Settings

Theme

Don’t Fix Facebook, Replace It

nytimes.com

402 points by jenkinsj 8 years ago · 280 comments

Reader

vinniejames 8 years ago

We did replace it, almost 10 years ago. It was called Diaspora[1], no one cared about privacy then. No one really cares about privacy now, at least not enough to do anything about it.

1. https://en.m.wikipedia.org/wiki/Diaspora_(social_network)

  • Jean-Philipe 8 years ago

    Diaspora is actually worse for privacy, because of its distributed nature. Diaspora is about distributed ownership. If you value privacy in a social network, check out https://github.com/ssbc/patchwork

    • soapdog 8 years ago

      Hey I Love Scuttlebutt, I am actually writing a client for it. But I don't think the objective here is privacy. If I follow you on ssb, I will start replicating your feed (unless you block me), and all you post publicly will be in my own HD which I could use to generate some "intelligence". There are no incentives in ssb for those marketing type actions we see on FB and Twitter but we can still mine it. Of course your private communication is private, but the public feed is very public.

      • fenwick67 8 years ago

        SSB does support encrypted private messaging, notably.

        You could send a private message to a group of (7 or fewer) friends and then only they could open it.

        • soapdog 8 years ago

          yes and as far as I know there is work being done to make private channels a thing. So in the near future, private conversation might be able to include more than 7 people.

          I just have this feeling that people sometimes talk about SSB as if it is like "private by default" and thats not really the case, public feed is quite public (and I don't think that is bad).

          I for example considered using private messages to myself as a diary. I know they will remain private.

    • yndoendo 8 years ago

      IPV6 is really needed to create social media distribution with customized privacy. Example, use a smart phone as the actually distributing and access control system. This way a person can instantly block and know who is accessing their content too. End to end encryption communication with content distribution.

      Of course this is more into the future when Cellular ISP are better with less strict data caps and better upload speeds along with not having to connection to Apple or Google or Amazon for Voice to Text / Command / Action solutions and smart phones actually have a viable storage capacity.

      • agsamek 8 years ago

        Please do not downvote this comment. It may not make technical sense for you but there is nothing wrong with the comment otherwise. The author has some vision and shared it with us.

  • verylittlemeat 8 years ago

    Man I remember the enthusiasm behind Diaspora like it was yesterday. I can still see in my minds eye that NYTimes article photo of the creators sitting around like they just invented cold fusion or something.

  • tomcooks 8 years ago

    It was not about privacy, it still isn't about privacy.

    It's about usability, and the flocking to Mastodon when there are better options around is the proof of this theory of mine.

    • jug 8 years ago

      Yes. It's absolutely about four simple steps:

      1. Going to a mobile-first website or app.

      2. Clicking a link.

      3. Typing in your new e-mail and password.

      4. Being able to add anyone in the world as friends.

      It cannot be about local "hubs" vs the global "public" / federation, being forced to make that distinction would feel like a step backwards for the users. It can be distributed in the back end, but not in the front end.

      It also needs to look beautiful.

      • catach 8 years ago

        I'd say Reddit is good evidence that the beauty element is optional, for the goal of Many Users.

        • criley2 8 years ago

          Reddit is a perfect example of a tech-focused product for a minority of young, white, tech-oriented men (and a minority of others) that while it influences the outside world, is mainly invisible to it.

          If you want to build a reddit, you'll never end up with a facebook, that's just reality, the target demo is completely different.

          • catach 8 years ago

            According to Alexa stats, Reddit is 6th in the world and 4th in the US [0], while Facebook is 3rd and 3rd [1].

            [0] https://www.alexa.com/siteinfo/reddit.com

            [1] https://www.alexa.com/siteinfo/facebook.com

          • davvolun 8 years ago

            I don't think that's true. I don't think I know anyone who doesn't at least occasionally use Reddit; my aunt told us a story at the family get-together that started "I saw this on AskReddit...".

            Certainly anecdotal evidence, and I'm inclined to believe the largest user base may still match your description, but personally I feel like you're describing 4chan, not Reddit.

          • 908087 8 years ago

            If that was the case, I wouldn't expect to see so much objectively false information treated as fact and massively upvoted in subs such as /r/technology. Reddit's user base might enjoy the belief that it is technically skilled and knowledgeable, but that isn't at all the reality of the situation in my experiences.

            • criley2 8 years ago

              They ARE technically knowledgeable for the 16-21 year old average demographic.

              Go compare a reddit technology thread to a youtube comment section. Big difference in writing quality, avg length of post, use of source and data, etc.

              You probably outgrew their age demo and realized that smart 18 year olds are still dumbasses.

              • catach 8 years ago

                > Go compare a reddit technology thread to a youtube comment section. Big difference in writing quality, avg length of post, use of source and data, etc.

                While I think this is generally a valid point, I also suspect there's quite a bit of When in Rome effect in play. Uninformed r/Technology posters may step their game up to match the consensus style, while informed Youtube users may feel a bit of pressure to dress down.

      • nine_k 8 years ago

        I see two assumptions:

        (1) Everyone's identity is their email.

        (2) The person whose email you're typing in has already signed in to the service (or meta-service if it's a federation), and agrees to communicate with you.

        If you squint just right, this exact thing already exists; it's called email, and adding to friends means adding to a mail list.

        I wonder why there were no (known to me) attempts to actually use the email infrastructure (fast, reliable, ubiquitous, near zero-cost) to distribute social network updates. It could use a custom pretty frontend app that makes posting or reading updates easier than e.g. gmail.

        (As a bonus point, the actual emails can be reasonably human-friendly, as an extra archive of all of your updates.)

        • zaarn 8 years ago

          EMail has it's problems. ~~Abusing~~ Using it for social media updates doesn't sound like something Email can solve well.

          It's not necessarily fast, delivery may take only 1 second but I've also had email take days until it was delivered successfully.

          Reliability is meh, it has some resilience to services being offline for a bit, so I'll give you that.

          The near-zero cost is also not quite true. It's only true if you sell your data to the provider of your choice, gmail or yahoo or AOL. If you want privacy on email, you'll have to pay for it, otherwise you pay by other means first.

          There is a chat app that uses email to function, it also features encryption but IIRC the userbase is very small and last i tried it for testing, it did quite spam my inbox.

      • pnutjam 8 years ago

        Anybody check out https://mewe.com

        • corobo 8 years ago

          > No spying. No cookies. No data sharing.

          How do you stay logged in if there's no cookies?

          It also looks like they try to do too much. Cure-alls cure nothing (thanks for the quip, Sawbones podcast!)

          • catach 8 years ago

            From their privacy page:

            "We don’t track you personally and we never sell your personal data. Here is what we track: we track how users use our site in general so that we can make it better. We are monitoring traffic, usage activity, site performance, and we use general analytic tools so that we can improve your experience. We do not associate any of this data with you personally. We never sell or share your personally identifiable information unless required to do so by law."

          • cgoughnour 8 years ago

            You can implement sessions with session ids in URLs in a relatively straightforward way.

            • corobo 8 years ago

              I was being somewhat pedantic in my previous reply, I realise they mean tracking cookies and the likes

              As for putting session IDs in URLs I would not advise that in any way, that's one unsanitized href away from Google being logged in as and indexing your user's private account data if done badly and a nasty bout of session fixation if done less badly. More information here: https://security.stackexchange.com/a/14094

          • OldSchoolJohnny 8 years ago

            > How do you stay logged in if there's no cookies?

            In my mind, when I read HN comments, I assume all the people who post here know what I know and more but then there's a post that comes along that reminds me of the sheer gulf of knowledge that can exist even between people on such a speicalized site as this one.

