From my PoV, for my purposes, as a technically minded user I might agree.
But thinking about the numpty-on-the-street, this could be a privacy nightmare with people being easily conned into allowing a random application full unrestricted access to slurp their data. This can happen already, of course, but the provider could detect a remote API scraper and try to block it, and a user-local malware scanner can be trained spot a rogue browser extension that scrapes the UI, but if API access like that is mandated they'll have to provide the access and won't be able to tell the difference between that which the user requested and that which the user was conned into requesting.
Building Code for websites is something I would be willing to support, e.g. no plain-text password storage allowed.
User must rotate their password every 7 days or be locked out pending in-person approval. The software must enforce this restriction while allowing a two-hour grace period on days when daylight savings changes.
You: this is retarded and anti-security.
Them: the lawyers are on their way. Stay put.
I recently renovated a 1950s building, among other things I designed and wired a fire alarm system from scratch, and passed inspection on first attempt. The building code gave very valuable pointers: what kind of cables should I use, how zones should be wired, how many sensors I should have, how they should be placed, how long backup batteries should last, etc.
Some areas are okay. Others are not. The issue is not so much building codes, although there are definitely codes that e.g. push specific products from specific vendors and other shenanigans, but the approval process that gives the local authority unlimited time to mess with you for any reason.
There is, I think, a single US state that puts reasonable limits on project authorization, but I can't remember which it is.
All in all, doing anything with real property opens you up to just having your money taken by the government and lawyers while accomplishing nothing.
(It used to be possible, but they removed that API after Cambridge Analytica.)
I mean, there are obviously responsibilities that naturally come with having delegated that access. And word will get around. The first GDPR violations because some user delegated access to their account and the entity that was authorized slurped up all of that user's contacts' personally identifiable data without the contacts being notified, will undoubtedly set the tone. That's still likely a GDPR violation. This doesn't change any of that. The only thing that changes is that the consequences for the GDPR violations now fall on the entity that was authorized, or maybe on the user who authorized the entity? (Not sure which?) But it obviously would not fall on Twitter since it is only complying with the law.
It's important that legal and criminal liability is matched to authorization or delegation. In practice, it will be the threat of legal liability that ensures data security and data privacy, so that needs to follow delegation to ensure incentives are always aligned properly.
I don’t think that was the point of what the parent commenter was saying.
As I read it, they were talking not about liability but the likely negative side effect of having more people be conned out of their private data that will then be abused.
Who is liable is a secondary concern. The main problem is the fact that people’s private data end up in the wrong hands.
IMO we should first and foremost be advocating for the right to have our data destroyed.
Intellectual property is no different than any other sort of property. The right to own property is invaluable, and serves the purpose of maximizing freedoms in the long run.
I am sure that some here would agree with that. I personally do not.
> Intellectual property is no different than any other sort of property
This is a very extreme view. You are basically saying that specific numbers can be owned by someone.
> and serves the purpose of maximizing freedoms in the long run
I can't see how this is the case, at least as long as intellectual property is concerned.
The same for knowledge would involve lobotomies.
Would you please hold still for a moment?
Is this rhetorical or literal?
This is a "take what we can get" type of step.
Not just third parties, but themselves (aka, write/use your own client for messenger/discord/...). This is the only way to get rid of having to use dozens of clients for various networks (apart from total standardization and federation which isn't happening anytime soon)
I love it.
This would be easily achieved with ActivityPub [0].
>> The bill would require communications platforms with more than 100 million monthly active members [...] to allow its users to easily move, or port, their data to another network...
That's the idea behind Berners-Lee's Solid [1].
I wish legislators were more in touch with open-source technology innovators. I feel the FOSS movement's philosophy and the idea of having collective technologies promoted and funded by the government go hand in hand.
(Disclosure: I work at inrupt, the main commercial player supporting Solid, founded by TimBL.)
Facebook has a history of outright suing 3rd party apps.[2]
If I can log into Twitter, I should also be able to update my account with an HTTP request. That's it. I shouldn't need to sign an agreement, or tell them why I'm programmatically accessing my account, or dig into a settings page. I should be able to grant an OAUTH permission to anyone that gives them access to that API, and Facebook shouldn't be able to sue that person just because they got around an IP block. That should just be part of my account.
I don't know if this legislation guarantees that (the article doesn't link to the text of the bill). Most tech legislation is bad, so there's a good chance it doesn't. But the principle remains.
