Facebook Tells Barr It Won't Open Up Encrypted Messages - <AUTHOR> https://www.nytimes.com/2019/12/10/technology/whatsapp-barr-encryption.html <comment><USER2> > Mr. Barr has said that Facebook's moves toward end-to-end encryption, which > shields the content of messages from everyone but the sender and recipient, > makes it harder for law enforcement officers to track malicious behavior > online.

It's kind of supposed to be hard, by design. Read the constitution on what it takes to get a search warrant. You're not supposed to be "tracking malicious behavior." You're supposed to be tracking individuals, once you have some sort of actual tangible proof that a judge individually signs off on, that they are doing something nefarious. It wasn't supposed to be a drag net fishing expedition where you can key word search everything anybody has ever said via a digital device at any point in history. No, they were pretty clear about that when they wrote that pesky constitution thingy (and for good reason.)

<comment><USER3> What is it that you think the Constitution says about getting warrants?

It's not my understanding that the Constitution was designed to make it difficult to investigate crimes. As I understand it, the US largely inherits the common law principle that the public is entitled to every person's evidence. The backstory I understand behind the Fourth Amendment is that the British used "general warrants" as a tool of harassment – where a general warrant was essentially a slip of paper that deputized a group of soldiers to toss houses and confiscate goods on a whim. The intent wasn't to make warrants hard to get, or to gate all conceivable searches on warrants, but rather to make sure that what warrants were issued were at least particularized with a real, defensible purpose.

Another observation that bolsters my particular understanding is the variety of conditions in which the Supreme Court, going all the way back into the era of the founders, authorized warrantless searches. The border search exception, for instance, dates back to the founders.

My feelings about law enforcement and encryption are complicated but hew mostly to the HN party line. However, I feel sometimes like I arrive at my conclusions in a very different way than people who invoke the Constitution here.

<comment><USER4> But even in the event the government demonstrates probable cause the constitution doesn't require us to make it as easy as possible for the government to search our homes, papers, and effects. If the police suspect you of murder and get a warrant to dig up your basement you aren't the one who's then required to dig.

Now imagine the government said no one should be allowed to pour cement in their basement because it makes it difficult to investigate suspected murderers. That's what Barr is advocating.

<comment><USER3> I don't believe the Constitution demands that we make it "easy" for law enforcement to collect evidence, though I'll again note that the animating common law principle comes close: the public is _entitled_ † to every person's evidence.

I work closely with cryptography and think about cryptographic freedom mostly the way other people on HN do. I asked a specific question about the Constitution. The debate about whether we should be "allowed" to encrypt things is incredibly boring, we almost certainly don't meaningfully disagree about it, and I'm not interested in having it.

† _or "has a right to" or "has a claim on", depending on whose paraphrase you're reading_

<comment><USER5> I think it's more that they have a right to seek it without interference after the fact. You can not be compelled to disclose the evidence that would be used against you, or any information required to obtain it (and thus constitute a disclosure).

If Facebook/WhatsApp's system was built to put them in a position to incriminate you after the fact, then probably the kind of criminal who would use it is the kind you'd convict by other means.

That leaves you with the choice of whether or not to incriminate yourself.

<comment><USER6> Assuming you are talking from a US point of view, [https://www.newsweek.com/court-rules-defendant-must- disclose...](https://www.newsweek.com/court-rules-defendant-must-disclose- phone-password-police-prosecution-first-ruling-its-kind-1466112) suggests that a person can be completed to provide passwords that unlock incriminating evidence

If you are talking globally each country has its laws or no laws on the matter (as you'd expect there are also contradictory court rulings within a country/ state )

[https://en.m.wikipedia.org/wiki/Key_disclosure_law](https://en.m.wikipedia.org/wiki/Key_disclosure_law)

</comment></comment></comment></comment></comment></comment><comment><USER7> "It is simply impossible to create such a backdoor for one purpose and not expect others to try and open it."

While I don't like or use Facebook. I can't agree more with this sentiment.

<comment><USER8> I hear this all the time but I don't understand why it's true. The security of your encrypted messages already relies on the security of the company providing the service. Facebook (and any other messaging app) can read all of your messages in plain text. Otherwise they wouldn't be able to display them to you. Allowing the government to get a warrant to retrieve those messages changes nothing about the overall security of the messaging platform.

What am I missing?

<comment><USER9> Facebook can't read the content of your messages. They can serve you an encrypted version of your messages that your device can decrypt. Look up end- to-end encryption for how exactly that works.

<comment><USER8> They can't read them in transit, but if you use Facebook's app to decrypt the message (which is the only option) then obviously Facebook can read your messages if it wants to.

<comment><USER10> While this is true, the app is a client whose code and behaviour can be analysed by end users to validate that it is not behaving nefariously. The same cannot be said for FB's servers or the data in transit, which is solved by E2EE.

</comment></comment></comment></comment></comment><comment><USER11> This backdooring of communication is a joke. Everyone wanting to hide something can pgp/gpg encrypt a message and paste it into whatever channel, from fb to irc, from email to counterstrike chat. This whole thing about protecting "children" (or whatever the latest excuse is) is the ultimate nonsense. This wont stop terrorists with enough money to organize something like 9/11, it will only enable spying on own and foreign normal cityzens who dont encrypt what they say. Everyone else who really has "something to hide" wont be affected.

<comment><USER12> > Everyone else who really has "something to hide" wont be affected.

A tiny handful of agents for cryotographically sophisticated organizations are "just" using gpg and pastebin or whatever.

In the real world, the vast majority of bad actors are using the simple/easy/obvious communication solutions delivered to them by their phones and apps. And law enforcement (for both good and bad reasons) knows this and wants access to that stuff, because they know it's possible to get it.

<comment><USER11> Yeah right. And they were living in a jungle with absolutely 0 news for last 10 years. This period is gone, even before "Eschelon" was known fact, after Snowden you really must be ignorant to avoid this news. And if you are targeting a Guatanamo bay or life long prison you are surely not. Or you are long gone.

This whole sharade is targeting cityzens. I can only speculate why, one could be stupidity and ignorance, profit maybe, or even protecting establishment, mass control. I dont know. But surely it wont affect the "excuses" they are using now.

<comment><USER13> The reality is that plenty of criminals and bad actors use insecure communication channels like phone calls, SMS, and unencrypted app messengers.

Evidence recovered from these channels is constantly used by police and if apps and services all actually switch to secure E2E encryption, a lot of evidence will be beyond their view.

Turn your argument around- if everyone who hasn't been living under a rock knows how important e2e is, why are Facebook and SMS and MMS still so popular?

<comment><USER11> As ordinary people just dont care. They should, but they dont. There is nothing at stake for them. But they are saying that are targeting bad actors who DO care. And now you think that some drug lord (which has seen Hollywood movie about himself using encrypted walkie talkies) with infinite amount of money, smuggling drugs with mini sub (just happened in EU week or two back), the terrorist who is risking air-to-land missile and with oil based money flow is going to use sms/mms? No. The ordinary people will. Maybe potheads.

<comment><USER14> There's a counter argument here that "ordinary people" represent a much more realistic source of danger than some super-criminals/high-level terrorists. Depressed dude who's read too much bullshit on some forum, so he goes out and starts shooting people is statistically much more likely to happen than another 9/11\. This type of lone-wolf lunatics and small groups of ideologically indoctrinated people who operate completely on their own - basically some guys sitting together one night and coming up with the idea that "they should do something about it" \- are the future of terrorist threat and significantly harder to spot than large organizations.

</comment></comment></comment></comment></comment></comment><comment><USER15> If anyone's interested in the history of this stuff and why government agencies have these expectations, I suggesting checking out The Puzzle Palace from James Bamford

[https://en.wikipedia.org/wiki/The_Puzzle_Palace](https://en.wikipedia.org/wiki/The_Puzzle_Palace)

[https://www.amazon.com/Puzzle-Palace-National- Intelligence-O...](https://www.amazon.com/Puzzle-Palace-National-Intelligence- Organization/dp/0140067485/)

After reading that book and getting a better sense of the scope of intelligence operations over a wider swath of history, these types of requests come from make a whole lot more sense (whether you agree or not, you get a sense of the place they're coming from). Not making an argument in regard to what's right or wrong, but it does provide a tangible dose of reality. Also, given this was written in the 80's and much has come to be known since then, I still think this book holds its own in terms of clarity because it discusses historical topics without the messiness of the internet, social media, etc. Bamford has several more recent books, but I have not read those.

