of politically subordinate roles in which professionals typically do not make a significant difference.

Companies are not democracies. Is it a contradiction that we both praise democracy and spend our working time in dictatorships? Probably but we usually don't even notice it.

I feel like you may share the same interest I have in this crazy giant federation of worker cooperatives (mondragon). I'm curious of many things in regards to it.

https://en.m.wikipedia.org/wiki/Mondragon_Corporation

I think large corporations are a threat to both democracy and to capitalism. Excessive concentrations of wealth and power are dangerous. Clearly they can be leveraged for money and power, which is why they exist, but we might be better off with smaller scale enterprises and more equal co-operations.

This is such an astute observation, yet remarkably simple.

I'd never stopped to think about it, but I think the world would be a much better place if more people did.

The book Moral Mazes also deals with this topic.

It is kinda funny when you tell their headhunters you will never work for them because they don't meet your ethical standards. I highly recommend the experience.

I told them a couple days ago that my belief in privacy as a fundamental right would make me a bad culture fit. They didn't reply.

Now you got me curious. Was the response ... a bit unethical ?

We're they confused, angry or both?

Confused at first, and then eager to get off the phone.

Steve Jobs understood the problem.

https://youtu.be/fuZ6ypueK8M

I was looking for the Steve Jobs quote in this thread, thought this was going to be "It doesn't make sense to hire smart people and tell them what to do; we hire smart people so they can tell us what to do."

Yeah, if there's one thing Steve Jobs is known for, it's listening to other opinions.

Ain't that the truth, but he said so at least the once, and now I guess that's how we remember him!

Much more succinct message. Thanks.

> enormous sums of money seeking out the top tech talent

Still less than what they spend on management.

Part of getting all the top talent is that you can deny it to potential competitors.

Top tech talent generally have no idea how businesses make money. So of course you’d ignore them.

Where's the greater RoI in this case, what shady shit were they doing once they gained access to users email passwords??

Realistically, probably just logging into the email account once to prove ownership. Not dissimilar to how LDAP authentication works.

Is it a worst practice in our industry right now? Yep. Is it nefariously evil, probably not.

The industry standard appears to be "click on a link in an email", I think that's what FB did for me. So the question still remains what the RoI is that makes getting users passwords better. The only answers I can give are very bad, I can't see a legitimate reason to change to do it that way.

I'm not even sure if that is even true about mediocre tech talent, most people have some inkling of how their company makes money or at least how it intends to (some startups may obfuscate this information however, or not actually know).

Tech talent of all sorts generally don't know how the business manages money and what rules might apply to that management however.

on edit: added even, removed extra letter at end.

This.

I studied Electrical Engineering and in my experience, the only thing my classmates cared about was the technical aspects of the field, and often they couldn't see the big picture. Great talents of course, but more like robots, not even capable of understanding the humanitarian aspects of life. Such a waste.

Disclaimer: It's just my experience, not necessarily true for all engineers and engineering schools.

That's one part of it, I'm sure. Another part is that if you pipe up, you risk getting shunned: loss of income, loss of status, loss of being "part of the cool kids". Sure, you can get another job (that pays less) but you'll probably not work at the same cutting edge technology, and when you tell relatives or friends who you work for, their eyes don't light up.

If somebody offered me five to eight times as much as I make today with a huge boost in status and other positive side effects, and all they ask is to quiet down those silly principles, I'm not so sure I'd say no. "You can still do good in 5 years when you've made enough money to be set for life", I'd probably tell myself.

<quote>If somebody offered me five to eight times as much as I make today with a huge boost in status and other positive side effects, and all they ask is to quiet down those silly principles, I'm not so sure I'd say no. "You can still do good in 5 years when you've made enough money to be set for life", I'd probably tell myself. </quote>

The worst thing is, sticking to those principles just means someone else will take the job.