[0]: https://www.theverge.com/2018/8/16/17699626/twitter-third-pa...
[1]: https://developer.twitter.com/en/docs/basics/developer-porta...
wanting to lock users in and make it harder to leave for another service and still maintain a presence (which is also a constant ad for that other service) by cross-posting
wanting to make it harder to see the stuff you're following people for without ads inserted every few posts
I 'm pretty sure their response was in order to avoid bad PR during the Analytica scandal period.
Having itself supplanted MySpace, Facebook is in a good position to see how easy data-exports can help competitors supplant a dominant company.
3rd-party clients are also a good way to remove ads and tracking, which is obviously not in Twitter or Facebook's best financial interest.
I 'm personally all in favor of making the APIs open and unlimited again, but within a month you 'll have journalists nagging again
That's actually a good question.
Does it outline in this legislation who is responsible if twitter throws open their api's and the company that a user delegated steals the user's data by acting, essentially, as a proxy api for other companies? I would think it's obvious that from the moment you delegate access to your data, Twitter would no longer be responsible. Basically, they should only be responsible for making sure that data is given only to whoever authenticates with the appropriate keys that the user in question authorized. What happens from there should be no longer Twitter's legal problem.
That seems obvious to me, but it's definitely something you would have to check.
Well, we're not trying to "solve" the problem. We're just trying to clarify that Twitter has no legal liability for the problem. If you delegate access to your account and someone proxies it; or there are all of a sudden all these GDPR violations flooding in because you gave away access to your contacts' private information when you delegated access to your account; etc etc; that liability should fall on either the user, or the entity to which the user delegated access. It shouldn't really fall on Twitter.
That's all we're talking about here, just making sure that legal and criminal liability is matched with delegated authorization. Because the legal ramifications are what tend to ensure security and privacy.
Second, slandering is not the same as legal liability. If people are slandering you, sue them. But people can't sue you and say FB gave some company access to my data unless FB actually does that without the user's knowledge.
Lastly, under this new system, no one would be saying that FB is legally liable for a user explicitly granting access to a third party. Vast majority of people would lay the blame for that at the foot of the idiot user. Again, we're just trying to verify that the legislation reflects that very common sense view.
Granted your points are still very valid / a concern.
If "literally" can now include figuratively, then "monopoly" can include oligopoly.
But the fact that people have LinkedIn, Facebook, Twitter, Reddit, etc accounts does show that people will use more than one service.
How many people are in multiple Slack groups.
> How many people are in multiple Slack groups
Aren’t they using a single app?
No they are not. there are no sub-HNs.
No it doesn't. It doesn't have the phone numbers or email addresses for the vast majority of people, even the ones who have their email address and phone number in their profile.
No. Your data remains your data, even if you allow someone else to look at it. You should be able to allow others to look at it, or even delete it after having allowed others to look at it. Now in practice, you can't. I get that. But that doesn't mean that it's not your data.
Certainly your contact info is your data. I shouldn't be able to give a girl's contact info to some other guy without her consent. One, that's douchey. Two, it's not my data, so doing so violates her privacy.
So you would argue that it's fine that Apple was deleting people's email the other day, because it's not really their data?
But for an answer's sake, no, Apple should not be able to delete an email I wrote. But that's the entire point of what I just said. I should be the final arbiter of my data. Me putting my data on an Apple Mac does not make the data Apple's. It's still my data. I should be able to show it to other people, or delete it whenever I like.
Apple should not be able to show it to other people.
Apple should not be able to delete it whenever they like.
But again, that's what I said in the first place.
>Your data remains your data, even if you allow someone else to look at it. You should be able to allow others to look at it, or even delete it after having allowed others to look at it.
So I really don't get your question at all?
Facebook already has a data export feature. You have to manually navigate to that page and download a giant zip file. Cool.
The much more important concept being proposed here is delegation:
> Under the bill the companies would be required to maintain an interface to facilitate interoperability. Or users would be allowed to choose another company to manage a user’s account settings, content, and online interactions, the statement said.
Very few people are going to manually export their data from Facebook. But they might go to a new network that supports cross-posting to Facebook, or an automatic import that doesn't require them to navigate Facebook's menus.
Delegation is a severely underappreciated digital right. Beyond advocating for data-exports, we should advocate that users have the right to delegate data-access through APIs to third-parties. If I can manually update/download my Facebook status, I should also be allowed to programmatically update it. And I should be able to authorize another person to update/download it on my behalf.