<comment><USER16> Interesting, thanks for the recommendation!

I recently read Permanent Record[1][2] by Edward Snowden and it'll be interesting to contrast his account from Bamford's some 30-40 years ago.

I have to say, Snowden's autobiography was a fantastic read and a chilling look inside the 3-letters agencies. Highly recommended, as the topic is evidently pretty circumstancial to us right now and for the foreseeable future. Also, if you grew up anywhere near the 1980-1990's, especially as a computer geek / nerd, you'll probably love this book for nostalgic / human / relatable reasons.

[1]: [https://en.wikipedia.org/wiki/Permanent_Record_(autobiograph...](https://en.wikipedia.org/wiki/Permanent_Record_\(autobiography\))

[2]: [https://www.goodreads.com/book/show/46223297-permanent- recor...](https://www.goodreads.com/book/show/46223297-permanent-record)

</comment></comment><comment><USER17> How I wish this article's title was "Facebook Tells Barr it Can't Open up Encrypted Messages".

<comment><USER18> If I login to Facebook.com from any random device+browser, I seem to be able to read my "Facebook Messenger" history - maybe this is different if I use the Messenger app, but it seems like there's no E2EE here since I get the plaintext from anywhere.

On WhatsApp there seems to be E2EE enabled but I have no idea what the keys are. A layperson definitely has no idea what the keys are.

Could Facebook build an "NSA mode" where the old keys (K1) are quietly replaced with some known keys (K2) for a particular user at a particular timestamp T?

This means that all messages before T are to be parsed by using K1 and all messages after T are to be parsed by using K2.

As a WhatsApp user, would I even know if "NSA mode" has been enabled for my account? This would enable courts to allow surveillance for all future messages, but the old messages would still be E2EE.

What if you involve Apple+Google into the mix and have them silently deploy a rogue update to a particular user's WhatsApp program - couldn't you just ask a court to write some kind of surveillance warrant which orders the 3 companies to work together to give the alphabet agency a way to remotely take the keys?

<comment><USER19> Facebook Messenger conversations are not E2EE by default. When you start one, you have to choose "Secret" in order for E2EE to be applied. This is only available from the Messenger app on mobile devices.

<comment><USER20> Is this advertised anywhere, like in clear wording? On the site, in the app, etc. If it is, good on them. If not, kind of worrying.

Simply saying "We have E2EE so you can trust us now" and not actually clarifying where E2EE is applicable in your apps is some very typical PR talk.

<comment><USER21> WhatsApp is default E2E and is quite visibly indicated in the application. You can probably make the call on how visible the E2E features in Messenger are yourself if you take a look.

<comment><USER20> That would require to join Facebook and I'm not coming back there. I'm aware of WhatsApp being E2E, yeah, everywhere except for backups. Another user replied that Facebook plans to go E2E completely, that's surprising but good.

</comment></comment></comment></comment></comment></comment><comment><USER22> This is the same William Barr that released an official DOJ statement yesterday claiming abuse of the FISA courts, no? [https://www.justice.gov/opa/pr/statement-attorney-general- wi...](https://www.justice.gov/opa/pr/statement-attorney-general-william-p- barr-inspector-generals-report-review-four-fisa)

<comment><USER23> Yes, this Bill Barr:

[https://gen.medium.com/is-william-barr-the-head-of-doj-or- qa...](https://gen.medium.com/is-william-barr-the-head-of-doj-or- qanon-58d68fc3a31)

[https://www.thedailybeast.com/william-barr-is-the-most- dange...](https://www.thedailybeast.com/william-barr-is-the-most-dangerous- man-in-america)

</comment></comment><comment><USER24> We've had innumerable discussions about the practical impossibility of what various Governments are asking for in relation to encryption. Those who know... know. There's no more debate needed, the mathematics speaks for itself, the history of security breaches speaks for itself (and is only ever gaining in its volume of evidence).

The technology industry needs a template reply referring to the obvious examples of the two pillars, mathematics and history of security breaches, to dismissively reply to any further such requests now and anytime in the future. We shouldn't need to get caught up in any of their cleverly constructed strawman arguments and appeals to emotion. Those who keep bringing these topics up are essentially performing a DoS on the technology industry by tying up resources having to argue established fundamental truths and logic over and over.

So, why do we have to keep spinning our tyres on this?

1\. Control: The well established push towards surveillance and the police state that protects the status quo. Technology has accelerated the enablement of this.

2\. Power: The powers-that-be don't like being told by 'nerds and geeks' what is and is not possible, despite the very same 'nerds and geeks' creating the technology that has enabled the acceleration of Control. The technology industry's continued non-compliance undermines their desired image of Power.

But, because this whole argument is so purely a power play it's not likely to stop (without fundamental changes to the fabric of society at least). As such, a template reply is needed to mitigate this DoS

<comment><USER25> This comment is wrong on so many levels.

It is absolutely technically possible to provided communications with the ability for a government to read them. No one debates that.

Many claim that the security and privacy trade off in doing that is not worthwhile.

 _The technology industry needs a template reply referring to the obvious examples of the two pillars, mathematics and history of security breaches, to dismissively reply to any further such requests now and anytime in the future. We shouldn 't need to get caught up in any of their cleverly constructed strawman arguments and appeals to emotion._

This is absolutely the wrong response. This is a political argument, and the correct response is in the field of politics, not a glib template argument that appeals to technologists view on security trade-offs.

<comment><USER26> Political arguements is a fool's game as they are experienced manipulators after power. Sociopaths in other words. Not playing the expert's games is the only way to win against them.

Force them to insist upon what every expert says is impossible. The only "answer" they can have to that are more spin spun bullshit or making it their own. A "don't use me ever" form of encryption if they actually succeeded (any other option is better) or they create a tower of babel standing on a vertical gnat's hair - an inevitable collapse on any foolish enough to use it that only damages the arrogant fool who made it further.

<comment><USER25> _Force them to insist upon what every expert says is impossible._

What does "impossible" mean here?

It is certainly possible to build an encrypted messaging system that doesn't use end-to-end encryption and that allows someone within the company that runs that system to read the messages.

There are plenty of existing messaging systems that work this way, even today (eg, FB Messenger in non-private mode, Slack, plenty of video products).

Plenty of them have a long history of operating without having unauthorised information leaked.

So again - what is impossible?

I agree entirely that E2E encryption is much better, but we are fooling ourselves to say anything else is impossible.

 _Political arguements is a fool 's game as they are experienced manipulators after power. Sociopaths in other words. Not playing the expert's games is the only way to win against them._

I'm not entirely convinced by this argument. I think that banning E2E is primarily pushed by security agencies, and I think politicians don't particularly care about this topic at all.

</comment></comment></comment></comment><comment><USER27> I think the best way to think about this is that such backdoor is like giving policemen ability to travel back in time to any time and anywhere any conversation between any citizens happened (no matter about what and how private) and invisibly eavsdrop to gather any information that will be used in the court of law against people involved in the conversation. It will be used to prove something but also to discredit a person. It may also be used as a blackmail tool in the process of plea bargaining. All against possibly innocent people whose innocence is not so blatantly obvious that law enforcement can't imagine a way to attach some guilt to them.

First of you can't give police such universal time machine because it doesn't exist and some coversations will be beyond their reach (because end to end encryption will not cease to exist if facebook and apple stop using it).

Secondly this analogy should show to anyone, even senator, that this is not a good idea. Especially in USA.

</comment><comment><USER28> I never thought I'd say this but well done Facebook.

That being said, a few things come to mind:

1\. Can they hold out against the inevitable pressure that's gonna be applied now that they have actively come out against the government and said "No".

2\. Does this mean they can do it but just won't do it?

3\. Will we ever find out if the government secretly forces them to do it?

<comment><USER29> In response to your third inquiry: They haven't created a warrant canary, so we'll never be able to tell. That's the thing about Facebook: You never know what the truth is. I'll continue to treat Messenger as compromises by the FBI/NSA.

</comment></comment><comment><USER30> Let's say FB does such a move. And let's say that it's such a wonderful tech that only FBI has access to those messages. You know what will happen next? Criminals and those child molesters that Barr uses as Boogeyman will simply create an app that will have E2E encryption without any backdoor. Unfortunately for Barr technology is here and it's easy to use it.

