> but however sexy that sounds from technical point, they are after all a public company and need to play by the rules. Unlikely to take on such a massive intrusion of your privacy, knowing that eventually it would get discovered.

You completely lost me here. We’re talking about Facebook, the company with a near infinite supply and history of privacy issues. Facebook has shown that rules don’t apply to it for as long as it can get away with it. Behind the scenes, it laughs at fines imposed by governments because they’re too tiny to have a material impact on the future of the company and its earnings.

At this point, does Facebook really deserve benefit of the doubt?

> At this point, does Facebook really deserve benefit of the doubt?

You have a point: Facebook is using the iPhone’s camera as users scroll their feed, https://news.ycombinator.com/item?id=21513471

It is layout bug, as explained, but who cares rights? Let’s just throw stones and without a shadow of a doubt attribute it to malicious intent.

Fool me once...

Have you read Facebook's origin story?

> For the last 5 years, we accidentally recorded billions of people's reactions to ads as they scrolled past them, then accidentally fed that data into our ad placement algorithm.

> We're really, reallllllly sorry and promise to do better.

Any day now....

This has been Facebook’s modus operandi for a few years now.

Wouldn't a network analysis be able to detect a difference in the amount of traffic coming out of the phone? Measure with and without Instagram installed, active, background, and given or denied camera access. If it's capturing images in the background that data has to go somewhere. Even if it batches for sending later. Another way to find out is to feed it "interesting" images with faces and objects, then compare if the camera is pointed at a blank wall for the same amount of time. If the phone is significantly noisier then you can conclude it's actually processing the images and not just dumping them to the bitbucket.

> Even if it batches for sending later.

Would probably be very hard to spot that if you piggyback on normal story/image upload traffic payloads. Seems like a lot of work for something that's not really that helpful or easier to accomplish.

> Seems like a lot of work for something that's not really that helpful or easier to accomplish.

That could be said for Facebook surreptitiously uploading images by piggybacking them onto innocuous requests.

I’ve disabled the FB app’s cert pinning so I can MITM it and they really don’t seem to care about minimizing the number of requests. Tons of little logging events will be fired off separately instead of being condensed. Also, there are several unofficial Instagram apps that were developed by thoroughly reverse engineering the app’s private API. Seems unlikely that this could have evaded detection.

And just data volume-wise, it’s much harder to conceal uploading weighty images/video. Facebook and Instagram mostly just download data. A long term discrepancy in upload usage between when the app has camera permissions and when it doesn’t would be easy to spot.

I have no doubt Facebook is still doing creepy things we don't know about yet, but this particular theory just seems incredibly unlikely to me.

> I wouldn't be surprised if this is an actual bug.

Under other circumstances, yes perhaps. But in the case of a Facebook, with their complete disregard for privacy and search for more and more ways to collect data, this seems like an explicit feature implementation.

> complete disregard

Complete? Aren’t you exaggerating?

There were hundreds much worse leaks than any Facebook leak. Any credit card leak is much worse. But Facebook is an easy hatred target.

Nothing bad really happened as result of these leaks. Nobody harmed, nobody lost money, and don’t start again on that CA story which happened and fixed several years before you learned about it.

rough experience in a company with an ads department is one ought consider them like some kind of fungus - they may not have been part of a given effort to begin with, but without careful efforts to keep them away, they're bound to colonize whatever it is that gets created eventually.

Also... wouldn't the bandwidth of streaming back all that video be pretty obvious? Seems like it would take a lot of resources for data they probably already have anyway.

Agreed. No matter what advanced stenography they try to use, if the app’s upload volume increases when given camera permissions that'll be easy to spot. That alone wouldn't prove anything, but it would definitely be interesting enough to merit a deeper investigation. Jailbreaks on iOS are currently flourishing, and developing the multiple exploits needed to pull that off makes reverse-engineering the Instagram app seems easy by comparison.

Let's say that it was in fact intended as a user experience optimization, as you suggested. If you were Facebook, and you now had access to the camera's feed when it wasn't in use, would you really be able to restrain yourself from violating the user's privacy? I imagine for Facebook it would be like seeing a freshly cooked pie on a window sill.

Sure, but you’re seeing the effect of earning a bad reputation, which is that all of your actions are interpreted uncharitably.

Did they break any laws?

Yes

https://techcrunch.com/2019/01/09/cambridge-analyticas-paren...

facebook has done worse and they aren't going anywhere over privacy concerns (privacy is antithetical to their raison d'etre)

and budgeting for fines and legal fees as contingency for when pseudo legal practises that have business beneifits are discovered is standard practice in most large corporations

If they get caught they just pay a few billion in fines. They do that all the time and still turn a profit. Maybe their shadiness attracts advertisers and makes up for it in part. Criminal consequence is needed to deter them at this point.

> I wouldn't be surprised if this is an actual bug

https://www.cnet.com/news/facebook-bug-has-camera-activated-...

funny however how often this 'bug' reappears

It's noted in the article that no photos or videos were taken when Facebook inadvertently showed the camera page to the user. If they weren't capturing anything, then it really was a bug.

> If they weren't capturing anything, then it really was a bug.

That's not true. The camera could quite easily have been intentionally enabled at applciation startup in order to have simplified code or instant responses later.

You were probably downvoted for using the F word, but outside of that that, I tend to agree that camera init is slow AF.

In fact, by playing privacy-advocate games, Apple is inevitably punishing every app except their own because while they will show "This app is using your camera," I wonder if the same rules apply to their own camera usage.

We will know soon.

Camera shows the indicator just like every other app.

Does it? I am yet to update to the new iOS because too many things break with early releases, and I've gotten tired of broken releases. But right now I can swipe my phone to the left, and get a sub-second access to my camera. There's no way it's not pre-loaded for this to work so fast.

My question is whether developers, who are not Apple, would be able to load the camera with the same speed that Apple. Does iOS load Camera in the same way that Apps do, or does iOS have access to lower-level API?

I don't have the answer, but I'd be curious to know if someone's got the know-how.

Nobody actually posts directly through their camera, but rather uploads preshotted pics

You'd have to qualify "nobody" with some statistics, because of the millions of users, I'm sure some of them use IG's camera.

Also IG Stories is where all the filters live.

> Unlikely to take on such a massive intrusion of your privacy, knowing that eventually it would get discovered.

I don't think that's a reason for them not to do it. They could just claim it was an accident, they weren't really collecting the data, etc etc ad infinitum and most people would continue to use facebook just as they always have.

The day I uninstalled the facebook app was the day it asked for permission to read all text messages (on top of the many, many other permissions it already had). I figured the next step would be audio and video (after all, there wasn't much left to ask for at that point).