            • corobo 8 years ago

              I'm glad I was able to bolster your ego with my plebeian mind. Have a great day :)

  • Sir_Substance 8 years ago

    Diaspora (still!) doesn't do:

    1. Chat (It could just integrate a javascript XMPP client and let people use whatever chat server they liked)

    2. Event management and invites

    When I suggest people leave Facebook, these are the things people complain there are no alternatives to.

    • rebuilder 8 years ago

      #2 is especially galling, as it's actually, to me, the only really compelling service Facebook provides.

    • jhasse 8 years ago

      > 2. Event management and invites

      https://github.com/diaspora/diaspora/issues/1359

      • dbbk 8 years ago

        That issue has been open for 7 years... what is your point? To me that only demonstrates that the project is dead.

      • Joeboy 8 years ago

        So via that link it looks like a PR that "adds event entities" was merged in January. Which sounds vaguely promising, although I'm not sure what it means in practice for end users.

    • dbbk 8 years ago

      I don't know what it's like in the US, but in the UK pretty much all of university social life is organised via Facebook Events and Groups. There literally is no other option available that people could move to, except for maybe Meetup.com, which would be a poor substitute.

  • corobo 8 years ago

    I get flashbacks to scrolling error messages whenever someone mentions Diaspora. Just horrible software to use if it ever had an issue. Great when starting but the maintenance time costs were too high

    Nothing to do with not caring about privacy, I really did try to use it. Even had 100 users or so on my open instance.

    It was on par with running a public email service. Not my circus.

  • bamboozled 8 years ago

    Really? I don't think so, it would be good if someone did a study on this though. Most people I know think privacy is important.

    I do think people are communicating via other mediums more than before though. It's anecdotal but most of my family and friends just gravitate towards iMessage , Facetime and Telegram to communicate by default now.

    Could it be that people don't care about this issue because they care about Facebook anymore? There are alternatives now, people will just use them more and more over time.

    • jamesrcole 8 years ago

      > Most people I know think privacy is important.

      The question is, how representative are those people of the population at large?

      • unclebucknasty 8 years ago

        >how representative are those people of the population at large?

        Another question is whether people truly understand their privacy exposure? They know FB has some information on them because they submit it, but they don't know how much info in total (sites visited, location tracking, etc), how that data is combined/used, who has access to it, etc.

        And, they assume that whatever FB is doing with their data must be OK/legal because laws.

        I think that's what we saw with reactions to these recent revelations. When an inkling of the real privacy exposure surfaced, people freaked.

      • catach 8 years ago

        And the follow-up question is, how much do they think it's important relative to other things?

    • Joeboy 8 years ago

      > Most people I know think privacy is important.

      Of course they do. What sort of person is going to tick the "I don't care about privacy" box? I guess the same kind of person that ticks the "I'm OK with mass extinction" box. Those opinions are not very relevant in the real world.

      • erikpukinskis 8 years ago

        Really? If I killed all the remaining snowy owls you’d see that as morally equivalent to treating all my data as discoverable? I don’t see it.

        • Joeboy 8 years ago

          No, I see ticking a box marked "I don't care about privacy" as comparable to ticking a box marked "I'm OK with mass extinction". In the sense that in theory nobody's outward preference is for invasion of privacy or mass extinction, but in practice few people are prepared to make changes that prevent those things.

  • sitepodmatt 8 years ago

    Similar story as app.net, the paid twitter replacement that was cool for 33 seconds, arguably poor naming though on both counts given one suggests something else and the second I have no idea how to pronounce.

  • chillingeffect 8 years ago

    I just joined yesterday.

    It will take some time to wind it up. Even fb took a long time to build before it was relavant.

    Nobody cared back then bc they hadn't felt they burn of foreign influence on our election.

    And diaspora will have to grow. Even some basic things can improve the on boarding process. For example, uploading my profile was diverted due to a cap on picture upload size of 4.2 MB.

  • on_and_off 8 years ago

    >No one really cares about privacy now

    I spoke with several non-tech people about the facebook fiasco.

    The issue is that even a brilliant neurosurgeon does not understand the TOS he has signed with Facebook and what they entail.

    Surely, there is some naïveté from people that don't expect facebook to do much with their data, but tech has also failed to teach users about this.

    Even self proclaimed privacy champions routinely make you sign dozen of pages of ToS that are updated on a whim.

    • rmc 8 years ago

      This is why a contract should not be legally binding if it's unclear. I don't mean "clear to a lawyer", but what the common person, spending the standard, common amount of time, with the advice you expect them to have[1], would think of as "clear".

      EU Data Protection law (like the GDPR) helps here, requiring informed consent. If you don't understand something, then you're not informed, and it shouldn't be binding.

      [1] When (say) signing a form for surgery, the surgon can presume that the person has been advised by a doctor. When buying a house, you can presume a lawyer was involved, etc. When signing a ToS for Facebook, we all know there was no legal advice recieved.

  • wink 8 years ago

    There's "I care about privacy" and "I have a bunch reasons to dislike Diaspora, so I won't use it".

    Not speaking for everyone, of course - but I know a lot of people who didn't like it for one reason or another.

  • bsenftner 8 years ago

    They were "selected" because they were likely to fail, gave pithy interviews, and were young and hopeful. Facebook even gave them $50K - that is not competition, that is coddling a child.

  • noobermin 8 years ago

    I think people care a lot more today than they used too. The problem is people use facebook because they have to.

    • obstacle1 8 years ago

      >The problem is people use facebook because they have to.

      It's remarkable how common this opinion is given its obvious shallowness. Nobody has to use Facebook. What are the consequences of not? You can't chat with your friends or view their selfies or see event listings. Or rather to do these things, you have to make an effort to use some other more private mode of communication like phone or in-person or classifieds or whatever. It's easier to use Facebook than to not.

      That is an extremely far cry from "having to" use the service. The problem really is people are lazy, and use Facebook because it saves them time, effort, and energy. In most cases, people care about this saved energy more than they do their privacy.

      • aninhumer 8 years ago

        I wouldn't go quite as far as saying people "have to" use Facebook, but there are fairly significant social costs to someone who chooses not to.

        Many people's friends communicate primarily via Facebook, and you can't just get around that by using phones and emails. People have discussions, invite people to events and post important life updates on Facebook. Often the primary communication mechanism for an organisation or even a local business will be Facebook. And they often won't re-circulate all that information via email just for the benefit of people who don't use it.

        And yet people insist on trivialising these costs, and blaming individuals for this massive invasion of privacy because they chose not to incur these costs, rather than questioning the circumstances that have led to people feeling forced to make such a choice.

        Do you really think the people who are having their privacy violated explicitly chose that trade off because they're "lazy"? Or do you think, presented with a choice between signing up to a seemingly innocuous helpful website, or encroaching social isolation as their friends start using it, they chose the former?

      • jopuwep12489 8 years ago

        When I was in a band, the people promoting and organizing the shows didn't have email or phone numbers. Seriously. I'd ask. It was all college kids who couldn't afford a phone plan, so they just used public wifi + facebook messenger. Email was apparently not cool enough for them, or too difficult to use.

        So to get gigs, I had to make a Facebook account. Granted, I tried to put as little as possible on it.

        Until very recently, a few friends had me trapped their too. They couldn't pay their phone bill. So no texts or calls. Would just steal wifi from some store, use Facebook messenger. I harassed them to get email, IRC, anything else. But they couldn't be bothered to learn those things.

        I know this sounds like the stupidest thing ever. It reminds me of people taking out payday loans or going to check cashing places, because they're too poor to go to the bank.

        Anyway, two of them finally got phone numbers, so Facebook is deleted now.

      • noobermin 8 years ago

        You really read my comment in the worst possible light. No one has to use facebook but so many people connect through it that there are social costs to not using it. If people want to connect with you, you can't use messenger or groups, bam, that cuts off a lot of your connection with others.