<comment><USER31> Why would a child sign up for an E2E app where it's easier for paedophiles to anonymously groom them? Sophisticated organised criminals don't use Facebook Messenger, but this article isn't about them.

<comment><USER32> One reason that a minor might seek out E2EE is that they have been prosecuted in that past for sharing photos of themselves with other minors.

</comment></comment></comment><comment><USER33> This debate has been raging since the Clipper chip controversy 25 years ago. I worry that encryption will only continue to weaken. It already occurred in Austrailia.

<comment><USER34> It will happen eventually, I believe. There is simply to much potential power to be wielded for politicians to ignore it long-term. Government only ever takes more power, and the common man does not care enough about this issue to stop it.

<comment><USER30> I strongly disagree. It will lead to criminals having their own app to communicate while rest of normal commercial communications will be broken with potential of criminals stealing stuff left and right. All it will take is for some big politician to lose all their money in a heist for these useless attempts to forever disappear.

I actually root for this to happen as fast as possible so all these attempts to go away forever already so that law enforcing agencies go do their actual job.

<comment><USER35> The fix for that will be to make using those levels of encryption illegal and to put you under suspicion for criminal activity (suspicion of terrorism, for instance) in addition to the criminal activity of using that type of encryption in the first place.

Yes, routing mechanisms, etc exist to make it harder to find out who is using the encryption but the law enforcement power could then also be extended to take down anyone participating in such a network as well as setting up honeypots that somehow get around entrapment laws.

<comment><USER36> Criminals, almost by definition, are good at doing things without law enforcement catching on. It's possible to try to crack down on this stuff, but like anything else they'll only catch the less competent people.

<comment><USER31> Catching the less competent people isn't a bad thing, though. Someone who is competent enough to commit crimes and get away with it is also competent enough to get a well-paid job and choose to live a pro-social life, without the risk of one slip-up sending them to prison.

</comment></comment></comment></comment></comment></comment><comment><USER37> Sorry but I can't and won't trust _anything_ that has anything to do with Zuckerberg. This year I have fully deleted my Facebook and Instagram accounts and WhatsApp is going by the end of the year when I visit family for Christmas and can help them switch over.

Sadly they won't be ditching WhatsApp themselves but if I can get them using something else to communicate with me and my wife hopefully over time they will see there is a world without WhatsApp. Small steps and all that.

As for what we are switching to that is where I am still undecided. Signal seems the obvious choice but I want to look at all the viable options so I am open to any and all recommendations. Must haves are E2E encryption out of the box, group chat, voice and video (person to person, groups calls not needed).

</comment><comment><USER38> Assuming that the systems are truly encrypted end-to-end, how do we know for sure that noone can actually decrypt it? I mean, apart from the Eng team that directly works on that part, are we basically trusting them at face value that it works? Or does this code need to live in an open-sourced environment so as to make it more trustworthy?

To be clear, I don't mean trusting the encryption algorithm, that part is easy because math. I mean trusting that that algorithm is actually what's being used under the hood and actually noone can decrypt it for any reason.

<comment><USER39> There has to be some level of trust at some point, unless you are going to create your own phone and all the apps on it from scratch.

</comment></comment><comment><USER40> Criminals will always be able to easily encrypt messages, unless math is banned. Is the government going to ban every language that has simple encryption libraries? You can easily create your own private keys and encrypt your own messages with a few lines of Python code, and no one can break it. I don't think this is about child porn or terrorists at all. They're only the usual justification for wanting to snoop on _everyone_.

</comment><comment><USER41> I dont trust Facebook and frankly, dont care about end-to-end encryption as there are a myriad of ways to communicate if necessary. But I definitely do not trust Barr or the Justice Department or any AG in any way shape or form as they have proven to act immoral,criminal and are clearly beholden to their political puppet-masters and campaign donors. So in the end, its better to have both side incapable of deciphering the data than either capable.

</comment><comment><USER42> Lets examine the character and truthfulness of both Facebook and William Barr.. There's not a grade low enough to characterize the lying and deceit of both of them.

I have no trouble believing that Facebook is lying an Barr is supporting this lie. We'll have to see how fast someone is convicted based on encrypted Facebook Messages and what excuse Barr and the DOJ use to rationalize it.

It's a sad day in America.

</comment><comment><USER43> If you do not know what you are looking for you should not be looking.

Serve a warrant and do it the proper way if you want to read private messages.

</comment><comment><USER44> The real issue is "Highly-Secure Backdoors: Internet of Traitorous Things (IoTT)" as follows:

[https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3425957](https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3425957)

</comment><comment><USER45> Mirror without paywall: [https://montrealtimes.news/facebook-tells-barr-it- wont-open-...](https://montrealtimes.news/facebook-tells-barr-it-wont-open-up- encrypted-messages/)

</comment><comment><USER46> Here's that marketing scheme again. Apple did it first a while back, so I assume now we can be assured we are safe.

</comment><comment><USER47> no body believes anything Facebook says

</comment><comment><USER48> > No, they were pretty clear about that when they wrote that pesky > constitution thingy (and for good reason.)

They were clear about many other things, but the idea of interpreting constitution as it was meant by the founders has long been dead, with the coup de grace having been delivered by Helvering v. Davis. The constitution is dead, and its skin is worn by 9 people in Supreme Court who get to decide what they want it to mean basically any way they please.

<comment><USER16> Isn't it time to consider writing a new Constitution then?

Most countries have had "a few" (2, 3, 4...) since the inception of the formalized idea. We now know how to draft "good enough" Constitutions by common standards (relatively to history and other countries).

It's a famous US peculiarity in Constitutional Law studies: to have gone the amendment path for so long. To have been so resilient to epochs, to change, to greatness. And yet as of the 21st century, it shows elements of "unfairness" and approximation that seem hard to sustain further, to "sell" to the masses for much longer, or so it seems from a nerdy-law standpoint.

There's evident success but it may have been at the expense of a significant degree of actual democracy — as you suggest for the judiciary branch: this infringes on the legislative branch in this case, and outright fails the accountability check absolutely required from lawmakers. By comparison, judges are elected in the US system, which is accountability put in place to counter or mitigate their ability to _make_ the law by way of setting precedents, giving citizens an indirect say in the matter.

I don't know. I've always pondered on this question. I observe tension rising in this direction over the last 20 years (since Bush Jr essentially). Maybe it's just my personal bias speaking — no wonder a programmer sees the law as inneficient code to be refactored asap! ;-)

<comment><USER19> We don't have a mechanism to replace the Constitution. Short of getting all 50 states to agree on it (good luck) it's never going to happen without a civil war.

<comment><USER49> On the contrary, Article V clearly states that it would require legislation on the part of two-thirds of the States, or passage by two-thirds of the House and Senate, and subsequent ratification by three-quarters of the state legislatures.

This would convene a Constitutional Convention, which in turn could rapidly pass an Amendment rendering the existing Constitution null and void upon ratification, after which they could turn their attention to creating and ratifying a new Constitution.

Not only would this be perfectly legal, I consider it an excellent idea.

<comment><USER50> > Not only would this be perfectly legal, I consider it an excellent idea.

An excellent idea in the abstract sense of _hey, that 's a really clever way to update the constitution,_ or an excellent idea in the sense of _the politicians operating in America today can be trusted to update the constitution properly so let 's do that?_ Only one of those isn't totally crazy...

<comment><USER49> In neither sense, because a popular movement to replace the Constitution could only succeed by replacing the existing legislature with one which is amenable to such a course of action.

It's far-fetched, I readily concede that. But it has a lot to recommend it, the very act of proposing and bringing to reality a Constitutional Convention would be a powerful engine of change, with a better-than-even chance we'd end up with a better system than we have now.

<comment><USER51> "a Constitutional Convention would be a powerful engine of change, with a better-than-even chance we'd end up with a better system than we have now"

What makes you think that? I would put the odds of a better system at approximately zero.

We had a rare, special moment in history that created our Constitution. The Bill of Rights is amazing and radical even today.

</comment></comment></comment></comment></comment></comment></comment><comment><USER52> That seems tethical.

</comment><comment><USER53> I don't see how the Trump administration is, on one hand, banning Chinese telecom equipment because of alleged backdoors, then turning around and asking US firms to put in backdoors. Sure, they're _your_ backdoors, but it hurts the US's credibility.