Coming out of university, I had one job offer (it was a bad down market at the time). My principles made me say no. I didn't want to work on guidance systems for military applications, thank you very much. That choice has cost me a great deal in earning potential. Even so, I would find it hard to blame someone for compromising their principles.

Did they not pay any attention during the humanities portion of their education? That's part of why it's there.

Disclaimers: I'm not an engineer, but my CS degree is ABET accredited. I also took a few more Archaeology, Cog Sci, and Philosophy classes than strictly necessary.

Another personal data point.

When I was in college I did have to take philosophy 101. It and all of the other core classes such as biology and English were nothing more than annoying hurdles. I do enjoy learning about philosophy and such, but that is not at all what happened while I was trying to get my degree.

Though to be totally honest, to a large extent I considered the entire degree earning process to be little more than an about hurdle to entering the job market. I spent practically zero time reflecting in any of it during the process.

Personal data point:

Did a Bachelor's + Master's degree in CS in Europe. Only around 5% of my coursework had (and could!) be outside CS. And you could fill that with things like Game Theory 102 or Copyright Law 101 or something without issue.

That's more like the typical engineering school format. I went to a Liberal Arts university, nearly half my classes were general humanities and sciences. The rest were in my major (also required an additional 18-21 credits for the ABET accredited degree option).

This makes sense, as you get your broad education before university. School focusses on a well-rounded education, whereas universities let you specialise. I realise this is a bit of a contrast to the US education system, with majors and minors, etc.

I partially agree with you. When I used to work at one of the big five, PMs for my team would regularly disregard the engineers' output on most matters (apart from occasionally letting us make purely technical decisions). This, of course, ultimately led to almost the entire team leaving, including me, and the rest transferring internally. It's not all the engineers' fault. One can push back as much as one wants, but it rarely changes anything at all. However the PMs' success is measured based on delivered features and projects. In most big enterprises the engineers are just worker bees, for the queen PM bee and if they don't perform or don't want to do something, they can be somewhat easily replaced with someone who will. And don't forget that a lot of the engineers might be on a working visa, for example. And why would they jeopardize their job and their way of life on moral grounds, instead of keeping their head down and just going through the motions. I'm not saying that I agree with them, but putting all engineers in the same basket seems unfair. Now that's why realistically it is much rarer for a group of engineers to take a stance than you'd think. This is why cases like the Google engineers who refused to work on military contracts got so much attention. As inspiring and empowering as it might seem, in reality it (almost) never happens.

Your summary hits the nail on the head.

But you forgot the most important thing: What happens once upper management reads an article like this and realizes they f*cked up badly again?

Yes, more of the same hierarchy, compensation, promotions, and "culture".

Welcome to "efficient" big corporate hierarchies.

I mostly agree but don’t underestimate the effect that drinking the kool-aid can have on your ability to tell if something is wrong or not.

I’ve worked in these megacorps and I understand how easy is to believe everything they do is awesome.

“We’re just doing it to make it easier for our users” or “we’re Facebook, we know how to securely handle their passwords”

It’s very easy to _believe_ these things when you’re in the inside being showered with money and being told how amazing you are all the time.

But frankly, when you think about it, the only amazing thing about FB is how it got popular, that's all. As for the user experience it's very far from amazing, in spite of all the tech used. It's slow, and on mobile not only slow but also resource hungry, it has several glitches, plus there is a ton of things that annoy users.

Now, I can understands that someone working for SpaceX can think they're all amazing, but if you work for FB? It's like working for MS in late 90s - maybe good for you cash-wise, and that's pretty much it.

It's sad, because Facebook wasn't like that when it started out.

It was clean and light and fast, unlike MySpace which was often described as a messy, bloated pig.

React and other JS projects gave them a largely positive reputation as tech employer in that field.

Not really as an engineer who had been in similar problem.

It's not that I am programmed to keep my head down and focus on technical stuff only and that I don't see the big picture and externalities of our actions.