        I didn't mean that using facebook is a requirement for life and I'm not sure why your first inclination is to read others' comments that way.

    • aaron-lebo 8 years ago

      If people really cared about their privacy they wouldn't broadcast their personal lives to millions of people (see social media). Until that's corrected (how do you get out of that social cycle where you have to market and yell louder than everyone else?), it's going to continue.

      People are mad at FB the same way people get mad when they realize they've been in manipulative relationships, but I'm not sure many people really want to accept that they gave into that despite all the warning signs that have been there for years and it's their own actions which enabled FB to be what it is.

      Some of the issue is the belief that anyone really needs FB. We've conditioned ourselves into it, but you don't need it any more than you need TV.

      • hellofunk 8 years ago

        > If people really cared about their privacy they wouldn't broadcast their personal lives to millions of people

        Most FB users certainly do not expect that they are sending out their photos and opinions and chats to millions of people. They have a circle of friends and family that they think are behind a wall called their network, and that circle is usually a few hundred people or less.

        • losvedir 8 years ago

          To be clear, that's accurate, right? They're not sending their photos and opinions out to millions of people. As far as I know, this whole Cambridge Analytica thing was about profile data, not messages or photos.

      • Joeboy 8 years ago

        > People are mad at FB the same way people get mad when they realize they've been in manipulative relationships

        To run with the simile, maybe some people remain in abusive relationships because of a reasonable fear that leaving will have consequences that are worse than staying.

  • wdr1 8 years ago

    +1

    In reality, people aren't upset about privacy. They're upset Trump won.

    • silverbax88 8 years ago

      They're not upset about privacy, they're upset the election was stolen. They didn't care when those of us with experience in election issues brought this up 20 years ago, they didn't care in 2000, they didn't care until suddenly a pretend-billionaire reality star stole an election.

      As soon as they can get rid of him, they will go back to not caring, even though it's more dangerous than ever and we've been telling them for decades.

    • georgeecollins 8 years ago

      It's not fair to say they don't care about privacy when by in large when they are surrendering it they are not aware. The average person has a very low awareness of the long term implications to the loss of privacy and how affect say, their chances of getting a job, or getting the best price for a product. But they will figure it out.

      When I read about the Cambridge Analitica story I was kind of shocked anyone was surprised by what they are doing. I have seen companies hoover up data from Facebook in a similar way so I have always understood that under their old ToS any friend could give away your data by participating in an app. It had been like that for a long time (they changed the ToS-- I believe in 2015). That seemed terrible to me, years ago. The fact that it took people so long to be shocked about it just shows that their is going to be a long lag between when these things happen and when popular consciousness catches up with the implications.

  • md2be 8 years ago

    This is typical NYT writing articles that support its one agenda. if we need to replace something it’s the nyt

    • komali2 8 years ago

      >one agenda

      Can you clarify what you believe the New York Times' agenda is, as demonstrated by this opinion piece article, and how "Tim Wu, law professor at Columbia," has been employed to propagate the NYT agenda?

      Also, why should the NYT be replaced, and what should it be replaced by?

sidcool 8 years ago

I tried explaining my 20 year old cousin about FB. Her constant argument was "I don't share anything private on FB". She checks in on FB everywhere she goes. Posts her pics all the time. I could not instill any sense of concern for privacy.

What I could conclude is that the appeal of social is too great to have any caution. Call me a pessimist, but I don't think FB is going anywhere. People will keep using it inspite of the risks. It's like a smoking addiction. It's bad but very difficult to give up.

  • seanwilson 8 years ago

    > I tried explaining my 20 year old cousin about FB. Her constant argument was "I don't share anything private on FB". She checks in on FB everywhere she goes. Posts her pics all the time. I could not instill any sense of concern for privacy.

    If she's happy with this level of privacy though, what's the problem? Maybe she does fully understand the implications but has a different value system to you?

    I feel that when people on this site are talking about Facebook, there's this assumption their friends using Facebook are failing to understand what Facebook does in the background and if they could somehow get them to understand their friends would all leave. People can be fully aware of what Facebook is and simply choose a different balance between privacy and convenience to what you prefer.

    • quanticle 8 years ago

      >If she's happy with this level of privacy though, what's the problem?

      The problem is that it's not just her privacy she's violating, but the privacy of everyone else, including OP, whose photos get shared by said cousin.

      When I got back from a trip I took abroad with my family earlier this year, my friends mentioned that they'd seen the photos that "I" had posted to Facebook. Except... I hadn't posted any photos to Facebook. I have a Facebook account, but I deliberately have a very minimal presence on it. What my friends were seeing was the photos that my mother had posted, and which I had been tagged in. My privacy was violated by someone else's inability to understand Facebook's privacy settings.

      • criley2 8 years ago

        "When I got back from a trip I took abroad with my family earlier this year, my friends mentioned that they'd seen the photos that "I" had posted to Facebook. Except... I hadn't posted any photos to Facebook. I have a Facebook account, but I deliberately have a very minimal presence on it. What my friends were seeing was the photos that my mother had posted, and which I had been tagged in. My privacy was violated by someone else's inability to understand Facebook's privacy settings."

        Ironically, it was your OWN inability to understand Facebook's privacy settings.

        Go to Settings -> Click " Timeline and Tagging Settings" -> Edit " Who can add things to my timeline? " section : " Review posts that friends tag you in before they appear on your Timeline?" make " Enabled "

        There, you will never be tagged in another photo or post, and you now have a review process for anyone who attempts those things, so you can manually up or down those things.

        • raquo 8 years ago

          You can't actually opt out of tagging anymore, you can only opt out of tags appearing on your timeline, but people can still see the photos and see that you are tagged in them.

        • quadyeast 8 years ago

          No, this is FB's fault. This should be opt-in.

        • KC8ZKF 8 years ago

          So you have to join Facebook in order to not be tagged on Facebook?

          • romwell 8 years ago

            The tags work in the way OP described only if you are already a user.

        • MartinCron 8 years ago

          I am reminded of a basic fact: You can’t opt-out of other people talking about you online.

          Keeping people from tagging you is pretty close, though.

      • auxbuss 8 years ago

        This is a key point that folk are genuinely surprised by when I explain it to them. It's kind of a reverse herd immunity. (I'm sure there's a better analogy.)

        • keketi 8 years ago

          > reverse herd immunity (I'm sure there's a better analogy.)

          Asymptomatic carrier.

          • mieseratte 8 years ago

            > Asymptomatic carrier.

            An asymptomatic carrier is one who exhibits no symptoms of the illness but is carrier who can infect others. I don't believe that is the right analogy here.

            With herd immunity you have a group with a large rate of participation, which effectively immunizes those that haven't been.

            Facebook is the opposite in that you may not be "infected" but if everyone around you is "infected" you might as well be, because Facebook will piece together your information based on what your friends make available.

            Plague almost starts to sound like a better analogy...

      • seanwilson 8 years ago

        Turn on the feature to hide photos you're tagged in and tell people you know they're not to show photos of you to other people then? Or tell people not to take photos of you?

        If Facebook didn't exist, people would still show photos to people in other ways. If someone takes your photo they're more than likely going to show it to somebody so I would assume a low level of privacy by default.

        • davnicwil 8 years ago

          > People would still show photos to people in other ways.

          I suspect this is not the issue or what the parent means by privacy.

          Rather, they probably mean specifically that they don't want their metadata enriched photos being made available, without their explicit knowledge or consent, to Facebook the company (and therefore also indirectly to any number of other companies / advertisers).

          If Facebook didn't exist, people certainly wouldn't do that! That's purely an unavoidable side effect of Facebook's current business model.

        • mayniac 8 years ago

          >Turn on the feature to hide photos you're tagged in and tell people you know they're not to show photos of you to other people then?