<comment><USER54> The government's argument has always been along the lines of: "Don't worry. The US is better than China and our secret backdoor keys will never be leaked. Trust us :)"

<comment><USER31> Have the secret backdoor keys that allow developers to remotely update the software on every Windows, iOS or Android device ever been leaked?</comment></comment></comment>


How Yahoo Knows Your Every Move - <AUTHOR> http://iskod.com/2011/08/21/how-yahoo-knows-your-every-move/

<comment><AUTHOR> Which company is known for spying its users the most? Yahoo or Google?</comment>


-= sequoia capital =- - <AUTHOR> http://tlrobinson.net/misc/sequoia.html

<comment><USER2> This is actually more informative than their current site!

<comment><USER3> And at least on par with their last site as I remember

</comment></comment><comment><USER4> It's a webpage from the future! All of the tags are lowercase and some of them have these "style=" attributes with some weird programming language in them!

</comment><comment><USER5> Doesn't validate, you have a </P> tag - what is that? Everyone knows you don't close your <P> tags.

What's that extra slash after the BR and HR?

And </li>?? Since when?

Where did you learn to program HTML?

:)

<comment><USER6> Sheesh, sorry. I fixed it, per your suggestions. Also, all tags and attributes are capitalized, and there's no quotes around attribute values.

</comment></comment><comment><USER7> A colleague of mine wrote about agencies moving to this odd, search-style site a few months back:

[http://www.newmediacampaigns.com/page/big-ad-agency- websites...](http://www.newmediacampaigns.com/page/big-ad-agency-websites- continue-to-get-worse)

It just doesn't make any sense. It's not even trendy.

</comment><comment><USER8> I can understand submitting this link to Digg / Reddit / 4Chan.

But why here? It's nonsense

<comment><USER5> Yah, it does seem that way.

It's actually a list of companies that Sequoia Capitol has invested in. So it's sort of an in joke given the startup focus this site has.

<comment><USER6> It was actually inspired by this comment: <http://news.ycombinator.com/item?id=772027>

</comment></comment></comment><comment><USER9> Man I love that under construction animated gif.

That was a standard on all sites for so many years...

<comment><USER10> yeah, because really, when is a site _not_ under construction??

</comment></comment><comment><USER11> Needs more blink.

<comment><USER6> Apparently the BLINK tag doesn't actually work in some modern browsers, so I had to reimplement it in JavaScript. If you'd like to use it on your own site, here's the code:

        var blinkOn = 1;
        window.setInterval(function() {
            var blinks = document.getElementsByTagName("blink");
            for (var i = 0; i < blinks.length; i++)
                blinks[i].style.visibility = blinkOn ? "visible" : "hidden";
            blinkOn ^= 1;
        }, 500);

<comment><USER5> Just a small note - you should not explicitly set the visibility to "visible", set it to the empty string "" instead. This way you don't overwrite the default property if it was something else.

And you can skip the blinkOn variable by:

      blinks[i].style.visibility = blinks[i].style.visibility == "" ? "hidden" : "";

<comment><USER12> That's actually way slower because you're doing a comparison within an iteration. That's putting an if statement inside a loop while the result is the same for every iteration.

<comment><USER5> Computers are not that slow these days :)

It reduces complexity and a global, which is far more important.

And that blink loop is probably not that big - just how many blink tags do you have?

I don't use it for blink loops anyway, I use it for toggle on/off, where keeping state for each element individually is pretty important.

<comment><USER12> You're accessing the DOM every iteration, so I'd bet that it does matter somewhat if blink is used a lot.

You can avoid polluting by make it an actual function and then setting the function.blinkOn instead.

You're right: individually swapping them this works better, but the intent is to have them all off or all on.

      (function() {
        var blinkIterator = function() {
            var blinks = document.getElementsByTagName("blink"),
             onOff = blinkIterator.blinkOn ? "" : "hidden";
            for (var i = 0, l = blinks.length; i < l;)
                blinks[i++].style.visibility = onOff;
            blinkIterator.blinkOn ^= 1;
        };
        blinkIterator.blinkOn = 1;
        window.setInterval(blinkIterator, 750);
      })();

</comment></comment></comment></comment></comment></comment><comment><USER13> Wow, I really miss the days of black text on a gray background. * sniff _

<comment><USER14> Expect it to make a glorious comeback because of OLEDs: <http://static.arstechnica.com/amoled.jpg>

source: <http://arst.ch/60n>

</comment></comment><comment><USER15> No <marquee>? I'm disappointed.

<comment><USER16> Might not work in all browsers, but check your status bar.

<comment><USER17> It could definitely use a "this site best viewed with Mosaic 1.0" or something to that effect.

<comment><USER18> And a visitor counter.

</comment></comment></comment></comment><comment><USER19> Fantastic. Their new site is ridiculous "look how trendy we are".

<comment><USER20> I actually think their site is pretty cool / innovative.

<comment><USER21> Seriously?! If search engines had AI, I can see it being cool/innovative. With the current state of search technology, it's a usability disaster.

Problem #1 - language. Is their portfolio page called "portfolio"? Or "companies we've invested in?" Is their contact page called "contact"? Or "Get in touch?" Do they have a blog? Searching for "blog" seems to indicate that they don't-- unless it's called something other than "blog". Search is hard and they are making their users play "guess the right search query" when a scan/browse action would be easier and less error prone.

Problem #2 - scan-ability. So say I AM interest in learning more about their portfolio. Roughly what types of companies do they back (what's the search query to answer that question?)? What have they backed most recently (again, what search query?)? Who works there (a search for partners suggests "Energy (partners)")? Scanning is a huge part of web behavior.

Problem #3 - discoverability. What about what I'm NOT searching for? They have some GREAT content around how to pitch VCs, what ideas are VC-worthy, etc. With a content-free page, there is a 0% chance of me learning about stuff that I didn't know I was looking for.

Problem #4 - SPELLING. Take a look at their partner page (if you can find it). Are there any names there that you might have trouble spelling/searching for if you heard it at a dinner party last night?

We don't have to guess with usability. What they SHOULD have done is write down 5 tasks that people might do at their site and had a few friends run a few informal tests.

I'm willing to turn in my UX designer badge if my guess is wrong and this UI increases task performance speed and reduces errors.

Hrm, as I consider it-- I guess your comment doesn't dispute all that. It probably can be cool, innovative, AND a usability disaster.

</comment></comment></comment><comment><USER22> The top text blinks.... Plus 1000 points

</comment><comment><USER23> OMG so hilarious!

Budd Ugly is a classic of web design parody, except that my buddy (a hypertext legend) thought it was a real site!

</comment><comment><USER6> Context: <http://news.ycombinator.com/item?id=772027>

</comment><comment><USER24> Wow, trendy stuff. I'm going to have to start using that window.status trick they're using.

</comment><comment><USER25> Many more of those companies should have gotten the "Cool" animated gif...

</comment><comment><USER26> Awesome, but is there a reason 'capital' is misspelled 'capitol'?

</comment><comment><USER27> Was spelling capital wrong part of the parody too?

<comment><USER6> Yes.

</comment></comment><comment><USER28> needs a bright green background to emphasize the tree connection.

<comment><USER29> What, and lose Netscape 1.0 support?

</comment></comment><comment><USER30> I lol'd.</comment>


Edward: An IDE for novel-writing - <AUTHOR> https://github.com/isaaclyman/Edward-the-App <comment><AUTHOR> Edward is a webapp for writing novels. I built and launched it over the last six months as a side project. The app was made with Vue, Node, and PostgreSQL. There's an unlimited-time free trial, so give it a look and let me know if you have any feedback.</comment>


How big brother and big media can put the Internet genie back in the bottle. - <AUTHOR> http://www.fourmilab.ch/documents/digital-imprimatur/ <comment><USER2> This is from 2003. It's not entirely outdated, but it is rather quaint.

The author foresees a future where everyone has to use personal certificates to communicate, which has various pros and cons - while enabling commerce, it could be the end of anonymity. He didn't anticipate a world where the government is simply hoovering up all the plaintext.

<comment><USER3> These personal certificates are turning out to be Facebook accounts, which is arguably worse.

<comment><USER4> Are there any important sites (like news / discussion sites) that require this?

</comment></comment></comment><comment><USER5> Microsoft wants ARM machines to be locked in Windows 8 mode, probably to block Android. From what I can tell, it goes both ways. Existing Android tablets are not Windows8-certified, so they won't run it.

Microsoft being the runner-up in the tablet market, I find the move puzzling. What do they have to gain? Why would vendors want to lock themselves in the hands of Microsoft, given MS's past behavior?

