This is a conflict that is not nearly as fundamental as Facebook likes to pretend. In a lot of ways, the Cambridge Analytica controversy was a godsend to Facebook, because ever since then the company has been repeating the same tired line that APIs, data standards, and personal control of information are fundamentally at odds with privacy.
For the most part, they're not. A lot of what Facebook gets criticized for on the privacy front has nothing to do with interoperability. It's only a conflict because Facebook has a particular lens of privacy that revolves around Facebook owning as much information as possible and being the single steward of how that information is shared and accessed.
And I'll be the first to say that Cambridge Analytica was poorly reported. I'll even be the first to say that some privacy "advocates" don't have a good grasp on these issues. But my goodness if Facebook isn't engaged in exactly the same kind of propaganda, constantly encouraging the exact same confusion between scraping and leaking, between consenusual data-sharing and hacking, whenever it fits their purposes and whenever it gives them an excuse to tighten the moat around their product. This most recent leak (I'm sorry, "scrape") is a perfect example of Facebook trying to explain away a poorly designed feature with a massive security hole around authentication and validation as if the real problem is interoperability and APIs.
It’s not in general but it is if you share information with your relatives and they don’t understand the consequence of their actions. That unique property of social data is something that creates that contradiction and something that privacy advocate keep missing.
> But my goodness if Facebook isn't engaged in exactly the same kind of propaganda, constantly encouraging the exact same confusion between scraping and leaking, between consenusual data-sharing and hacking, whenever it fits their purposes and whenever it gives them an excuse to tighten the moat around their product.
There’s a lot of people at Facebook, me first, who would love to have a different communication, but we know from experience that we’ll get pummelled if we try to introduce nuances like that in the public debate. I always find that frustrating until someone reminded me the trope about having two wolves inside of you. The story is corny but it explains the problem with coverage of Facebook really well: the misguided critics make it so that only spin-doctors manage are the only ones who can have a positive impact on the company’s image.
The majority of privacy advocates understand that distinction, it's just that our criticisms of Facebook go beyond that distinction to a bunch of other issues. If you want to talk about nuance, then tackle those issues. Tell me why Facebook is choosing not to notify users about this breach. It's really, really convenient that a supposed lack of nuance is an excuse to avoid talking about privacy breaches and bad policies across the board.
I mean, to be blunt, it sometimes just feels kind of insulting. I'm supposed to believe that Facebook would love to talk about what went wrong here and why an authentication issue and a clear vulnerability in their API is being labeled as a "scrape" instead of hack, but instead they have to be silent about the entire thing because nobody on Hackernews would understand their "nuance." Come on.
And I really do believe that the majority of complaints that most people have about Facebook are not related to API access. It's ridiculous crud like misusing phone numbers that were intended for authentication. It's this leak that we're talking about right now. It's the propaganda and fearmongering from official accounts and press releases that's being spread about iOS's new privacy changes. It's tying unrelated products like Oculus into Facebook accounts after customers were assured that wouldn't happen. It's not just accepting information about me from other people, but aggressively targeting those people to get that information. It's everything that happened with Instagram and Snapchat.
I am perfectly willing to talk about nuance in the very narrow case of Cambridge Analytica, and in the very narrow instances where "who owns information about me" is actually relevant to what Facebook is doing. But I don't think Facebook is desperate for nuance and just can't get anyone to have a productive conversation, I think Facebook is using nuance as an excuse to avoid talking about the litany of issues it has in other areas.
> There’s a lot of people at Facebook
This is a weird point, because it plays both sides of the issue. I'm supposed to excuse a lot of bad messaging coming out of Facebook because the people saying it might not represent the full company, but I'm also supposed to ultimately say that Facebook as an entity is trying to do the right thing. I'm supposed to trust "Facebook" with my data, not an individual team.
So it doesn't make me feel better to label Facebook's messaging teams as un-unified, it just makes it harder for me to trust anything that comes out of their mouths because nobody seems to be willing to say "this is what Facebook believes as an organization." This is one of the most powerful social media companies in the world. At what point does it become reasonable to ask the company to get its crap together and present some unified messaging?
Or, alternatively, if Facebook is so gigantic that it contains multitudes of different teams that have different motivations and messaging and its impossible to think of it as a single entity, at what point does it become reasonable to ask Facebook to stop representing itself as a unified entity and to stop pulling products like Instagram, Oculus, and WhatsApp closer and closer to its main services where upper management and other teams can interfere with their operations?
The argument you're making about a disjointed company is a really strong case for having some good data silos, and based on your other comments it seems to me that you're saying data silos have gotten considerably worse since 2016 because the company wants teams to more easily integrate and collaborate with each other.
