Well, fuck that and fuck me, those people are not idiots, they're criminals.

Like, if someone treads dog poo into my house on their shoes, it doesn't really matter if they did it by mistake, or spent ages walking around town trying to find some dog poo to step in before coming to my house; the effect is that there is now dog poo on my carpet.

We need to be more dispassionate when discussing these issues because otherwise threads like this descend into analysis of whether Zuckerberg/Bezos/whoever is a moral person. Which is a)probably unknowable and b)besides the point.

There is a problem here with a very big company that has more power than it knows how to handle, which can probably only be mitigated by breaking it up. That's all there is to it, really.

[edit] Just as an addendum, that's not to say that if the company has done something illegal, the people responsible shouldn't be prosecuted- they should.

Likewise for big companies. If a company is acting badly, you need to figure out if it was intentional. In both cases you seek damages, but your approach to making sure it never happens again will be very different.

But the point is that this assumes you're able to tell the difference between the two cases- intent is often a really hard thing to prove. And often discussions about whether Facebook acted in good faith when it did certain things neglect the fact that they made a big mess everywhere, that needs sorting out regardless of their intent.

It is and yet the legal system is busy with these sorts of proves all the time. e.g. if you have a professional insurance and caused some damage by mistake - that's covered, if you cause damage deliberately - it's not.

I think this is basic good that regulations- thoughtful ones- serv. Because if Facebook makes money by being evil, then their competitors will be pressured to do the same in order to stay in business. But by leveling the playing field you can help prevent these monopolies from getting so big and powerful.

We can't rely on businesses to act "morally." That ship has sailed. We have to compel them to behave, not by social shaming but by making non-compliance painful and repeated non-compliance an existential threat.

That's like saying there's not a difference in involuntary manslaughter and murder.

There is. Intent is very important. That's WHY so many people focus on the intention.

The choice not to dedicate those resources up front was an intentional one.

If a company makes an "innocent" unintentional mistake, it can be attributed in part to their choosing not to put resources towards detecting and avoiding that kind of error

It's hardly an accident at that point anymore, but intentionally or (intentionally) carelessly done. That's where we are with Facebook I think.

There is a difference between empowerment ("Joe Public can't do much to change society") versus investing (literally putting money into local businesses, demanding better behavior, etc).

I have met a lot of my American peers who believe their individual liberty absolves them of responsibility to the society they live in, which is entirely opposite: their personal liberty is granted precisely because of the society they live in.

I disagree that it's likewise for big companies. Corporations like that don't really have intentions; every intention is fundamentally about profit. Profit is in fact both its intention as well as its reward/punishment.

It's really the only way to properly "communicate" with an entity like that. A corporation is not a human being. And just like it's not useful to try to reason with (or attribute human-like intention to) a cat, it's basically futile to do so with a corporation.

Any time that human-like reasoning seems to apply with a corporation, it really only happened because the reasoning happens to align with its profit intentions.

Edit: this is less true for smaller companies, but for a multinational it's pretty much a given.

Also, there's something in the way that large companies are structured, that actual accountability (like you'd find with humans or small groups) seems to disappear and slip between the gaps of hierarchy. Lacking accountability, attributing intent becomes guesswork.

Yes, but if someone treads dog poo into your house every day for a year, their repeated claims that it was a mistake every time are not going to carry as much weight. With FB we're not talking about a single incident of treading dog poo; we're talking about a repeated pattern of getting dog poo all over the place.

a woeful understatement, in my opinion; more like bulldozing manure into you and your neighbor's house.

Have to disagree with this; I am much more forgiving of accidental harm than intentional harm. And speaking of dogs, pretty sure my dog understands this as well, since there's barking if he thinks I did something on purpose but accidentally stepping on him doesn't elicit the same response.

Don't bend yourself out of shape. Actively, happily ignoring the evil you have caused and continue to cause is evil.

You can call Facebook a number of things from amoral to negligent or even criminal, but once you start talking about evilness you have to start judging their intentions and motives.

All of these things are no one's fault.

> Evil isn't about results. It is about intent and motive.

Exactly. Prioritizing profit at the cost of customers' well-being is a deliberate decision; if not, seeing that customers are harmed by your own, continued actions and doing nothing to change it is, to me, actively being evil. Your intent may not be exactly to harm, but you have no problem harming people to get there. There is no difference.