More puzzling yet: what is the force in the Microsoft DNA that prompts them to systematically return to this kind of anti-competitive behaviors as soon as they get a chance?

<comment><USER6> Remember the BCG matrix? I think Microsoft is desperately trying to keep Windows in the "cash cow" quadrant, while the consumer is starting to look at it as a "dog." For teens and people in their 20s, Windows is the OS that your mom and dad use. I just think the product has run its course. Just like GM couldn't revive Oldsmobile, Microsoft (the GM of the software world) can't revive Windows. Android and iOS already own the tablet/handheld space. That war is over, unless Apple and Google seriously stagnate. Microsoft had more than their fair share of shots at winning that and failed miserably, because their approach was always one of expanding lock-in to Windows rather than really building stuff that people enjoyed using.

<comment><USER7> I mostly agree, especially your last sentence. With the exception of our Exchange/AD environment at work (which everyone uses Macs on top of) I only boot Windows when some piece of software I can't get around requires it. I've used a combination of OS X and various Linux flavors to do everything for a few years now and haven't missed MS one bit.

My father on the other hand (who told me I was nuts back in the 90's when I explained how Linux/OSS would change everything) still clings to Windows even though it's a major source of frustration for my folks. I would even raise the age you posited, as I am in my early 30's (though it could just be that I'm immature).

I disagree with your assertion that the war for mobile is won, however. I think MS is down, but certainly not out. If the last 10 years are any indication, things can turn around in the blink of an eye.

</comment></comment></comment><comment><USER8> This article seems to focus on closed-source solutions. What about Linux? If the Trusted Computing code would be open-source, that creates another rather huge problem for the big brother and big media. Does that mean Linux machines would be unable to connect to the internet? Or would they need closed-source Trusted Computing drivers instead?

<comment><USER9> From the article:

> Consequently, a trusted computing platform must validate the signature of an > operating system before booting it. Operating systems not certified as > implementing all the requirements of Trusted Computing will not be issued > certificates, and may not be booted on such systems.

This has already happened with Windows 8 verified hardware. If you want to run another OS, you (or rather, the OS maintainers) have to pay the $99 Microsoft (ed: VeriSign, see below) tax to get a Microsoft-signed bootloader and kernel. (Fedora has already done this.) A decent write-up is here with some comments from Linus: [http://www.zdnet.com/blog/open-source/linus-torvalds-on- wind...](http://www.zdnet.com/blog/open-source/linus-torvalds-on- windows-8-uefi-and-fedora/11187) It's kind of disturbing when the main reassurance is "Hackers will get around it. Probably."

<comment><USER10> > This has already happened with Windows 8 verified hardware. If you want to > run another OS, you (or rather, the OS maintainers) have to pay the $99 > Microsoft tax to get a Microsoft-signed bootloader and kernel.

No. While that is an option -- if you want to _use_ Secure Boot -- MS is requiring certified x86 machines to allow disabling Secure Boot entirely. Does that make it more difficult to install? Marginally, yes; it adds additional steps. Does it mean that you have to jump through the signing hoops? Absolutely not.

<comment><USER9> For now. The story is different for ARM devices, however, unless there has been an update to that policy that I missed.

<comment><USER10> Yes, ARM still doesn't allow unsigned kernels to run; I mentioned x86 specifically in my post.

That said, the "For now." is fearmongering. It's very possible that MS could change things, but that doesn't mean we should make that assumption -- that's just FUD. There are plenty of legitimate things to gripe about around the Secure Boot stuff, but potential future changes to the policies aren't high on the list.

<comment><USER11> Sorry, but there is FUD and FUD.

When Microsoft claims Linux violates their patents, that it lacks the level of service companies require or that it destroys value, it is FUD. Microsoft does it very well.

But when we raise the possibility Microsoft will act in its best interest in the future (which is to block competition) I'd argue it would be a fair extrapolation from previous behavior. Microsoft consistently engages in anti- competitive behavior and it would be naïve to expect a sudden surge of morality from its top executives.

</comment></comment></comment></comment></comment></comment><comment><USER12> Wait, can someone explain what the hell is going on?!?!

Last I heard the no-images-except-signed ones was for for ARM devices only. Did MS just put this into x86? Can you turn it off in the BIOS?

<comment><USER13> No, nothing's changed except for people getting hot and bothered at the possibility that it could be turned off for x86.

<comment><USER14> Which, I think, is a valid fear to have considering MS is basically just decreeing this. Like they say, rights disappear in degrees.

</comment></comment></comment><comment><USER15> How was this peer-to-peer Internet actually put to use, and why isn't it used that way anymore? I think I could name Usenet, but what else? Most of things I do on the Internet nowadays is using the www - a hierarchical structure. But were there p2p equivalents of any of the websites we use today?</comment>


Wanting it more - <AUTHOR> http://www.marco.org/2013/04/26/wanting-it-more

<comment><USER2> _"Before, it was effectively merit-based: whoever cared the most (and had the money and ability) to get a ticket could get one."_

I'm not sure Marco understands what "merit-based" means.

</comment><comment><USER3> This exact same problem has existed with music concerts for years. Many solutions have been tried, none have worked yet. The main problem is that the people selling the tickets _don't care_ who buys them.

I know, there'll be arguments that Apple should look after it's most devoted fans, but the same applies to any band / artist. If the current biggest fans don't get tickets, the band / artist don't really care as they've sold the tickets to people who will be the _next_ biggest fans. What the companies / artists / promoters are forgetting is that their customers now have the ability to communicate _very_ quickly and effectively with each other. This leads to lots of public, negative feedback. This isn't currently a large enough effect to change system.

Thankfully, with this problem existing in a much larger space than software developer's conferences, the negative feedback effect should become quantifiably apparent to various music promoters well before it becomes apparent to any developer's conference promoters, and the pattern will change.

In both cases I see this being a variant on some form of loyalty reward. Maybe, if you buy the album / release an app, you get (for example) 10 minutes advance notice for ticket purchases. I can see this working, but it will take a while for the ecosystem to work out the correct ratio of loyalty to reward.

I hope it happens soon, I'm sick of missing out on concert tickets because they sold out in half a second. (slight exaggeration, but it won't be long before it's reality)

</comment><comment><USER4> Make new friends? Meet new people? Learn new things? Rather presumptuous to assume that just because 'your friends' won't be there, those who will aren't going to be 'as good' for an arbitrary definition of good.</comment>


Show HN: RSpec results on a Novation Launchpad - <AUTHOR> https://github.com/rixth/rspec-launchpad

<comment><USER2> ^^ this is really cool. But what do you do when the specs exceed the available buttons?</comment>


Atari 2600 analysis via Let's Play Solaris + Breaking Down "The Story of Mel" - <AUTHOR> http://lparchive.org/Solaris/ <comment><AUTHOR> Saw this a bit ago, interesting.

First half is a playthrough of a quite finicky and fairly impressive-for-the- system game (though, let's be fair, nearly anything but Pong on the 2600 is impressive in some way).

Second half is an in-depth look at how 2600 coding works. See also: Impressive. Highlights include: A debugger/disassembler that fits all of RAM readably in less than a quarter of the window, the use of pixels as a unit of time, and upside-down graphics as a speed hack.

Ends with a bit on The Story of Mel, the perspective of which I rather like.</comment>


Study Has Recorded Increasing Anxiety Symptoms Since the 1930s - <AUTHOR> http://nymag.com/scienceofus/2016/03/for-80-years-young-americans-have-been-getting-more-anxious-and-depressed.html <comment><AUTHOR> One interesting thing about this data is that it records responses to questions of symptoms, so it's more resistant to bias then, e.g. ADHD diagnoses.</comment>


Digging into the Privacy Sandbox - <AUTHOR> https://web.dev/digging-into-the-privacy-sandbox/ <comment><USER2> > The problem is… privacy.

That's awkward phrasing in need of an editor. People love misunderstanding anything to fit their believes and one shouldn't make it too easy for them.

Other than that: this is the right direction. Thanks to Apple might be appropriate.

There is a middle ground here and I wish the wider community would be more open to exploring that space. Ad blockers, especially, are still competing to block as much as possible. I'm sure there is space for more intelligent blocking that decides based on advertiser/publisher/ad network/format.