Having a technical degree instead of humanity or philosophy doesn't make you less ethical. I'd bet a broke and uneducated person can be more ethical than me despite not having the technical education I possess.

I can see the ethical problems but when I raised them to the management.

Management acted like my friend and told me, look pal, there are many people in the world and we can't just think for everyone. You need to care about yourself and your family and we care about you. This is our group and we only care how much our group prospers (read: makes money) and we don't care about outsiders.

It's ingroup and outgroup politics here and it's much easier to sympathize with the people who are in front of you acting desperate to make money than those who you'll never see.

Then they bring their legal team, who assure me that this plan is completely legal, so we will not run into any problems!

Have you ever seen Wolf of Wall Street? It's much similar to that, we live in bubble where it's okay to do those things and no one around us judges us for that, so we feel safe and secure.

There is no one telling me that I am doing something unethical.

If you want to study this problem then go back to history and see how much unfair the world was and people who had it easy were pretty okay with all that.

I can choose to leave this job but it basically means being stripped of your status, income and group (which took years of hard work) and even then someone else will right? And I can move up the chain, some day I might do ethical work, system can only be changed from the top, right? It's easy to justify your actions to yourself this way and stay at the place.

In my country there was a joke running about the communist establishment. It went like this:

You can't? We'll help you!

You don't know how to? We'll teach you!

You don't want to? We'll force you!

I guess these companies work pretty much like totalitarian regimes but at least you can quit without being shot.

This is why control > salary for me. I would much rather (and do) work at a smaller company making less money, but where I have real input in the company itself.

We routinely have clients ask for more tracking data on users and we explain/teach why it is a bad idea. In some way these FB stories help me, because I can point to these articles and ask 'do you want to end up associated with this?'

That's great when you have the ability to forego potential salary.

It's also why manufactured scarcity (especially in housing) enables people who wish to apply engineering effort in unethical ways.

If 10 engineers are bidding on 5 houses, the 5 highest-paid ones will get it. Any pay raise they get will get dumped in to their house - give them all 100k raises and the house will go up by whatever another 100k a year in mortgage payments gets you (I simplify, but not that much)

Not only that, those 5 highly-paid engineers who got the houses have every incentive to make it illegal to build more.

It's hard to stick to your principles when it means getting kicked out of your home, pulling your kids out of school, your spouse having to move away from their job, etc.

It's not just housing, of course, it's a huge part of it. The engineer with a $750 a month mortgage will have a MUCH easier time saying "fuck off this is evil" than one with a $7500 a month mortgage.

First, no one is talking about getting paid incredibly less (especially if you factor in COLA). It's more generally about not maximizing for only salary. Second, unless you want to work in one of the big companies, why work where it is only engineers bidding on houses? Engineers have the luxury right now of taking less pay and still making much more than a large majority of the population.

He's describing, hyperbolically but not wholly inaccurately, the Bay Area housing market.

> Welcome to life at a big tech company.

Most of this is, as you've correctly spelled out, just due to perverse incentives, and there's not really any intentional malfeasance. The REAL problems start when you get a neurotic psychopath with a modicum of power, and an agenda to climb the ladder, who pushes through ideas they KNOW are bad for the company, as a whole, in the long run, but do so anyway because they know it will help their career in the short run. I've been powerless to try to stop this from happening at two Fortune 250's.

> there's not really any intentional malfeasance

I would argue that the people at the top making these decisions are not ignorant about what is going on.

The finance industry gets (often rightfully) vilified for having flexible morals and reckless profit seeking, but this is not something unique to finance. Finance was traditionally the environment that enabled this sort of behavior, but the root cause is that fundamental human behavior is still fairly reptilian in nature.

As technologists we like to think that we are above this behavior, but we are not. All it takes is someone to wave enough dollar bills in front of our eyes and we'll mostly justify our actions with a mixture of whataboutism and by saying "I'm just a lowly cog in the machine".