While I agree that it's useful to maintain some nuance in our perspectives, generally I think it's better to recognize and realign our actions, not definitions. It's the difference between accidentally hitting someone, and accidentally hitting someone and proceeding to run them over.

And to your example, I think we know most people aren't really aware of what is going on. Another group of people don't believe it at all, a combination of ignorance and poor government. We're all human; that means something.

Mark isn't trying to kill people. Mark _is_ evil, because he chooses to take actions that are likely to cause great harm.

No, but you would call it evil if someone repeatedly built rickety buildings in a hurricane zone or built structures out of dry wood and paper next to a forest at high risk for a forest fire, and then acted like they had no responsibility when the buildings repeatedly got destroyed by fires and hurricanes and people's personal property got lost forever or looted in the resulting disorder.

That's ridiculous, neither hurricanes nor fire possess free will. I bet you would call someone who intentionally starts those things evil, though

Unless you're an animist, I guess.

Trying to fit things into neat little boxes so you can apply words to them isn't particularly helpful. What Facebook is doing is some form of wrong. They aren't murdering children, but still, what they are doing is not good and they are doing it at a massive scale, so the harm is multiplied.

I think about this a lot with regard to Big Tech. For some companies it looks easy and obvious (e.g., Amazon spins off AWS). For Facebook is it really as obvious as "spin off Instagram"? I'm not really convinced of that. It seems like their power is so ingrained in Facebook itself that it's not immediately obvious what splicing off Instagram would do. What would we actually want to accomplish?

I suppose breaking off AWS might lower Amazon’s ability to subsidize an unprofitable retail business in search of market share, though that is probably a moot point now that Amazon is raising its prices in search of profitability and is likely to stop being the de facto online shopping destination now that other online retailers are also standardizing in two day shipping and easy returns (often easier due to providing return labels in the box).

My 9 year old son always rightfully claims that many of the harmful things he does was accidental. The problem is that he frequently leaves little margin for error in a lot of things he does. Follows his sister just a few feet behind his bike; of course your going to run into her if she stops quickly. Stacking your bowl, cup and silverware on your plate then bring it up one handed; of course they're going to spill.

Facebook's internal controls and practices are insufficient to manage their business. It doesn't matter if they didn't willfully intend to do all of the shit they did. They did intentionally create the controls, practices, and culture in place that allowed it to happen.

I think in most of these cases the intent should simply unleash an additional charge or penalty - leading to the imprisonment of executives.

If my company accidentally does something extremely stupid or negligent, or against the interests of my customers, fine me enough to ensure I create systems and oversight to attempt very hard not to.

If it turns out I was doing so intentionally, lock me up and throw away the key.

So, whether it's your own two year old or a malicious adult, you think it's wrong to respond differently because they both produced the same harm?

So, are you saying that the malicious adult poo-tracker is being childish and should be treated with the leniency we afford to children?

> I interpret parent poster as trying to make a point about how we cannot tell anything about intent so we should judge on the action, solely.

Why on Earth do you think we can't deduce someone's intent? In the case I posited, you can know the intent of both the child (no malicious intent) and the malicious poo-tracker (malicious intent). In many other cases, you can also deduce intent from someone's behavior.

No, I'm not saying that. Take it easy bro. Why you all angry and shit?

Facebook is perhaps not out of the ordinary really, it's just another of a variety of businesses who have come to realize they hate having users. They just need their data. Vampires don't want human friends either, they just need their blood.

My response to that quote is, to paraphrase Arthur C. Clarke: "Sufficiently advanced stupidity is indistinguishable from malice."

They can make money from contact lists, but IIUC the article said they didn't use the contact lists. Also, given that it only affected a couple million users (like 0.1% of their user base), the damage to their reputation would far outweigh any benefits of actually using those contact lists.

On the last item, the collection of email passwords, the only benefit would be if they actually use those passwords to get information, so the above point covers it.

Let me know if I'm missing something.

It's a bit like Exxon Valdez: they don't profit from spilling oil in the ocean, but they should still be penalized for cutting corners on safety.

In other words, Hanlon's Razer doesn't say that there is no such thing as malice just that you shouldn't default to assuming malice.

Some actions move into the criminal areas, like tricking users for passwords and phone number to then use that for other purposes to further their own agenda. That could indeed be seen as criminal I think.

And someone has to be held accountable.

I find that the people who use that quote are most often both.

People are realizing that social validation is becoming less validated by social media. (Lets remove the likes on IG!!). The people coming around now are sheep looking for the next wave of validation.

in logs.