          That does protect you to some level. But throw in machine learning with image processing and simple metadata extraction and while your friends might not see the photo, Facebook can potentially figure out if you're in the photo whether or not you've been tagged, where the photo was taken, what camera the photo was taken with, what mood you're in, who's with you, what clothes you're wearing etc etc. And then they'll sell that data without ever telling you.

          I have a bigger issue with that happening than I have issues with friends seeing photos I may not have wanted to posted myself, to be honest.

        • mulander 8 years ago

          > Turn on the feature to hide photos you're tagged in

          And how should I do that if I don't have a Facebook account? How do I tell Facebook to not steal my phone number and texts from phones of my friends?

          • seanwilson 8 years ago

            > How do I tell Facebook to not steal my phone number and texts from phones of my friends?

            https://newsroom.fb.com/news/2018/03/fact-check-your-call-an...

            "Call and text history logging is part of an opt-in feature for people using Messenger or Facebook Lite on Android. ... This feature does not collect the content of your calls or text messages"

            • barrkel 8 years ago

              So, to reiterate, how to stop Facebook from stealing your phone number from your friend's phones? Phone numbers aren't content - FB is still stealing it.

              • wilsonnb 8 years ago

                It's not stealing if your friend consents to it. If you don't want your phone number shared with Facebook, don't share it with people who are going to share it with Facebook.

          • wilsonnb 8 years ago

            You can't tell Facebook not to do that because your phone number and texts are no longer just yours at that point.

            Your friend has a copy and can do whatever they want with them, including share them with Facebook, the NSA/FBI/police, their friends, or anyone else they want to.

            If you don't want them shared with Facebook, don't give the people who are sharing them with Facebook a copy.

      • awat 8 years ago

        I think your point is under represented in the digital privacy conversation. It doesnt do me a lot of good to stay off of Facebook if Facebook is still mapping me and scraping my contact info from other peoples phones.

      • blanche_ 8 years ago

        You can enable to only tag photos after your approval.

        • a012 8 years ago

          You can add a filter on your profile but the other people did post a photo which include yourself on their wall. So mutual friends still see the post no matter your security settings.

    • herbst 8 years ago

      Usually when I creep these people out by confronting them with personal details of their life (which I simply snapped of public Facebook data) they actually are creeped out.

      So while yours is a interesting thought I highly doubt a lot of people Actually understand the full issue.

      • xiphias 8 years ago

        It sounds interesting, can you give a concrete example?

        • mayniac 8 years ago

          Not the person you're replying to, but I had a boss at an old job who liked to make "your mum" jokes as often as humanly possible. It got annoying. Since we worked in forensics and did a lot of OSINT I decided to stop it using Facebook.

          Found his Facebook. He didn't have any family listed, for privacy. Friends list wasn't visible either. However his dad and sister, both easily identifiable as such, I found since they had both liked the same profile picture a few years ago, and I could view their relationship (handy trick, go to someones user account, add ?and= followed by the user ID of another user and you can view relationships between anyone). Saw that they had a few mutual friends, <10. Found two which fit the criteria for possibly being my boss's mum. Searched both names in the electoral register and got rough locations. One of them lived in the same city my boss had listed as his birthplace, and co-habited with the person I previously identified as his dad. She was using her maiden name on Facebook (there goes security questions). I paid £1-2 for the full address.

          For the next week or so I sent him random bits of information about his mum whenever he made a bad "your mum" joke at me (if it was good I didn't particularly care). Previous addresses, streetview screenshot of her house etc. Despite streetview blurring her car's license plate, I could see what make/model/colour it was, which was enough to find the license plate by skimming through photos posted on various sites which let you search by location. So I sent him MOT and road tax reminders too. It was fairly easy to find what schools she had gone to, previous marriages, a company she had started etc. He stopped making "your mum" jokes after a week.

          Bear in mind: this was someone who worked in computer security and was actively privacy conscious, and within an hour I had enough information that I could have probably stolen his identity.

        • herbst 8 years ago

          I like to do it passively if the person doesn't already expect it. Like asking overly specific questions about past events they posted. 'how was dj dickhead in January?' 'the girl you were with didn't she go to (put school I surely shouldn't know anything about here)' just making random creeper comments and getting worse until I explain my intention. For the best effect stretch this process over a evening or more.

          We had a overly 'social' secretary which didn't understand privacy implications until she met our team :) we pointed out every joint, cheap vodka bottle, or even slightly awkward things found in mirror selfies until she started to really rethink her privacy.

          Or there is a old social network many people in my country kept for the email. They encouraged to write or at least post poems. Lot of awkward lines to be found there to make some heads red.

        • sf_rob 8 years ago

          While I don't approve of some (most?) of their antics, Phone Losers of America did a series where they "prank called" users of Foursquare and started reading off details about their personal lives. Pretty scary stuff that puts things in perspective.

        • herbst 8 years ago

          I am thinking things like Wechat, Telegram (also Whatsapp to some degree but that's behind in functionality) but also things like discord and slack.

          So without a direct social graph, specialised interest groups, more direct connections, more 'privacy' at least in terms of how public the data is available.

    • sidcool 8 years ago

      It's that she's unaware of the negative consequences of hyper social media presence. She seems to have become addicted to the 'likes' of FB. Unless there is a cancer like warning for social media, she's unlikely to give it up.

      The lure of being more famous than her friends is too much to resist. Not sure if wrong or right. I would like being famous on HN, StackOverflow, tech blogs etc. Perhaps it's similar.

  • panarky 8 years ago

    > It's like a smoking addiction

    It's awesome to watch massive shifts in values and priorities.

    Smoking used to be seen as cool, sexy, even healthy. Now it's widely seen as unhealthy and disgusting.

    Same thing with high-fructose carbonated beverages.

    I remember people using terms like "retarded" and "gyp" without hesitation. Today even people who hate political correctness don't talk like that in public.

    It wasn't long ago that men abusing women in the workplace was routine and unremarkable. Now it's outrageous and shameful.

    Things change, slowly at first, and then all at once. People are waking up and it will never be the same for Facebook.

    • sidcool 8 years ago

      That is a good point. What baffles me is it took so much evidence from the medical community to convince people about smoking. And many still do it! Adverse effects of technology/social in general wouls be even more difficult to prove. I see technology addicts' rehabilitation centres a reality in near future.

      • majewsky 8 years ago

        What baffles me more is that a ton of people are vaping now, even those that haven't smoked before, because "it's, like, totally not like smoking".

      • herbst 8 years ago

        I am pretty certain most of the current younger smokers had a very good idea of the health implications.

        Anything that changed from a medical perspective since I am smoking is that we know by now that a 'smokers lung' is not actually that and most never get it. Otherwise all the risks are well known for 15+ years.

        Tldr: I don't think people actually care about dying earlier (or more cruel), at least in countries with working or cheap health care.

      • freeflight 8 years ago

        > What baffles me is it took so much evidence from the medical community to convince people about smoking.

        That isn't really the issue, smokers have been aware of the negative consequences for quite a while. Many are okay with it due to the relief the smoking brings them from stress and other issues, it's a trade-off. Just like alcohol ain't that healthy for you but many people still chose to drink it.

        But on the other hand you have massive companies who've spent decades and billions of $ in making tobacco as addictive, and easy to smoke, as possible. So once the customers are hooked it's extremely difficult for them to kick the habit and even when they manage to kick it, many will still get cravings for years, if not decades, to come.

        Which could be explained by this: https://slatestarcodex.com/2016/01/11/schizophrenia-no-smoki...

        • thaumasiotes 8 years ago

          For the effect on schizophrenia to explain the people who have difficulty quitting smoking, the population of people who have difficulty quitting smoking would have to be similar in size to (really, smaller than) the population of schizophrenics.