With a bit of individualization, such a blocker might allow clearly marked text ads everywhere, your favorite band would get the privilege of full-screen auto playing video with sound. If you're into music production, Ableton ads would get through even where MS Office does not. If you believe not all professional journalism deserves to die, display ads on FiveThirtyEight are shown while they're blocked on Pinterest. Animation in the header might be ok, but in between paragraphs (where it's more distracting) it's blocked, etc.

Unfortunately, the ad networks have poisoned the relationship between publishers and readers, and people seem almost eager to inflict pain even on the creators they rely on. Case in point: the self-appointed "brave" browser, boldly answering the question "why isn't there another middleman between creatives and their audience, skimming another 25% off all revenue?"</comment>


Cisco is buying Duo Security for $2.35B in cash - <AUTHOR> https://techcrunch.com/2018/08/02/cisco-is-buying-duo-security-for-2-35b-in-cash/ <comment><USER2> Based on [https://www.crunchbase.com/organization/duo- security#section...](https://www.crunchbase.com/organization/duo- security#section-locked-charts) that looks like quite a nice exit.

$121M raised, and $2.3B sale price...</comment>


Ask HN: Any good Swift training courses in London? - <AUTHOR> Hi UK people,
Work give us a training budget of around £500, it's a use it or lose it situation.
As an iOS developer I thought an advanced Swift course might get me out the office for a few days ;)
Does anyone know of any decent courses like that in London? Preferably in person, during weekdays and not too far in the future.
- I'm open to other suggestions on how to spend the training money (no conferences though), user interface stuff could be quite interesting too.
Thanks! <comment><USER2> This is the only reputable one I'm aware of but no doubt there are others: [http://www.amsys.co.uk/course/beginning-swift- development/](http://www.amsys.co.uk/course/beginning-swift-development/)

<comment><AUTHOR> Thanks for letting me know Peroni :) I actually come across Amsys ones in my Googling, can be difficult to know if they're legit or not though.

<comment> char-am Hi JonCox...

Charley from Amsys here... just thought I'd let you know we're an Apple Authorised Training Company and have been teaching iOS development courses for the last 5 years. We have a range of Swift dev courses. If you're already an iOS developer then we'd recommend this course.

[http://www.amsys.co.uk/course/advanced-swift- development/](http://www.amsys.co.uk/course/advanced-swift-development/)

Also.. as we're approaching the 1st anniversary of Swift... you can book on any Swift course running in June and save 20%.

Thanks, Charley

<comment><AUTHOR> Thanks Charley, have just booked that course :)</comment></comment></comment></comment>


Google+ struggles to attract brands, some neglect to update - <AUTHOR> http://news.yahoo.com/analysis-google-struggles-attract-brands-neglect-120219911.html

<comment><AUTHOR> Rumors are that Google favors those with Google+ 'likes' so I'm surprised businesses are taking a chance of not using them more. The pro/con scenarios are in favor of having an active Google+ page, at least for large businesses and brands.

But personally, the more they try to trick or force me to create a G+ account, the more I avoid them.</comment>


Building storage-first serverless apps with HTTP APIs service integrations - <AUTHOR> https://aws.amazon.com/blogs/compute/building-storage-first-applications-with-http-apis-service-integrations/ <comment><USER2> These technologies are fascinating and make good sense for some APIs for sure. But if I look at our APIs, and I don't think we're unusual, they characteristically are not "fire and forget". Instead, the API call actually returns some data in the API response! Even for POST /widgets, I want to pass back an identifier for the just created widget, not a 200 code that means "request accepted and queued but no data available right now".

The uses for APIs that don't return data seem pretty limited in our realm (SaaS). One example is handling incoming notifications/webhooks from other systems. By their nature these are asynchronous and the caller (the external system) does not usually expect a meaningful response, so for sure we can use SQS to buffer the incoming API calls.

But for the APIs that we offer, virtually all of them have an online response. In my experience this is not an unusual pattern (for SaaS APIs anyway).

I feel that these technologies are somewhat biased towards super scale systems that are highly decoupled and asynchronous - perhaps the sort of systems that Amazon are used to dealing with in-house - rather than simple old business systems.

<comment><USER3> "The advantage of this pattern is increased application resiliency", as spelled out in the first paragraph. So yes, these technologies are 'biased towards' systems that require this degree of resiliency rather than 'simple old business systems'.

<comment><USER2> Simple old business systems require resilience too.

</comment></comment></comment><comment><USER4> This is awesome and long overdue. Providing a simple way to go directly from an HTTP endpoint to SQS, Event Bridge or Kinesis makes it much easier to build more robust webhooks or tracking endpoints.

I have tried doing similar things in the past,using API Gateway and SQS without Lambda, and it was a huge pain.

I wish they had skipped coining the "storage-first" buzzword though. I mean, I get it, but I feel like it hurts more than it helps.

My first assumption was that they were just talking about writing data to S3 and then using Lambda to process after.

</comment><comment><USER5> What I want is a storageless-first serverless connectionless computerless apps.

<comment><USER6> I think you may have just invented the whiteboard.

</comment></comment><comment><USER7> This is all nice, but here is the important part you gotta remember - the more you take dependencies on AWS and its integrations, the harder it will be to actually have any flexibility and say in your own systems design. AWS is interested in taking your money first and foremost as well as having you depend on it from one side to another of your stack. Instead I'd look at containerizing my workflows and only using cloud tools on the edge (like load balancing).

</comment><comment><USER8> There is so much dependency on proprietary technologies here that anyone pursue anything serious should just stay away from the suggested architectures. If AWS were to raise prices in the future or to kick you off the platform, it would be that much harder to move elsewhere.

<comment><USER9> Would you say the same thing to someone building all their software to compile on Intel? What if Intel doubles the prices of their CPUs? Then what?

The lock in argument is sort of silly. Everything has some sort of lock in. It's just a question of whether the benefits outweigh the potential costs of the lock in.

In the case of AWS, they give you incredible velocity since you don't have to built any of the infrastructure before you get started.

<comment><USER10> > Would you say the same thing to someone building all their software to > compile on Intel?

If they're targeting Intel processors only and not x86 more generally? Yes, I would.

Otherwise, there's at least one credible competitor (AMD) that'll gladly sell you compatible processors, who I'm sure would be happy to see the increased sales if Intel jacked up their prices.

<comment><USER9> AWS has two competitors, so I'd make the same argument back to you.

<comment><USER10> As a sibling comment pointed out, applications built for x86 PCs don't even need to be recompiled to run on compatible processors by another manufacturer. (Heck, even across architectures you can usually recompile relatively easily provided the software is written in a high-level language with a compiler available there.) That is very much not the case with cloud providers' APIs; they're largely provider-specific.

The closest equivalent in the cloud provider ecosystem is probably Kubernetes; there are provider-specific extensions (and I recommend avoiding those where possible) but largely things work the same across providers.

I'd say a more representative example of lock-in in the PC ecosystem is that of proprietary OS vendors. If you're targeting specifically iOS/Android (w/ Play Services)/macOS/Windows/etc, then yes, you're beholden to the vendor (to varying degrees in each case).

You may accept that risk, but you should always be aware of it.

</comment></comment></comment></comment></comment><comment><USER11> How is the the SQS pattern bidirectional?</comment>


Covid-Tracing Framework Privacy Busted by Bluetooth - <AUTHOR> https://hackaday.com/2020/09/03/covid-tracing-framework-privacy-busted-by-bluetooth/ <comment><AUTHOR> > Why didn't the researchers submit a patch? They can't. The Apple/Google code > is mostly closed-source, in contrast to the open-source nature of most of > the apps that are running on it.</comment>


Facebook Is Not the Internet's Only Privacy Villain - <AUTHOR> https://choosetoencrypt.com/news/facebook-is-not-internets-privacy-villain/ <comment><USER2> Companies choosetoencrypt.com sends information to by embedding them in this page:

\- Facebook

\- LinkedIn

\- Twitter

\- Google

<comment><USER3> Is it technically possible to add an image/link like "Find us on Twitter" without embedding anything that ultimately requests a Twitter-hosted asset?

<comment><USER2> Yes, you can. But if your message is that social media networks are "privacy villians" then you shouldn't have a Twitter or a link to it in the first place.

<comment><USER4> Good point, but for people that will have a link anyway, it at least makes service-use consensual.