I'm seeing a great many parallels in the short term predatory and risky behavior in the financial machinations of the past and the behavior of tech firms including FAANG today. Even with the best intentions, the system eventually evolves to a point where the show is being run by fundamentally the same sort of people in both industries. Perhaps it is because it is these sort of people who strive in a cut-throat corporate environment that is itself in a cut-throat capitalist environment.

I'm not saying this as some sort of hard line leftist either - hell, I work in systematic trading so I'm as much part of the system as one can be. Yeah sure, I should hold true to my morals, but what about all the others who are willing to replace me at a moments notice? I'm just a cog in the machine, my action will not make an ounce of difference and only cause hardship for myself.

Oh the irony!

I agree partially. First of, I don't think the finance industry gets vilified for having flexible morals, they attract hate for having no morals at all.

Certainly, you're right that we depend on each one to say "no, I won't do that", but I feel like there's a difference in quality: evil intent vs willful ignorance/negligence. There might be borderline illegal tax-dodging with large tech companies, there might be irresponsible data security, but there's not a lot that is comparable to the cum-ex-trades that large banks engaged in: no active defrauding of the government and/or citizens. Granted, it may happen once tech corporations have as strong a grip on governments as banks do, and feel secure enough that they won't have to face repercussions if it blows up.

Plenty of banks, and not just the large, global ones have actively engaged in tricking their customers by selling them junk and hiding and/or downplaying important details to get their sales provision, and it wasn't something that was "only known at the top". I've yet to hear of scandals of a similar magnitude in tech. Chrome doesn't contain any hidden crypto-miner, and if it ever will, I doubt that an investigation would reveal everybody on the team knew about it - it would likely just reveal a security breach or a small amount of people subverting the processes.

I do completely agree that tech isn't all sunshine, however. Behind pretty much every large scale data leak is an engineer that said "well okay if you want me to put this database server on the public internet and remove the password, I'm happy to do it" instead of refusing, and behind every horrible overreach in surveillance is an engineer that just blocks out the impact his work has on real people. There are people working on killer drones after all, and I don't think any of them are naive enough to believe that "they only target the bad guys".

> Certainly, you're right that we depend on each one to say "no, I won't do that", but I feel like there's a difference in quality: evil intent vs willful ignorance/negligence.

Oh so you are saying that the willful and deliberate exploitation of people's private data, the willful and deliberate ignorance of laws by companies like Uber, the willful and deliberate "research" done by tech companies to determine the most addictive products to entice people to buy in and stay on particular platforms, the willful and deliberate exploitation of minors by tech companies to get them to spend their parent's money on whatever stupid game or product is the fad of the week, or the fact that there are tech companies running targeted campaigns to influence voter opinion based on stolen private data is all just ignorance/negligence?

I strongly disagree. There is just as much rotten in tech as is in finance, the only difference is that many of the shenanigans enabled by tech have not been outlawed yet. Borderline illegal tax-dodging by large tech companies is business as usual compared to the other crap that they do, but being disruptive and breaking things is hip and cool, and it's Us doing it, and not Them, so we let it slide.

You say that banks are willfully selling junk to customers, and this is true. But this is exactly the whataboutism I was talking about. Tech companies mining people's most private data to get them to buy stuff they don't need is just as insidious, if not more in my book.

I don't see Facebook openly admitting to their users that every single bit of their and their loved one's lives will be exploited to the max to allow thirds parties to influence their opinions based on the wishes of the highest bidder.

I don't see them warning their users that right now they are (maybe) not being profiled by governments for thought crimes, but the data is all there, so if in 10, 20 or 50 years time the government changes, this is a definite and very real risk.

No, I'm not saying that at all. There are _some_ companies that run targeted campaigns to influence elections, sure, but they are a tiny minority in the world of tech. I don't like Uber's business tactics either, but I don't see them as the face of the tech industry - in fact, I don't really see them as a tech company. Count everybody who's main source of income is driving for Uber as an employee and the percentage of employees working tech roles is pretty small. Many large companies (including banks) have more and more complicated tech than Uber.