          But I would bet that it's much larger.

          • freeflight 8 years ago

            Afaik schizophrenia is a spectrum, so some are bound to be affected worse than others. I also didn't say it was the only reason for people having trouble kicking the habit, only one of the factors for it, so there's still plenty of room for non-schizophrenics not being able to kick the habit due to tobacco (and the additives tobacco companies add to it) being highly addictive.

    • tzakrajs 8 years ago

      > I remember people using terms like "retarded" and "gyp" without hesitation. Today even people who hate political correctness don't talk like that in public.

      Wrong wrong wrong. They still do these a lot.

      • JKCalhoun 8 years ago

        I prefer, "You sir, have negotiated with me as would a Gypsy. I am cross."

        Seriously though, kids used it all the time when I was growing up — I didn't even know "gyp" was derogatory until I was perhaps in my 30's. If I had to guess, young me would have suspected it was spelled "jip" anyway.

        We told Pollack jokes too and I didn't even know it meant someone from Poland.

        I was not very cosmopolitan as a kid.

    • mpweiher 8 years ago

      > men abusing women in the workplace was routine and unremarkable

      When was this?

      • JKCalhoun 8 years ago

        Somewhat related: I was wandering YouTube the other day and stumbled upon an old T.V. segment with Hunter S. Thompson and a Hell's Angel sharing the program's stage. The amount of joking about wife beating (and audience approval of said joking) was frankly shocking to watch. Easy enough to search for, I'll leave off the link.

      • oblio 8 years ago

        Fully out in the open? Never, really. Even religion looks down on it.

        But covertly? It’s happening even now, all over the world.

    • Spellchamp 8 years ago

      What does "gyp" mean? I googled it but I feel like I'm missing something.

  • brandonmenc 8 years ago

    > It's like a smoking addiction. It's bad but very difficult to give up.

    Social media is socializing now, whether you like it or not, and whether you're along for the ride or not.

    In that light, it's strange when people say it's "addicting," like that's a bad thing. It's supposed to be - we're social creatures.

    Sharing things about your life with friends and family is not some horrible drug we need to curb.

    • sidcool 8 years ago

      The problem is that FB encourages a popularity contest online. This is not healthy. We are social creatures, but the internet based social does not cater to our social needs. It caters to our dopamine kick needs.

      Several studies have proven the ill effects of social network. So you are only partly correct.

  • mikroskeem 8 years ago

    > Her constant argument was "I don't share anything private on FB"

    I've heard worse. Plain "I don't care" and "I like that people know what I do all the time".

    > It's like a smoking addiction

    I'd say that tt's more like a drug. Most people seem to seek for an attention (in a comments/likes form).

    I know few people who use even PhotoShop-like software to make themselves "more beautiful" to gather more attention; however they don't look even similiar to their pictures.

    (it's like drug addicts do weird shit to get their dose of their favourite drug)

    • gaius 8 years ago

      I'd say that tt's more like a drug

      It is literally like a drug, former FB execs have explained how they trigger dopamine responses in your brain

  • tomcooks 8 years ago

    Everytime you say, hear or read the word "Facebook" replace it with either "mom and dad" or "the creep". Works great.

    • akkat 8 years ago

      Except it doesn't. Situation a: Facebook knows what I did last night. Result: I get ads tailored to what I did.

      Situation b: Mom and Dad knows what I did last night. Result: I get grounded.

      • tomcooks 8 years ago

        Guess what a teenager cares about more, coincidentally it's also the joke you just missed

      • sidcool 8 years ago

        There is a high probability that you did something wrong last night. /s

  • egfx 8 years ago

    People will use it but only for the necessary stuff, like birthdays and condolences. Facebook as a time wasting medium is dying. And dying spectacularly. In fact the same network effect that made Facebook what it is will work it's way in reverse order.

    • 908087 8 years ago

      Sending birthday wishes and condolences via Facebook seems more like an insult to me than "necessary stuff". If you give a fuck about someone, you'll make some kind of actual effort for such events.

      Doesn't Facebook "remind" people to wish their "friends" a happy birthday? That kind of changes the meaning of those birthday wishes from "these people were thinking about me" to "these people clicked a button because an advertising corporation told them to".

      As for condolences, the idea of deaths and other bad events increasing "engagement" (and therefore ad exposure and profit) for Facebook should make all involved feel dirty.

      • egfx 8 years ago

        Death is big business. Legacy.com is totally dedicated to the idea. Why should anyone feel dirty about giving condolences? Actually, the general tone of your comment feels off and vindictive so I'll just stop here.

  • JasonFruit 8 years ago

    Social is an adjective. I will die on this hill.

jamestimmins 8 years ago

It's interesting that Tim Wu discussed the cycle of technology starting amongst outsiders and then becoming monopolized in his (phenomenal) book The Master Switch. The cycle always repeats itself by the next new technology coming along, making the prior one less significant.

We seem to have accepted that the internet is essentially the final communication tech. Maybe that's true, but it seems improbable. Simply based on his past writing, I'm surprised he isn't advocating for a solution based on the blockchain.

I'm not suggesting that's the right answer; I merely find it curious that he didn't apply the same assumptions to the future as he did to his historical analysis.

  • jgh 8 years ago

    I'm not really sure how blockchain is related to a potential "next" communication technology. Why not AR? Why not lasers n shit?

    • joejerryronnie 8 years ago

      Wait for it . . . "Quantum Blockchain" - Boom!

    • arisAlexis 8 years ago

      Talking about a blockchain based social network. a laser based social network doesn't make much sense

    • jamestimmins 8 years ago

      You're right. I was thinking "blockchain or another in-development technology", but was lazy in my phrasing. Other tech is equally as applicable.

    • Geee 8 years ago

      It's possible to create distributed but capitalistic systems with blockchain. Without blockchain most distributed / P2P systems fail because they rely on volunteers to run the system.

      • kodablah 8 years ago

        I don't think that's why they fail. Lack of adoption primarily due to difficulty of use is mostly why they fail. Lots of us are willing to donate our resources, but that won't affect the success or failure of the platform.

        People need to be working on simple to use platforms, everything else is secondary (including scaling and featureset). Max effort needs to be towards onboarding, wizards, easy walkthroughs, etc. It's a goal in a project I'm doing and I urge others to prioritize similarly.

        • Geee 8 years ago

          But still, with blockchain you can design all kinds of incentives directly in the protocol without anyone in control. I'm not saying it's easy or if it's actually viable, but blockchain has properties that could make P2P social network possible in economic sense.

  • michaelmrose 8 years ago

    The internet has come to mean communication between potentially distant actors over a network.

    The successor to the internet will be called the internet.

  • mrweasel 8 years ago

    Blockchain technology isn't really a viable option for something like social media any more. With the new GDPR rules in Europe and the right to be forgotten, using blockchain just isn't an option, because you can't delete specific parts.

jjrh 8 years ago

I think in the long run we will use a decentralised/federated system. Privacy concerns aside, it just doesn't make sense to rely on one service or expect one social network to meet everyone's needs/desires.

  • thephyber 8 years ago

    I think this is exactly how health/medical data should exist. My family should have their own health/medical network node and only my direct healthcare providers should be able to access the data from it and only after I authorize them with a digital signature. Whatever data they generate about my person (or persons in my family) should be owned by me, stored in my family network, and only available to others after I explicitly authorize it.

    The massive collections of monolith data sets for financials, health/medical, credit history, employment records, taxes, census, etc are far too valuable to not be highly valuable to criminal orgs and/or government entities. Centralization into monolithic organizations will lead to irreversible issues of data non-privacy for a generation or more..

    • iambateman 8 years ago

      I love this and I want it to be real but it won’t work. Here’s why...