I guess what I'm saying here is, when I sign up for a Facebook account who am I trusting? Am I trusting a specific team? Can I get to choose which teams I trust with my data? When a press release comes out from Facebook, will all the authors and chain of management behind it be identified? Because if Facebook wants me to treat it like a unified entity, then I'm going to do what it wants and treat it that way. It can't have it both ways.
People who you trust with your data are privacy specialists, literally every single of of the best that money can buy. The company is very large and full of people who care about it deeply and the internal culture means that you can’t get away with bad design. Every hacker in the world, starting by the people Snowden worked with, are trying; preventing them from winning motivates a lot of smart people.
You might not like the disjoint between what you hear in the press and the idea that some of the most sophisticate activist are working on making Facebook the safest service out there. That’s because, as I pointed out many times, most of the coverage, including most of the things you raise, is misleading or plain false.
A common pattern is around settings: a piece of information can be visible or used in different context. Someone makes that information open; screen-captures the information being shared. They then change their settings; screen-capture that and then claim that the settings were abused. It sounds too big to be true, so no one will believe they can get away with it, but they do, often. That article is guaranteed to trend; any denial will be buried, or more likely used against the company. Previous scandal will be re-hashed, especially similarly made-up ones.
Some people like me will be outraged. They’ll try to explain that what happened, that truth is the exact opposite of what was reported: "Facebook didn’t commit that, they _prevented_ it. They were the only one who did anything!" We’ll write “I _worked_ on that project personally” “I’m a primary source for this” and that comment will get downvoted and ignored. My comment history is full of those. I don’t think you want me to explain individually why every scandal you raised isn’t something I’d be worried about, but… I’m not. Some decisions were poorly explained (see my first paragraph for why) but the actual, internal motivation was sound. If there’s anyone that worries you particularly, happy to answer specifically.
I understand that I’m asking you to trust a pseudonym on the internet, against literally the entirety of the press and most of the content of social media. Trust me: I know how confusing things are when so many people are trying to gaslight you _about your own job_. It gets weirder because they are some real, bigger issues (that oddly no one cares about). I started early (with my PhD in 2005-2008) so I got into that gradually; I think that has made me able to handle that better than most. But the weight of that constant unfounded hostility is heavy.
I’m simply trying to answer the original question: Why people stay in spite of all the scandals? Because they are genuinely making things better from the inside. Because it’s easy (necessary) to ignore all the noise when, for those that you have more context about, it’s mostly lies.
Many people leave, me included, but that’s generally a far more complicated problem, related to the fatigue that this dichotomy carries, and internal priorities.
The best privacy specialists that money can buy are working in an organization that has decided it doesn't have to proactively notify its users about data breaches. That is the wrong decision, regardless of the internal reasoning that brought the organization to that conclusion. There might be a really engaging, interesting, reasonable set of events that led Facebook to make that decision, but it's still the wrong one.
So the picture you end up painting in these comments is of a highly motivated, talented group of individuals with good intentions fighting tooth and nail against an organization that doesn't seem to be listening to them. And honestly, sure, whatever. I can buy that there are experts in Facebook working to make the system better. But clearly they aren't winning.
So we go back to my original point, which is that when I make a Facebook account and when I hear from Facebook's PR team about how asking users for consent to track them is "killing small businesses", I don't get to choose to only trust or listen to the privacy-conscious amazing people who are fighting to fix problems. I also have to trust my data to and get my information from the giant organization of marketers, PR people, advertisers, and managers who make up the rest of Facebook and who seem to have a lot more power than people like you do.
> but the actual, internal motivation was sound.
To expand on the above point about internal motivation, and to address your claim that all of this controversy is just bad faith reporting:
I do not believe you if you say there's a good reason to link Oculus accounts to Facebook accounts and to tear down the data silos between those products. I do not believe you if you tell me that it's OK for Facebook's marketing team to spread FUD about Apple's privacy settings. I do not believe you if you try to play off those issues as misreporting or the media lying to me. They are real things that have happened.
Or if you want to dig in even deeper to things that can't be described as one-off mistakes or miscommunication, you are never going to convince me while actively using a pseudonym online that Facebook's current real-name policy is a good idea. It's a policy that is still problematic to this day, even after Facebook promised to try and make it better. I understand why Facebook has that policy, I understand that there must have been a lot of nuanced conversation internally that led to it, I understand that Facebook has a point of view that makes the organization think the policy is logical. But it's still not a good policy, and we can look at the effects and see that it didn't turn out well.
I can believe you that there were long, complicated, reasonable internal processes that lead to these problems. I can believe you that people didn't wake up in the morning and decide to be evil. But the end results are still bad for privacy -- not because the media tells me they are, but because I'm a functioning human being who is capable of looking at the outcomes of those decisions and reasoning about the world.
