News for hackers. Stuff that matters.

A comment on Backblaze submitting names and sizes of files in B2 buckets to Facebook.

Re:Backblaze submitting names and sizes of files in B2 bucke... by mgraczyk on Sunday March 21, 2021 @11:40PM (#26536620)
Just an FYI in case this isn't clear to people. Even though this is a serious problem, it's super unlikely that FB is using the filenames in any way, or aware they were being sent. That part is probably just a (really awful) mistake.
[ Parent | on HN ]
Re:Backblaze submitting names and sizes of files in B2 bucke... by swiley on Monday March 22, 2021 @12:26AM (#26536856)
This is the same company that has published iOS apps that have silently escaped the sandbox. I think pathological is probably an appropriate word for them and wouldn't trust anything remotely related to them with a single bit of personal data.
[ Parent | on HN ]
Re:Backblaze submitting names and sizes of files in B2 bucke... by exikyut on Monday March 22, 2021 @02:28AM (#26537434)
> silently escaped the sandbox

I can has reference? Sounds genuinely interesting, and that info didn't find its way through the rock I'm apparently under.

[ Parent | on HN ]
Re:Backblaze submitting names and sizes of files in B2 bucke... by mgraczyk on Monday March 22, 2021 @01:07AM (#26537042)
Sounds unrelated
[ Parent | on HN ]
Re:Backblaze submitting names and sizes of files in B2 bucke... by tzmudzin on Monday March 22, 2021 @01:45AM (#26537210)
Possibly, but company culture transcends the immediate team. And if your business model is based on data siphoned off every possible channel, the concern is very justified.
[ Parent | on HN ]
Re:Backblaze submitting names and sizes of files in B2 bucke... by akudha on Monday March 22, 2021 @02:53AM (#26537584)
super unlikely that FB is using the filenames in any way

First, we don't know that. Second, it doesn't matter even if they are not using it in any way. Backblaze shouldn't be sending this data to FB. And lastly, even if FB isn't using it in any way today, how do we know they won't use in future?

Nobody should be having access to any data that they don't absolutely need. It doesn't matter how mundane the data is, which company the data is going to, etc etc.

[ Parent | on HN ]
Re:Backblaze submitting names and sizes of files in B2 bucke... by AnonC on Tuesday March 23, 2021 @03:42AM (#26552157)
More so with all the machine learning code being deployed to gather better information about people to thrust more ads on them, it's possible that even those who work at Facebook may probably not know the extent to which all this data is funneled into various systems and attempts are made to extract monetary value from it.
[ Parent | on HN ]
Re:Backblaze submitting names and sizes of files in B2 bucke... by mgraczyk on Monday March 22, 2021 @03:01AM (#26537632)
It matters a lot.

Like I said, it's definitely a problem regardless.

But this is like saying it that if you misplace your cell phone, it doesn't matter whether you left it in your friend's car or a taxi. Of course it matters whether or not data is being (mis)used.

[ Parent | on HN ]
Re:Backblaze submitting names and sizes of files in B2 bucke... by TheDudeMan on Monday March 22, 2021 @12:49AM (#26536969)
> it's super unlikely that FB is using the filenames in any way

You mean other than storing them forever?

[ Parent | on HN ]
Re:Backblaze submitting names and sizes of files in B2 bucke... by mgraczyk on Monday March 22, 2021 @01:06AM (#26537038)
Facebook, like other GDPR compliant companies, deletes most data after 90 days by default. My guess is that this data was not intentionally stored, and any place where it was will be deleted manually within a few days as part of remediation for this issue. Even if that doesn't happen, it would automatically disappear after 90 days.
[ Parent | on HN ]
Re:Backblaze submitting names and sizes of files in B2 bucke... by zertrin on Monday March 22, 2021 @01:56AM (#26537270)
How can we know for sure that's actually what happens?

Are there audits to check compliance?

[ Parent | on HN ]
Re:Backblaze submitting names and sizes of files in B2 bucke... by mgraczyk on Monday March 22, 2021 @02:19AM (#26537385)
Yes, there are: https://www.facebook.com/legal/terms/dataprocessing
[ Parent | on HN ]
Re:Backblaze submitting names and sizes of files in B2 bucke... by matkoniecz on Monday March 22, 2021 @03:06AM (#26537652)
Why I would believe what FB publishes?

FB used 2FA phone numbers for spying, after repeatedly promising that they will be not used in this way.

See also FB promises about WhatsApp during merger.

Is there a truly independent confirmation?

[ Parent | on HN ]
Re:Backblaze submitting names and sizes of files in B2 bucke... by justinclift on Monday March 22, 2021 @02:29AM (#26537441)
> Facebook, like other GDPR compliant companies, ...

Isn't there a lawsuit or similar going through the EU courts atm about Facebook not really being GDPR compliant? eg They claim they are, but the court case is about them not being.

[ Parent | on HN ]
Re:Backblaze submitting names and sizes of files in B2 bucke... by RobLach on Monday March 22, 2021 @12:55AM (#26536995)
I’m unsure if there’s any evidence to support this claim.
[ Parent | on HN ]
Re:Backblaze submitting names and sizes of files in B2 bucke... by walrus01 on Monday March 22, 2021 @12:09AM (#26536774)
But you have absolutely no way of knowing for certain.
[ Parent | on HN ]
Re:Backblaze submitting names and sizes of files in B2 bucke... by mgraczyk on Monday March 22, 2021 @01:09AM (#26537049)
That's not actually true, it's possible to wait and see if FB publishes a statement. If they do, you'll know.
[ Parent | on HN ]