Again, let me make that clear: I'm not arguing that every company in the tech industry is staffed by angels, but that intentional bad actors in tech are the exception, not the norm.

> Borderline illegal tax-dodging by large tech companies is business as usual

And I haven't said it wasn't, I've merely compared it with what the largest banks have been involved recently. I don't know if it got worldwide coverage - this is what I was referencing: https://en.wikipedia.org/wiki/CumEx-Files

> I don't see them warning their users that right now they are (maybe) not being profiled by governments for thought crimes, but the data is all there, so if in 10, 20 or 50 years time the government changes, this is a definite and very real risk.

And I'd love for them to be legally required to explain privacy considerations to their users in such a way that informed consent can be given. Again: I'm not "pro big tech", I'm saying that big tech still has some room if they want to rub shoulders with big finance when it comes to amoral business practices. Big tech operates in a grey area, big finance hasn't seen anything but #000 in decades.

> Again, let me make that clear: I'm not arguing that every company in the tech industry is staffed by angels, but that intentional bad actors in tech are the exception, not the norm.

Just to be completely clear, are you arguing that the opposite is true in finance - i.e., that the norm is to be intentionally malicious?

I'm much closer to that position than the opposite.

This doesn't go for day to day interactions between you and a bank clerk, but rather for product development, sales etc. Fortunately, the industry is much more heavily regulated that the tech industry.

And in finance, they've developed entire management wings called "compliance" to watch over things and make sure that laws are not broken/the firm is not put at risk. I wonder if that will happen here (there is a distinctly smaller set of laws that can be broken, but Zuck apparently is asking for that now...)

Is it possible the private sector (free market) is not as infallible as I was lead to believe?

This story you wrote seems like something that happened a couple of years ago at Lenovo.

Facebook's would most probably not call it off. Or just resurface the same thing at another time with another name or excuse.

true, apart from I would expect this to go from growth team (making signup as friction less as possible), not from anti-fraud team.

This. You nailed it

People with any sense of ethics don't work at Facebook.

Maybe, but that's very counter-productive actually. If you want to do ethical stuff FB is a perfect place to try to influence what happens.

Unless you have been doing deeply corrupt work for them for years you are not going to be making any change at that megacorp. I know someone who worked there and they just remove anyone who does not conform.

Changing them can be done with market forces and political will from the outside and through participation on the discussions on the inside.

Probably all approaches are needed.

I'm simply stating, that if no one is on the inside, then we're missing out on a possible interaction channel that could help changing FB.

At the same time, you help Facebook do what it currently does, i.e. unethical stuff. I dont think an individual engineers ability to influence a company they dont own outweighs their contributions.

Not necessarily. You don't have to lie during the recruitment/interview. If you get in you get in. And you can resign when they ask you to do something you feel you should not participate in.

Simply trying to get in to be on the inside - without lying, is better than not even trying.

Of course, trying to advocate for better political control (privacy, transparency, lower barriers to enter the market) is important, and can and should be done while trying to engage with FB, trying to get close to their internal decision making process.

And, naturally, not everyone has the affinity to work at FB, but since it's a spectrum, likely there are a lot of software engineers that do have some ethical concern with regards to what and how FB does, and they shouldn't be discouraged from working at FB, but they should be very much empowered to be able to stand up and leave when their moral compass signals.

Eh I don't think that holds universally - and even when it does is an inversion of responsibility. A small mutual protection street gang maybe could work for with resources but one doesn't make a vicious gang like the Cartels nicer by joining them and trying to reform them from the inside.

Okay, it might not hold, that it's the best place to try to exert change, but it's undeniably a channel of interaction. Not exploiting it leads to less change.

I would love to take a peak into the meeting where they formulated this idea.