Heck, we can even go a step further. You've tried to play off Facebook's API decisions as being about privacy instead of monopolistic behavior. We started this conversation with me pushing back at the idea that people needed to choose between privacy and and interoperability. But your opinion on that is not reflected by Facebook's internal chain of managers, and I'm not basing my opinion on secondary sources. I read the internal emails that were exchanged about its competitor's API access -- not snippets from news sources, I read through the actual leak. You can't play that stuff off as if there's a hidden world that would change everything if only I could see it. Because I personally got to look into that hidden world and see the reasoning that managers were using in their own words, and it was all pretty bad. It's not media bias that's causing that perception.
I’m just going to correct things that you seem to attribute to me that I have not said:
> against an organization that doesn't seem to be listening to them
Nope, the organisation listens; they listened to me closely. They just learned that very few people outside the organisation do and they try to protect from the frustration of engaging with dishonest people. You certainly do not care to listen, for instance.
> you are never going to convince me while actively using a pseudonym online
I’m using my first name. I’ve used it as my handle in any service that allowed short handles. I’ve never met someone else with it, so I always assumed that it identifies me directly. Facebook the company is not against using pseudonyms: Instagram uses them; WhatsApp has no names.
> the assumptions that you are making are false or misleading
Nothing that I listed in the second section of my comment was false, it was all factual information. Facebook did take out full-page adds with misleading and inaccurate FUD about Apple's privacy stances. Facebook did merge Occulus and Facebook accounts. Facebook does, still, to this day, ban pseudonyms. Facebook has never claimed that the leaked emails describing its internal policies towards competitors were faked.
Those are factual statements.
If you want to claim that I'm lying about them, then that's a really bold claim that you should own in specific terms, not just allude to in vague statements about whether or not I'm willing to listen to you.
> You certainly do not care to listen, for instance.
You have never provided a single example throughout this entire thread of any of my examples being factually inaccurate, but you're characterizing me as being close-minded for not taking you at your word with zero evidence that every critique about Facebook is wrong.
You're upset that I don't know what you have to say, but you haven't said anything. You set up an example of a hypothetical critic who doesn't understand how shared contacts work, and told me to extrapolate from there. So yes, I do think you're wrong, because absent any evidence of the contrary, the fact that you've worked at Facebook doesn't mean you magically have context that makes Facebook's real-name policy not a problem.
Again, unless you want to claim that the entire media landscape is outright committing libel and that Facebook doesn't have a real name policy[0].
This is the main reason we end up with filtering bubbles, contents that needs to be consumed fast and push people to react, relying more and more on anger over most other emotions, with no need for veracity or depth, or bringing anything lasting to the user; the other side of the coin being the privacy debacles coming from monetizing that engagement.
I don’t see facebook doing any effort to mitigate these effects on their users. On the contrary we had many reports of research to increase engagement, direct the users emotions and test the different algorithmic strategies.
Facebook aggressively tries to mitigate issues, but struggles to get its critic to admit that they can’t ask for more interoperability in one sentence and more privacy in the next; for more freedom to say what you please and more control of unacceptable speech; for respect for local mores and universally understandable rules. Facebook employees are constantly trying to argue for nuance, offering solutions and getting downvoted and silenced because Facebook=Bad.
Find me one employee of a car company willing to breath from a the exhaust of an ICE. Even suggesting you might rightfully gets you sent to a psych ward on suicide watch. But we can make cars non-polluting, they just chose not to; they refused so hard that electric cars, a technology that is a century old was presented as inconceivable until they started loosing sales to a weirdo a little too much fan of anime.
What every employee of a traditional car company can easily conceive, and is very keen willing to excuse is a slimy tale of Union reps and executives paying prostitutes to convince Environment authorities to look the other way when they evade basic pollution control (seriously, the VW scandal is dark and human trafficking isn’t the bottom of it). Talk to your local oil & gas executive about “human rights violation as a cost of doing business in certain part of the world”. All that the cost of dozens of millionth of people dying of respiratory complications, and billions risking environmental disaster.
How to have fewer than a million people killed in accidents every year? There’s many way, but a very easy one would be to prevent cars from driving faster than maximum speed limit on a highway. It’s an elementary tool. Find me one employee from a car company who wouldn’t laugh you out of the room for suggesting it. “Nobody would accept to not be able to repeatedly break the law if that meant we could save millions of lives.”
There is nothing in common with that nightmare and the debate around the legibility of privacy controls, or the rate of false positive on automated translations used for violent content detection when dealing with non-Ascii language.