      As an individual, I won’t lose my medical records because I have three backups and offsite and whatever. You probably do too.

      But how do you remain really decentralized when the system has to work for a 76-year-old who can’t even remember what Google is, much less his password. Will this work in the golden hour after a stroke, when literally every minute matters?

      So we would make a medical record “bank”, which is federated sensibly, and require everyone to use it. And eventually we end up with a similar system that we have now.

      • naasking 8 years ago

        > So we would make a medical record “bank”, which is federated sensibly, and require everyone to use it. And eventually we end up with a similar system that we have now.

        Except accessing your encrypted records require the presentation a doctor's key and your key, which might be a standardized health card with a chip. So not entirely similar to what we have now, it could be considerably safer.

        • dllthomas 8 years ago

          > it could be considerably safer.

          If my card is lost or broken? The system you describe seems clearly at less risk of inappropriate disclosure. Whether it's safer is perhaps another question.

          • naasking 8 years ago

            a) You still need physical access to a terminal to use the key, and b) you revoke the key when it's reported lost.

            • dllthomas 8 years ago

              Those are just more reasons why it's harder to inappropriately access the data. My point was that you may need access to the key fast for health-related reasons, and so from that perspective it may reasonably be deemed "less safe" even if it's more secure.

              cf. the difference between "fail safe" and "fail secure", in a slightly different context

              • naasking 8 years ago

                I get your point, but I don't see how it would be less safe. Right now they look up your records by name or health card number, and this would be a direct link to your health records that you could just tap. It's arguably safer even in the sense you're using it.

    • secstate 8 years ago

      Incidentally, I'm working in healthtech right now and I have looked at this a million different ways, and the first and biggest problem is the quality of the data and trust of the data. You make a big deal about after I explicitly authorize access, but once you've granted access, that's it ... what's to stop the doc from copying some info from your chart?

      More relevant, what happens if you lose access to your data? Or it becomes corrupted? Now, because you owned your data, it's only your responsibility. You know who's not going to put up with that? Anyone who can afford to hire someone else (like a doctor) to keep track of their chart for them so that stupid stuff doesn't happen.

      Most people don't realize that many of the connected health record problems have already had high quality solutions provided in the form of VistA (https://www.wikiwand.com/en/VistA). It's interface would make a startup designer cry, but medical professionals find it highly effective. Especially the network effect of being able to hand charts off and coordinate care, which would be very difficult in a decentralized health record world.

    • saganus 8 years ago

      Uhmmm...just thinking out loud here.

      How feasible do you think it would be to use Mastodon for this?

      If you have a "Medical Node" as you put it (which I find apt btw), you could share it with your doctor(s) and provide access (maybe using Keybase? Auth0?) for them to either add "their own posts" with the analysis results, their findings, etc, or just to read the relevant data (e.g. for a dentist).

      Again, just thinking out loud, but they way you put it sounded interesting :)

      • wilde 8 years ago
        • HillaryBriss 8 years ago

          nice article.

          "It turns out there are strong economic incentives for doctors to keep patient information to themselves — and even stronger incentives for electronic medical records not to play nicely with each other."

          "While patients might want one hospital to exchange information with another hospital, those institutions have little incentive to do so. A shared medical record, after all, makes it easier to see a different doctor. A walled garden — where records only get traded within one hospital system — can encourage patients to stick with those providers."

      • ams6110 8 years ago

        Doctors make notes by dictation, which is transcribed to patient charts by medical secretaries. So you'd need to authorize those people as well.

    • hvidgaard 8 years ago

      The average Joe will never manage to do that. So unless the state develop, maintain, and make available free of charge, such a service, it will never happen.

      • marcinzm 8 years ago

        In which case you've now built a centralized medical record storage system. And since people lose their keys all the time and you don't want that to cause them to lose all their medical records you also now have access to their medical records in plain text.

        • hvidgaard 8 years ago

          I completely agree, and I'd rather that it's done this way, I believe the benefits far out weight the risk of abuse.

          On the other hand, with old fashioned paper journals, you could get all copies and store them yourself. If you lose them they're gone too. If there was a cryptographic construct where the access of data would require a public action, i.e. "to assemble the key to decrypt this data, I need to broadcast this to the world", then I can think of a number of good ways to store things with a robust accountability feature.

    • ams6110 8 years ago

      Who would develop and market and support this, and who would pay for it?

  • Nomentatus 8 years ago

    What's stopping this is Facebook's illegal interference with interoperability. Once upon a time railroads and telephone companies had to be forced to allow traffic to cross networks, now it's time for Facebook, etc, to do this. Well past time.

    • nugget 8 years ago

      This is why the data portability requirements imposed by GDPR are potentially so significant.

      • dane-pgp 8 years ago

        For those who haven't read it, the requirements are here:

        https://gdpr-info.eu/art-20-gdpr/

        In particular, there is this wording:

        "In exercising his or her right to data portability pursuant to paragraph 1, the data subject shall have the right to have the personal data transmitted directly from one controller to another, where technically feasible."

        This could, in principle, require Facebook to automatically broadcast your posts to your friends on third party social networks, once a standardised technology for that becomes widely implemented. Fortunately it seems that progress is being made on that:

        https://activitypub.rocks/

    • squarefoot 8 years ago

      The Internet as we knew it before corporations turned it into the pile of rubbish it is today, was built around open protocols that allowed software from different developers/vendors to talk each other. One could write an email from a Windows client, send it to a Linux server and then read it on a Mac. We just have to get back to the era of interoperability, possibly retaining the good things learned from experience.

  • ams6110 8 years ago

    So, email then? It's decentralized, federated, and only sends data to the people you address it to (gmail excepted, I guess, at least in the free tier).

    It's what has always worked for me.

    • zzzeek 8 years ago

      it should be email. but you need to build a fabulous UX on top of it that is as simple and instant gratification as Facebook, and you need to do it essentially for free, or with a grant or something, because it will never make a dime.

      • esfandia 8 years ago

        Why doesn't this exist already? Sounds very feasible. Your "friends" are people in a given mailing-list, and even a minute action such as "like" could also just be an email sent to that mailing-list, with some proper tagging in the subject header, so that the email client knows not to display the email but rather act on it as an event handler.

        • Slansitartop 8 years ago

          One important functionality gap, between FB and email, is that email always creates copies that are easily controlled by the recipient by design. While it's technically true that a FB recipient could be auto-scraping everything, practically that's not true, which allows people to retroactively delete things with a large chance of success.

          I feel like reasonably effective retro-active deletion is an important feature of a social network, as it gives users more control.

          • esfandia 8 years ago

            Very good point. I guess if we're going to use email as a substitute for Facebook we could use messages containing deletion/update directives. Clients could still of course decide to ignore them or interpret them however they wish.

          • zAy0LfpBZLC8mAC 8 years ago

            It's just not a reasonable expectation. Either you give the control over the data to a central authority, or you give the control to the user, you can't have both.

            • Slansitartop 8 years ago

              > Either you give the control over the data to a central authority, or you give the control to the user [receiver?], you can't have both.

              No, there are middle grounds, such as a decentralized/local authorities. E.g. you send a hyperlink to the message on your server, rather than the message itself. Theoretically, you've still ceded control to the receiver, but practically, in most cases, you haven't.

              • zAy0LfpBZLC8mAC 8 years ago

                Well, yes, but decentralized "authorities" still have an incentive to do what their users want, and if there is a market for "no remote cancellation" accounts, then they will exist. It's quite different from one central authority that would be acting against its own interest if it did that.

          • zzzeek 8 years ago

            twitter is essentially auto-scraped and in general, I think if my friends posted something, I've seen it, and I should be able to keep a copy of it. one feature of the "email as a social network" idea is that it really would be just "your friends". you wouldn't be exposed to far-flung randos the way facebook likes to game you into doing.