</comment></comment></comment></comment><comment><USER5> Many of us, as software developers, are taught to solve general problems instead of specific instances whenever we can. That's what I see as wrong with 99% of the commentary about this recently. Sure, there might be a bug in Facebook. Maybe it's a serious bug, and it really needs to be fixed. But it's a bug that manifests in many other places too. It's even possible that Facebook is neither the first nor the worst. Facebook doesn't have "assistants" that listen to your every word like Google and Amazon and Apple do. It doesn't have all of your email, or your entire search history, or the very OS on a device you have with you all the time. But I digress.

The real point is that targeting any "fix" too narrowly toward Facebook, or Google, or any one party doesn't fix it for the others. It might even distract from or interfere with development of a more general solution. But that's exactly the path a lot of people seem to be going. By all means, criticize Facebook if you think they've done something wrong, but _don 't stop there_. Make sure you understand the full scope of the problem, and the options for addressing it _in a general way_ , and the benefits or drawbacks of each approach. Progress doesn't come from everyone saying "me too" on a bug report. It comes from people talking about and then implementing ideas to make the bug stop happening _anywhere_. I've seen precious little of that.

<comment><USER6> Ugh. I hate these sorts of arguments. "ha! you're outraged? Maybe you're not outraged enough! You do something? Do more, you're not doing enough!". If you tell people "if you stop wasting water you don't solve global warming!" it typically won't entice them to do more; most people will hear "I might as well waste the water, my efforts are meaningless anyway".

> But I digress.

Yes you do. Starting with all that makes the reader feel that "they're not even the worst offenders, Google/Apple/Amazon is probably worse". Which may be true but you present no proof for that and it's not even something that you needed to argue.

> By all means, criticize Facebook if you think they've done something wrong, > but don't stop there. Make sure you understand the full scope of the problem

Or stop there if you wish - it's still something. It's certainly better than thinking "I don't have time to understand the full scope, so I'll let others do the criticism".

> I've seen precious little of that.

Well, lead the way. Show us how to do it. Help us understand the full scope of the problem and address it in a general way. Don't just chide people for criticising Facebook.

<comment><USER7> I don't think he is arguing for more or less outrage, he just wants it directed better. I'd argue that picking out one offender and focusing on them is in some ways _worse_ then focusing on the entire issue.

Facebook being slapped with a massive fine/being broken up might not do a lot to stop the general trading and exchange of users data online, but its enough to get the politicians to say "job done" and move onto the next issue. We need to focus on fixing the issues that allowed the FB/CA scandal to occur, instead of just focusing on the symptom.

<comment><USER6> > Facebook being slapped with a massive fine/being broken up might not do a > lot to stop the general trading and exchange of users data online,

Or it might; the other companies are watching, and precedents do matter.

I honestly don't see how bringing Google/Amazon/Apple into this won't do more harm than good. In fact, if I were Zuckerberg, that's exactly how I would try to mitigate the issue for Facebook.

</comment></comment></comment></comment><comment><USER8> I have nothing against Amazon and I had been a happy customer, but when I ponder which company has the most valuable information about me, it's Amazon - by far.

When it comes to Facebook (or other social media companies) it's all about self-portrayal and in the end we have control which information we provide. To some degree at least.

Amazon on the other hand has direct unfiltered buying behaviour data. Isn't this advertiser heaven?

<comment><USER9> Amazon doesn't have a million photos of me, hourly location data, and lots of other things freely provided by my "friend" network.

I'm glad there are no friends on Amazon.

<comment><USER8> > Amazon doesn't have a million photos of me,

Yes, but what good are they to make you buy stuff or otherwise spend money?

> hourly location data,

Location data is a commodity nowadays, if Amazon want's your locations data, it can have it.

> and lots of other things freely

Your messages, which are probably much more useful than your photos and your location, but what else?

My point is that Amazon's data is much more valuable, but I'm neither in advertising nor data brokerage so I might as well be wrong.

<comment><USER10> You're assuming that targeting people's finances is the best way to leverage the data collected. In Facebook's case, they are using it to literally assert influence over masses of people. When other groups get access to that same data, then they too can use that data to assert influence because that's literally what the platform has been developed into (not implying this was Facebook's intent all along).

I think these groups targeting your pocket book may have the most immediate effect on your person -- however -- I don't think it's the scariest or most malicious outcome.

<comment><USER8> That's a good point, actually.

</comment></comment></comment></comment></comment><comment><USER11> Databrokers enable this - take a look at something like Acxiom's developer APIs.[1] You'll find that they have some quite interesting stuff, like whether someone's interested in gambling.[2] Facebook partners with these folks (as do many others) to enable them to build this aggregated database.

Interestingly, you can log in and see your own profile there. I did that a few years ago, and introduced subtle errors into it (e.g. I changed my car to a different brand of car, and the "extended warranty services" robocalls around a year later started calling about my nonexistent vehicle).

[1] [https://developer.myacxiom.com/code/api/data- bundles/main](https://developer.myacxiom.com/code/api/data-bundles/main)

[2] [https://developer.myacxiom.com/code/api/data- bundles/bundle/...](https://developer.myacxiom.com/code/api/data- bundles/bundle/gambling)

<comment><USER12> How do you see your own profile?

<comment><USER11> Register at [http://aboutthedata.com](http://aboutthedata.com) to gain access to your profile.

</comment></comment></comment><comment><USER13> FYI: this article & website are plugs for the owner's "private" search engine:

[https://www.searchencrypt.com/](https://www.searchencrypt.com/)

which seems to be heavily ad-laden (e.g. searching for "free" gets you ads, which it doesn't on Google).

</comment><comment><USER14> Spotify reserves the right to sell your details/listening habits when their terms of use changed... (ie genres of music you like, the types of musicians etc)

Is this facebook data being funneled back to the record labels and their parent companies to sell advertising? my research says its likely, this feels similar to the CA situation, just not as political..?

<comment><AUTHOR> If you use Facebook to login to Spotify then that information is definitely available. The information doesn't even need to be sold to the record labels. If the labels then use Facebook ads, the targeting can be as specific as someone who likes a particular band or song.

The fact that people use Facebook to login to EVERYTHING, means that Facebook has access to their usage data.

<comment><USER15> No, that's not true. If Spotify sells the data without anonymizing it, then it could tracked back to Facebook, but otherwise OAuth only provides them with your email and Facebook ID: listening data doesn't flow anywhere automatically.

A different thing is Facebook gadgets on random websites while you are logged in into Facebook.

<comment><USER14> Yes i think is correct, so the data could be sold by either Facebook, spotify (or both) to 3rd parties.

(Direct quotes from their privacy policy below)

"Consistent with the permissions you give us to collect the information, we may use the information we collect, including your personal information:

1\. to provide, personalise, and improve your experience with the Service and products, services, and advertising (including for third party products and services) made available on or outside the Service (including on other sites that you visit), for example by providing customised, personalised, or localised content, recommendations, features, and advertising on or outside of the Service;"

....

And here are some of the parts about data collection:

"We may also collect other information available on or through your Third Party Application account, including, for example, your name, profile picture, country, hometown, email address, date of birth, gender, friends' names and profile pictures, and networks.

You may also choose to voluntarily add other information to your profile, such as your mobile phone number and mobile service provider.

...

"When you use or interact with the Service, we may use a variety of technologies that collect information about how the Service is accessed and used. This information may include:

information about your type of subscription and your interactions with the Service, such as interactions with songs, playlists, other audiovisual content, other Spotify users, Third Party Applications, and advertising, products, and services which are offered, linked to, or made available on or through the Service;

The details of the queries you make and the date and time of your request; User Content (as defined in the Terms and Conditions of Use) you post to the Service including messages you send and/or receive via the Service; technical data, which may include URL information, cookie data, your IP address, the types of devices you are using to access or connect to the Spotify Service, unique device ID, device attributes, network connection type (e.g., WiFi, 3G, LTE) and provider, network and device performance, browser type, language, information enabling digital rights management, operating system, and Spotify application version. motion-generated or orientation-generated mobile sensor data (e.g., accelerometer or gyroscope).

You may integrate your Spotify account with Third Party Applications. If you do, we may receive similar information related to your interactions with the Service on the Third Party Application, as well as information about your publicly available activity on the Third Party Application. This includes, for example, your "Like"s and posts on Facebook. We may use cookies and other technologies to collect this information; you can learn more about such use in the section Information about cookies and other technologies of this Privacy Policy."

</comment></comment></comment></comment><comment><USER16> To me it's an issue of cost vs reward.