This is the sort of thing that leads the HN crowd to sneer at the old, slow ways of the enterprise world.

What's to stop a malicious ex-lover from grabbing a FB password and reading that person's private messages? If FB didn't even know there were passwords in plaintext, they very likely weren't auditing log access as much as was needed.

[1] https://www.theverge.com/2019/3/21/18275837/facebook-plain-t...

I can't f'in believe I have to explicate such simple things to supposedly intelligent and thoughtful people

  create_user('Bob', 'BobPassword123')
  assert "BobPassword123" not in logfile

I don't think it's trivial to guarantee non-existence.

I disagree in this case. Log messages don't spontaneously appear in arbitrary places. If the developers understand what their software is doing and how their systems are configured then they should know where to check for the logging messages.

With billions of dollars and some the best software developers in the world (supposedly), Facebook should be able to figure this out.

That said, someone should have been watching for this stuff and failed to do so (or to exist), so I'm not excusing them - but this is not a trivial thing to protect against.

Subject: Change Request

Body: I would like to log the body of authentication requests in production.

Subject Re: Change Request

Body: How will you ensure personal data is not stored that shouldn't be?

Subject: Re: Re: Change Request

Body: I will add configuration Y to logging system X.

Reviewer: Does this have privacy implications?

Change1: No, Service X marks all PII before this point. Code X drops everything marked in this way.

Two years later.

Change N: Modify request structure for more optimal blah blah blah.

Now suddenly the changed request structure causes a regression in the PII detection which causes some logging of PII.

This shit is way more complex than "just stop people when they ask to log passwords".

You assert that it's trivial, yet you're adding more layers to protect against something like that from happening. It's the naivety that all problems are trivial is what gets people and companies into trouble in the first place

What if there is a bug and some other function logs "[...]word123"?

Of course we (and they) should do it anyway, but it does often take an investment in making things testable.

I think it would be way worse if we found out they were storing passwords were plaintext in the database in 2019. Even if the security implications are the same/worse, the policy/decision making of such a revelation would be beyond terrible.

edit: To put it another way, remote code execution flaws are terrible but they can happen. However it would be way worse if someone put in a static username/password backdoor. The security outcome may be the same but one is beyond terrible policy/decision making.

If Facebook devops engineers, who are probably among the best trained and highest paid on the planet, lack the same common sense for their users passwords... I can't even come up with an ending to this sentence that would properly express my emotions right now.

Sorry, but it is like saying "there is no SQL injection, only bad input validation".

... for seven years.

If they wanted to show proper contrition, they'd not only delete that information from their systems, they'd also remove all links in the social graphs that can be in any way a result of that information. They'd also take 100% of their revenue that was even slightly influenced/generated by the inappropriately gather data and send it out to the users whose data was copied without permission.

Also they should probably put together a legal team who will be ready to start handling the $150,000 per copied item that they didn't have the right to copy. :lol

https://www.linkedin.com/help/linkedin/answer/5204/email-pas...

> If your email provider doesn't support OAuth, you'll need to enter your email password before clicking Continue. LinkedIn will use your password only for a moment to authenticate your account. We don't store or save your email password during this process.

Facebook’s feature was similar I believe. Where they stumbled was connecting an email verification feature to the code written almost a decade ago for contact import.

Shutting down these options, even if it is the right things to do for the users, is effectively increasing the barriers of entry and reducing the growing speed of new companies. The result is that those companies will maintain a dominant position on the market.

What kind of a profile of me would they be able to glean from email? Whole thing feels so fucking invasive.

>> “When we looked into the steps people were going through to verify their accounts we found that in some cases people’s email contacts were also unintentionally uploaded to Facebook when they created their account,”

Im struggling with the "unintentionally" part and to play devils advocate trying to figure out if it could be possible. Perhaps they had a service already that performed the login to upload peoples contacts on request and to save time reused this service to also verify the account?

You're under the impression that regulators are in the business of bankrupting companies.

All the instances you cited of Facebook's wrongdoing are not worth a $50billion(!!) fine. They just aren't.

[I meant this as a serious observation, linkedin was sued but I believe they only got a mild slap on the wrist]

On the contrary, I think we need to keep repeating it. Everything I know about Zuckerberg, everything he says, the lies he tells, his actions and the actions of his company...they all lead me to one conclusion; that that particular quote is the deepest insight we have into the mind of Mark Zuckerberg, and we should never forget it.

Judge him by his actions, not his PR.