        • zzzeek 8 years ago

          yup, that's been my idea for a few years now, see if you can get PG to run with it. You're welcome.

    • ivansavz 8 years ago

      Yes! Email has the best chance to take over.

      Links to photos, events, and group chat can all happen using email as transport. Like @esfandia suggested, the social-emails could be tagged as hidden so they are not displayed by your regular email reader.

      Here is a old write up of how "events" could work over email: https://news.ycombinator.com/item?id=12671812

      Does anyone know if something like this has been tried before? Surely someone has thought of this before...

  • 8bitsrule 8 years ago

    I keep seeing the suggestion of 'federation' for soc.media and am not sure understand the use of this word. What are the characteristics of a 'federated system' and how is it immune to the problem of centralization? What are some successful examples?

    • oblio 8 years ago

      I’m going to be a bit ironic here and say that email is an example of a federated system.

      I’m being ironic cause we did end up with a centralized system for email. Not a single center, but a few: Gmail, Yahoo, Microsoft, etc. Because of abuse (spam, primarily) and because of ease of use.

      Having an easy to use and safe federated system is discovering-the-theory-of-relativity hard, in my opinion.

      • zAy0LfpBZLC8mAC 8 years ago

        On the other hand, even a few "centers" are way better than just one, in that that creates competetive pressure.

        But also, those three are by far not the only ones, there are quite a few more significant email providers across the globe.

        And also, there are tons of participants who use none of those services. Apart from some individuals running their own servers, lots and lots of companies run their own email infrastructure.

        > Having an easy to use and safe federated system is discovering-the-theory-of-relativity hard, in my opinion.

        The important thing is that it's way easier than a safe centralized system.

p49k 8 years ago

Has anyone seen a product that was functional, polished, and enjoyable to use that would be capable of replacing Facebook? I haven't. Diaspora, Mastodon, Ello are the only things that I can think of, and none of them come close to matching the basic functionality and the "it just works" factor of Facebook.

Maybe someone should put in some resources to create a polished product and see what happens? It doesn't even have to be some idealistic p2p distributed system or anything like that, just a company who actively works to minimize the data they store and to allow users to control and manage their data effectively.

  • ytjohn 8 years ago

    I'm planning to setup Hubzilla as a forum/wiki for my local radio group and local tech community. Hubzilla might not have everything right (I would prefer the scuttlebut/patchwork approach), but it definitely checks most boxes for me. The key one being Nomadic identity - they can export everything they've ever posted and upload it to another server. This is really crucial (not for my club, but for other groups). Hubzilla also federates with ostatus, diospara, gnusoc, frendica, mastadon, and others.

    Hubzilla only has a few thousand users. In a social media world, that's a rounding error. So my thought is that people should setup Hubzilla for a targeted group. Get an active community of dozens or possibly hundreds of people, and if they like the platform, encourage them to invite other people and start additional communities. Or find communities through the federation.

    https://project.hubzilla.org/page/hubzilla/hubzilla-project

    https://medium.com/we-distribute/the-do-everything-system-an...

  • pnutjam 8 years ago

    Try this one. It's the most user friendly I've seen: https://mewe.com

  • haylem 8 years ago

    True, I haven't seen another product "match" Facebook.

    But I also don't see much need for it (entirely), or at the very least for most of its features.

    The Facebook of ~2007 was about as good as it ever needed to be (minus the pokes). It served its purpose well. It could have used some of the UI polish it got afterwards, but no new feature addition has made any significant change to end users in my view, apart from pushing them towards more extreme sharing.

    It's a super cool app, and a super cool platform, with unfortunately little actual value to its end users (except if you consider advertisers and users of the tech platform the end users, not the actual Facebook users).

    Not that I think it's all Facebook's fault: you build something for a certain purpose, and it naturally evolves, and you adapt to what people want, or what you think they want based on some metrics or "need" for growth. And then you get... this.

    • p49k 8 years ago

      The biggest feature for me that no one has replicated is the ability to create events with extremely customizable privacy preferences in which you know people will get the invite, even if they’ve changed phone numbers (in other words, some level of contact redundancy).

  • brylie 8 years ago

    The closest open-source, distributed option I know of is Friendica;

    https://friendi.ca/

    Of course, there is room for improvement in the Friendica UX, but it still seems like a viable option for federated social network. The Friendica devs seem to strive for interoperability with other networks and support open standards for the social Internet.

  • alecco 8 years ago

    An even bigger problem is making critical mass.

    Young people are already tired of old Facebook. The problem is Facebook keeps acquiring the competitors gaining ground (WhatsApp/Instagram), and if not possible just ripping off the features. It's grown too big to be upended easily. And they are not stupid. They see the writing on the wall.

    • skinnymuch 8 years ago

      Don’t a decent portion of people sign up to FB once they finish high school/begin college or after they finish college (or are around that age). FB would obviously want every age signing up, but having young people sign up eventually doesn’t seem so bad either.

vijaybritto 8 years ago

"Another “alt-Facebook” could be a nonprofit that uses that status to signal its dedication to better practices, much as nonprofit hospitals and universities do" -> Honestly, I don't think this would be sustainable to function as a social network. At least I don't think it would work in a capitalist society.

  • jcadam 8 years ago

    I've had the same thought. Charge a small monthly fee in lieu of running ads or selling user data. Might cut down on fake/spam accounts as well.

    But I don't think it would work (and I'd totally work on something like this if I thought it would). People say they care about privacy, but when you present them with the option of paying $5/mo for a service that respects their privacy or using a "free" service that tracks everything they do and sells that data to anyone who'll pay, they'll almost always opt for the latter.

    Now, I would certainly pay a monthly fee for a non-user-hostile social network experience. And I would consider the smaller user base a feature, so long as it wasn't too small.

    • bachmeier 8 years ago

      $60/year to post about taking the kids to visit Grandma is pretty steep for most users.

      • 908087 8 years ago

        Maybe we should take that as a sign that announcing every trip to visit grandma to the world just isn't a thing we need to be doing.

      • 18pfsmt 8 years ago

        You should have seen what long distance phone calls cost before the 90's (i.e. cellphones).

        I made a $100 phone call to a girl I met on vacation in 1990.

      • jcadam 8 years ago

        Then maybe we ought to charge $0.05 per post instead of a flat monthly fee :)

      • boomlinde 8 years ago

        Is that a bad thing?

    • gukov 8 years ago

      Most people will follow others, and if everyone's paying $5 they'll gladly pay it too. It's getting that critical mass of paying users is what's hard. I wonder if it's viable to have government subsidize somehow...

    • mawburn 8 years ago

      The whole point of a social network is to connect with friends. If it was a paid service, nobody would be on it.

      Considering that every other startup has wanted to build "Facebook/MySpace/Twitter BUT FOR XXXX" for the last decade, I guarantee what you want is out there (or has existed at some point), but nobody is on it and nobody has heard of it, because it costs money and nobody is going to pay money for a social network that's empty. I personally wouldn't pay money for a social network that's not empty, either... and I'm sure a lot of people share my sentiment.

    • vijaybritto 8 years ago

      Yes, exactly! Also developers still thinking in dollars need to understand the rest of the world seriously! The income levels all around the world are very less in the developing countries. This is a significant factor. If I'm earning only 100$/month I would definitely not pay a cent for a service that promises 'privacy'. I need to survive first and if I'm able to do stuff for free I'm definitely using it. Those people are least bothered about privacy.

      An anecdote from a recent experience: I'm in India and there is the Aadhar project which assigns unique id to every citizen. There is a big privacy debate about it in the cities regarding privacy issues as the govt is forcing everyone to link our assets and tax numbers to it. People in the villages have no idea about it and there were pamphlets of Aadhar numbers being used as tissue papers in a local snack shops. But they all have a Facebook account for sure.