While I would love to see greater privacy awareness and consideration from all entities I use, the fact is that there are certain web properties that I find indispensable and without a privacy considered alternative.

Facebook I can live without, likely even happier than with it. I also think that the social contract of "sell me as a product in exchange for enabling my social communication" is not the correct paradigm, and once there's a user friendly alternative similar to secure scuttlebutt (i.e. Mozilla level friendly), that best represents the proper social contract (I'll provide hardware resources to enable my social communication).

<comment><USER17> That sounds nice but it's a pipe dream.

<comment><USER18> Not with that attitude.

Seriously, writing off any attempt at discussing or fixing the problem because "it's a pipe dream"/"network effect"/etc will ensure that you do end up going nowhere.

</comment></comment></comment><comment><USER19> It's not news that Facebook is gathering and storing TONS of information about its users (and even non-users). Google, Amazon, Apple, Microsoft are all guilty of the same thing.

<comment><USER20> The difference is the extent to which those companies make that data accessible to third parties.

Disclaimer: I work for Google

<comment><USER21> What is the _actual_ difference between Google/Facebook and "third parties"? Google actively uses information it gets about me in ways I don't approve of, and generally can't opt out of without stopping use of the services entirely.

Sure, Cambridge Analytica was using the data to influence an election, but Google is not shy about it's own social activism, and it's efforts to manipulate users into seeing it's view of the world.

Google's only protective of our data for selfish reasons: If you sell our data outright, the third party doesn't have need of you anymore, but if Google maintains a tight hold on the data, Google can continually sell the ability to make use of it (through Google's advertising services and the like) over, and over, and over.

The harm to me is the same either way.

<comment><USER22> Google keeps a tight hold on the data, whereas Facebook had APIs that allowed FB-apps to crawl segments of the FB graph. By doing that thousands of times, apps could export a large part of the data, and FB lost control over how the data could be used. By contrast, Google retains control.

I understand your point that we as end-users don't have any control over the way the data is used in either case. But I do think there is a material difference between the two scenarios.

<comment><USER21> I just don't see why "Google retaining control" is a positive, when Google is as hostile an actor as Cambridge Analytica. If companies are going to use data to sway public opinion and tailor advertising, how much does it really matter which company is doing it?

<comment><USER23> This is sort of like saying all political parties are the same. We can and should make distinctions.

<comment><USER21> What makes Cambridge Analytica worse than Google, specifically? Is the distinction you can draw between the two objective, or subjective to your personal view (or political party)?

(From what I've found, most people upset with "all political parties are the same" are people who belong to one, and are upset that they get grouped in with people who do the exact same things they do. Not "all political parties" are the same, but the two of them I deal with as a US citizen definitely are.)

<comment><USER24> > What makes Cambridge Analytica worse than Google, specifically?

The outright lying about purpose thing, by which CA's key data was gathered, for starters.

<comment><USER21> I would argue both Google and many other data collection based companies do this as well. Data is collected under the auspices of being able to "provide you with better services", even though the actual purpose is to target ads to you more accurately. (They may have better legal disclaimers and statements of how data will be used stuffed in their EULAs nobody reads, but I don't feel that's much less deceptive in reality.)

</comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER25> Completely by the by but is the scrolling on this page screwed up for anyone else? Seems to have a weird slow non-native scrolling method for me. I'm running Firefox on Android

<comment><USER26> Yeah, looks like custom JS scrolling. I hate people that do this.

<comment><USER27> It's the worst. Disabling Javascript temporarily can work around this. Or using Reader mode... Assuming the content is worth it to you.

<comment><USER28> And disabling JS permanently makes almost all other websites better!

</comment></comment></comment></comment><comment><USER29> Recommend this: [https://books.google.com/books/about/Surveillance_Valley.htm...](https://books.google.com/books/about/Surveillance_Valley.html?id=65WYDgAAQBAJ&printsec=frontcover&source=kp_read_button)

</comment><comment><USER30> Most media criticizing Facebook run Google Analytics and many other trackers. Fortunately HN is clean, according to Privacy Badger.

<comment><USER31> This equivalence is false. Facebook's business is selling access to your private data to third parties. Google's business is not that. They are not the same.

<comment><USER28> Google's business is tracking me despite me not wanting to be tracked. It doesn't matter what they do with that data, I don't want them to have it.

There are differences, but they aren't worth worrying about. You are still vulnerable to being abused by Google's data about you as well as Facebook's data.

<comment><USER30> Yes, what's annoying is that if you are using Gmail, you are automatically logged in on all other Google services, including Maps, YouTube etc. When I'm searching a doctor's address or watching a stupid video on YouTube (most of the time embedded in some other webpage), I don't always want it to be added to my history. [https://myactivity.google.com](https://myactivity.google.com)

Now I'm using Firefox Multi-Account Containers to separate Gmail from the rest. And I am considering switching entirely to ProtonMail.

<comment><USER31> FYI this isn't true in all contexts. For example if I log into Gmail for iOS that does not log me into the Maps app on iOS.

</comment></comment></comment></comment></comment><comment><USER32> And Cambridge Analytics isn't the only election campaign "influencers". But for some reason, the focus is only on facebook and cambridge analytics.

<comment><USER33> Probably because, and not to get too political but, the perceived slight from those two was helping Trump. Though, I don't think there is much data that supports the notion that data analytics helped Trump more than Hillary. I think the argument that Hillary's ground game was horrendous holds up more under scrutiny.

</comment></comment><comment><USER34> Perhaps the government should protect us more actively. It could hand us fake- ids we can use when dealing with these companies. And it could give us fake home addresses, etc. Like a witness protection program, but for everybody. And it could provide an API for sending (e)mail to real users, using their fake info. And it could set up a VPN service for everybody to mask IP addresses.

<comment><USER19> The internet has been a "wild west" for its entire existence. While this allowed it to grow and improve freely, it also brought about bigger issues. Government intervention could work, but the government getting involved in tech usually sucks.

<comment><USER34> > the government getting involved in tech usually sucks

The internet was built by government organizations (e.g. DARPA, NSF)

</comment></comment></comment><comment><USER35> What? Who would have thought?

[https://prism-break.org/en/](https://prism-break.org/en/)

</comment><comment><USER36> Malwarebytes flagged this page as malicious; and umatrix lists a lot of javascript from elsewhere.

</comment><comment><USER37> Yes, the other companies are probably just as bad, but one at a time, please. It is very hard to keep the attention of the man on the street, we should not split it across multiple companies.

<comment><USER19> Only focusing on Facebook's scandal shifts attention away from the real issue, which is tracking on the internet in general. Most people aren't aware of the extent to which they are sharing information.

<comment><USER38> Focusing on Facebook gives the benefit of _focus_. Techies have been warning people for years about tracking on the internet, but "tracking on the internet" is a vague premisse.

It's by bringing the actions of popular bad actors to light that we'll raise awareness to the rest. People need something tangible that they see is affecting them, and Facebook's scandal is just that.

<comment><USER39> > It's by bringing the actions of popular bad actors to light that we'll raise > awareness to the rest.

What usually happens is that the one "bad actor" gets turned into a "bad apple," convincingly repents, is renamed, or is dismantles, other companies have a quiet period during the media frenzy to avoid being the next focus, then continue with impunity.

If focusing on facebook brings legislative changes, then good. If focusing on facebook just punishes facebook, who cares?

<comment><USER38> > If focusing on facebook just punishes facebook, who cares?

Everyone. Punishing one single bad actor (and one of the biggest, at that) is indisputably better than punishing zero. By having one answer by the consequences of their actions, the others see the same can happen to them.

The math is simple. A bunch of little people against multiple tech giants. There's no way the people have a chance to deal with all the giants at once. One at a time, maybe.

</comment></comment></comment></comment></comment><comment><USER40> Steve Jobs actually envisioned building an ads product where the ads were actually beautiful and enhanced the user experience, in his final years. That was the idea behind iAd. I occasionally get these types of ads from youtube where I'm actually glad they showed it to me. No other ad product has ever met this bar for me including fb so that's why I think they deserve the market's current skepticism, that and allegedly selling political ads at different CPMs to different parties (this is not legal in other types of media).

<comment><USER19> The price gouging is a whole other issue...which is a by-product of the availability of this data.

If Facebook/Google are really gathering our data to enhance advertising, it isn't helping the end user. Although it could, if they shifted their focus from ad revenue to user experience (not gonna happen).</comment></comment>