With all the shit being fired at Facebook from all directions these days, I just want to see the faces and reactions of those who thought "Yep, that's a good idea!" when this concept was originally brought up. It's really stretching my curiosity and imagination to the point where I start wondering what type of people they are hiring at Facebook these days.

Is there a name for this phenomenal in psychology where one would insist on doing the exact same things other people are criticizing them, but with an increasingly higher intensity the more they get criticized for it? This is exactly what it is.

Perhaps they are being eaten headfirst. Each bite leaves them a little less scrupulous and a little dummerer

LinkedIn has been doing this for years. It's the reason why I don't use it (and the spam they send is the reason why everybody hates them).

LinkedIn asks for email passwords? I knew they encouraged uploading your contacts, but didn't realize they wanted your email too. Guess I shouldn't be surprised. If their's any major social media platform less ethical than Facebook it's probably LinkedIn.

You mean emails? I've managed to turn them all off; if that doesn't work, you can file a complaint with the EU who have strict laws against e-mail spam, and the requirement to unsubscribe with as few actions as possible.

Yeah i've managed to stop all emails with my active LI account, they do occasionally add stuff that triggers them again so I just go into the settings and they're gone.

LI are awful for many reasons, but they do honour these things.

Where can I file these complaints? I have looked for this before, but wasn’t able to find out

IANAL, but usually you file a complaint with your national regulator, so it would depend on your country (of residence, I guess).

Yeah, I'm not seeing where all this moral indignation is suddenly coming from. Asking for email passwords has been a staple for social networks since the beginning.

I worked at FB briefly so maybe I can explain. FB has a corporate culture that really discourages critique. When things are broken, especially internal things, people look at you funny if you speak up about it. A big part of that is that quarterly bonuses are given for "making an impact" and your group's status (and part of your bonus) is based on delivering a consistent set of "impacts" over time. So it is better for your comp to do things badly really fast since you get (1) did something super fast! and (2) get to record a big impact a few months later when you fix the obvious brokenness.

Pretty quickly, people learn to keep their mouth shut.

Also, many, many FB engineers are early-career folk who are fresh out of school. More senior folk are few and far between and are even more strongly incentivized to keep their mouth shut, because their bonuses are bigger.

Yesterday, this same rationale came up with why Google keeps launching new products and then abandoning them over and over and over.

I guess this is what happens when a startup gets big. They keep all the toxic baggage of startup culture (edit: "move fast and break things") while gaining the impact on people's lives that big companies have.

I think Apple is the only one of the FAANG that's jettisoned startup culture, and I think that's why they're doing so incredibly well.

Facebook also asked users in Australia for their naked photos. This isn't even the weirdest privacy invading request that they've had recently. This is business as usual.

https://www.irishnews.com/magazine/technology/2017/11/08/new...

There was also probably some "Well, financial sites/tax softwares do it and they have much higher security requirements than we do!".

Let's not underestimate the power of precedents: someone else said it was crazy at ANOTHER COMPANY, didn't get their idea through, and now other companies are copying it.

Additionally, a lot of people in the comments mentioned how engineers are ignored. Being able to convince your peers (like a product manager) of something is a skill, one that is fairly uncommon among "top tech talent", but happens to be a minimum requirement for roles like PMs. Saying "We can't do that, it's crazy!" and expecting everyone to just agree with you because you're awesome at coding just isn't going to cut it. Yeah, maybe the PM should have realized it was insane on their own. But let's consider that given hundreds or thousands of people in a company, crazy ideas might get deflected thousands of times, but it only take one "failure" for it to slip in.

> and people at a higher level thinking "well we're doing this in a secure way"

I have never had a higher level person worrying at all about security except as a nuisance when prodded.

I have seen security worried about but even then it is often ironically misaimed like attempted DRM or bad password policies.

I was once in a conflict with a bunch of people at a larger e-commerce tech company because I railed against the practices and requirements of one of the stupidest projects that I was pushed into. The 'wisest' amongst the group, justifying his subservience, stated as an argument: 'they debate, they decide, we deliver'. I felt a visceral sense of disgust at hearing that and never spoke to this person again. He is doing quite well slithering up the corporate ladder, last I heard. The stupid project in question cost the company millions and died a well deserved whimpering death within a few months.

That's why they prefer young people? Yep, they could be smart like anyone else, but they also care/need more about money for obvious reasons and in the long run they tend to fall in line more easily.

Move fast and break things!

Preferably other peoples things!

"If it's good enough for immigration, it's good enough for account setup. Isn't facebook something like a nation?"

Maybe they hired someone who worked at border controls?

It was probably A/B tested and yielded the highest conversion rate.

Developers did it for whatever reason.

Ignoring their recent fail at logging passwords.

It has been established as minimal practice, that NO ONE should be asking you about your password. If this would become a normal, it would also make regular people more likely to give out their passwords.

And email is key to your online kingdom, so it's a big deal, if it gets compromised.

At the very least, your mail client has to ask you for your email password. Might sound like I'm splitting hairs but I don't think most users have a strong sense of why that's different from Facebook doing it. And with wizzy online features crammed into more and more desktop software (seen Photoshop lately?) you can't really fault them for it.

Your mail client isn't a company, that's not the same.

You're right that the wording is important, and we do a bad job explaining what passwords actually mean, and how to treat them. A simpler analogy: Don't give your house keys to strangers, McDonald's has no business asking you for your keys to confirm your order.

I don't think users need to understand why, they just need to understand what to do / not to do. I've taught my mother to never give anybody her passwords, not even me, and if anyone asks her for her password to call me. She's mildly annoyed when I'm helping her with something and I tell her to please input her password, but she's gotten used to it. Did it work? It did. The representatives for a car sharing company were poorly trained and asked her to write her email and her password into a form. She refused, walked out and called me because she was worried that they were trying to get into her bank account. Turns out they wanted her to choose a password for their service, and were just very bad at wording it (and had the terrible idea to have customers hand-write it into a form and let somebody transcribe it into the computer system) and the guys working in the office had only been handed a script, they didn't actually know what information they were supposed to get. I'm certain that they accidentally harvested a good number of valid email/password combinations since it's a leading company that is owned by a major car manufacturer and has a good reputation.

Especially when most users are probably using the same password for both, or are just warming up to the concept that you shouldn’t do that.

This is security by "no one should be asking for your password". The responsibility is with the user and they need to be taught "you must not disclose your password to just anyone who asks for it".

And having well-known entities ask for people's passwords normalizes such behavior and teaches users that this is normal and OK to do.

Does it really? It is wrong and the users need to know it.

Yeah, thanks facebook for doing all the wrong things so that users can have a clear example of what is wrong! (only half joking)

And how is Facebook explaining to users what they need to know?

Because most people need to be protected against themselves; a lot of people, even tech savvy ones, only find out later that their data has been stolen or their privacy breached.

I mean a random but common example is stolen credit card details. Out of automatism most people will fill those in when they're ordering something, without wondering whether the site is secure. And usually they are secure enough at the time of writing, only a few years down the line someone dumps them onto a public S3 bucket by accident. Whoops. If the system was secure by default - that is, CC data never passing to the webshop - that would be a preventable occasion.

Email in this case is the same - don't give FB access to your emails in the first place and they'll never be able to "accidentally" read all your emails.

The user that found this and is cited in OP's article mentions there was no alternative to giving Facebook your password: https://twitter.com/originalesushi/status/111249895877604966...

Could the alternative be gasp not using facebook?

people don't register on facebook to check out this cool new social network, it's bee quite while since FB was cool. But imagine a situation of great social pressure, like your kindergarten parent group is communicating there

You know, when I moved from one country to another I've seen directly how a global action is better than dealing with those things as individual and wearing spikes 24/7 everywhere.