      People don't understand understand privacy when they just want to survive.

    • jasonkostempski 8 years ago

      Does FB make $5 a month off the average user? If not, $5 a year? Regardless of what FB makes, could $5 a year keep a FB clone alive at FBs current volume? Would people even pay that?

      • skinnymuch 8 years ago

        App.net failed charging $50 a year. I think they should have tiered or been cheaper. But that’s one datapoint.

        FB does tens of billions in revenue on 2.1 or 2.2B users worldwide. Far more than $5 a year. I assume a $10 a year social network could break even or even profit. But how many people will really pay? Especially when you scope out to every type of person from every country FB has a hold on.

      • TrevorAustin 8 years ago

        In 2017 FB made $40B in revenue on 2B users.

    • TACIXAT 8 years ago

      I feel 5 dollars is expensive for a monthly. Servers are pretty cheap, storage is pretty cheap. There is no realistic way to pay a few pennies per month though. Maybe 5 dollars yearly. If it's a not for profit then they just need to operate slightly above cost.

    • reitanqild 8 years ago

      I was very happy to pay USD 1 a year for WhatsApp.

      I think they were already profitable by te time they sold out.

      There's also other monetization options:

      API access for businesses.

      Premium accounts.

      Etc.

      And FTR: I'd gladly paid 10 times as much as WhatsApp charged if that was the price- as long as they didn't sell out to my enemies.

    • petepete 8 years ago

      The reason Friends Reunited failed (at least here in the UK) was definitely that any payment was too big a barrier. Most people just don't care. They didn't before CA, they don't now.

      I use FB as I attend various gatherings that organise there, but I no longer contribute much, and am phasing it out.

  • gnud 8 years ago

    I think some sort of freemium would be the way to go. Photos/videos expire unless you pay, limited space for photos/videos unless you pay, limited group size, limited amount of events/month, integrated ticket sales, branding oppts. for business pages.

gvurrdon 8 years ago

The only possible thing for which I might need Facebook would be for groups, as some hobbies seem to have almost entirely moved there for event organisation and general discussion.

Previously we used to use forums such as phpBB, but setting up one of these involved finding someone able to host the forum software on their server. Tapatalk could be set up to improve the mobile experience, but most users seemed to find that somehow difficult. There was also a constant battle with spam and malware.

I'm not sure what would suit - Mastodon and Diaspora don't seem to me to be the right solutions here. Currently, I am making do with being out of the loop and missing things.

ohiovr 8 years ago

I think we need alternatives to text only communication. If we could judge each other's tones maybe we would chill out a bit.

  • ams6110 8 years ago

    Text can work OK between people who know each other well and are familiar with each other's patterns of speech and sense of humor. Not perfect, but generally OK.

    Much worse between people who aren't so well acquainted. I'm actually in the middle of trying to mediate a disagreement based mainly on two entirely different perceptions of intent in some stuff that was written in an email.

  • ssalazars 8 years ago

    I definitely agree with this, however, most people moved away from verbal communication because it's an async process, and it removes any awkwardness from the interaction. Video conferencing is used occasionally. I think text-based communication is here to stay.

pi-squared 8 years ago

I wonder what is the penetration of these kind of news outside our bubble here at HN, reddit and the like. I'm wondering the rest 2 billion people (which to a first approximation is probably just about everybody) care about this or are willing to care if few of their techie friends leave facebook. Is there some mathematical model + social science that could estimate the network effects of say, every techie person does leave facebook for good - what would happen to the rest?

Most of my non-techie friends have heard briefly about "some kind of scandal with facebook" but I cannot possibly appeal to them talking about "privacy" or they are stealing and selling your data - "Oh, everybody does that, you can't not use the Internet".

  • keybits 8 years ago

    DuckDuckGo did a survey of just over 1,000 random US adults after the Cambridge Analytica story: https://spreadprivacy.com/cambridge-analytica/

    • skinnymuch 8 years ago

      A lot of people might say they are going to do more for privacy or interact with FB and other social media less, but until there’s a proper followup study in day 6 months, I don’t know if I believe all the respondents. I believe that they tried to truthfully answer the questions. But that some of it is reactionary and/or the right thing to say at the time. Maybe I’m wrong though?

      Thanks for the link of course! Great write up and charts to look through.

908087 8 years ago

I find Zuckerberg's argument that Facebook needs to be the way it is so that "people who can't afford it can have access" pretty repulsive and incredibly sleazy.

If people can't afford a few dollars a month, why in the fuck would it be acceptable to expose them to manipulative ads that encourage them to hand over money that Zuckerberg claims they don't have? He tries to paint himself and his company as altruistic, while simultaneously exploiting the hell out of the people he claims to be "helping".

jenkinsjOP 8 years ago

I'm captivated by the phrase "free content (sic) is the creature, the servant and indeed the prostitute of merchandizing". -Walter Lippmann

heisnotanalien 8 years ago

Why can't I just pay for FB a monthly fee and as such they have no need to make money by selling my data or spamming me with crappy ads?

  • icebraining 8 years ago

    My uninformed guesses:

    1) Hard to price discriminate. Some people are worth almost nothing to FB, others are worth a lot. The price would either have to be absurdly high (e.g. $500+/y) or they might leave a lot on the table from that very profitable minority.

    2) PR hit. People more easily accept that a frivolous luxury is only available to the wealthy, whereas even many people who use FB see privacy as more of a basic need. See: response to "price gougers" selling stuff like ice or water at a premium in disaster areas.

    3) Hard to cleaning delineate. It's a social graph, your data is useful to generate data on your friends. Could they use it in that case or not? If they do, will that expose them to a lawsuit?

  • 6ak74rfy 8 years ago

    A usual CPC (cost per click) that an advertiser is willing to pay is somewhere between 50 to 150 cents. Let's say it is 100, and you clicked on 10 ads in a month. So, Facebook earned $10 off you. Now, you should be willing to pay more than that for Facebook to prefer the model you are suggesting.

    My math above is highly simplistic. For e.g., you'd say you aggressively use an ad blocker and never click on ads. Fair enough, but what about non - tech people unlike us? For e.g., when my dad starting using Facebook at an age of 50+ couple of years, he just tried an unknown plumber through a Facebook ad. Moreover, you'd be willing to pay a monthly subscription, but would all of your friends?

    So, what I am getting at is that at Facebook scale they'll earn more though ads than through a subscription model.

    • mrweasel 8 years ago

      The value you represent to Facebook is also dependent on your location. People in the US are worth the most, around $60 per year: https://www.theguardian.com/technology/2016/jan/28/how-much-...

      For heavy Facebook users $60 isn't much, but for everyone else it seems a little much.

      • mch82 8 years ago

        If they really focused on delivering quality tools for organizing groups I'd pay that. $60 is a bargain compared to MeetUp.com admin fees.

    • einr 8 years ago

      Who clicks 10 ads a month? I don't think I've clicked 10 ads in total since getting on the web for the first time in 1997...

    • johnchristopher 8 years ago

      Not so fast:

      > https://www.buzzfeed.com/alexkantrowitz/heres-how-much-youre...

      > Here's how much Facebook makes per person in each region, extrapolated annually based on the network's third-quarter numbers:

      > Worldwide: $16.04

      > US $62.60

      > Europe: $18.88

      > Asia-Pacific: $7.56

      > Rest of World: $4.84

      Another metric:

      > The social network giant, Facebook has a market cap of $227 billion and 1.4 billion users—which makes you worth a whooping $158. https://arkenea.com/blog/big-tech-companies-user-worth/

      So for a max. of 10 bucks per month we could get an ad-free, privacy oriented Facebook. With dev. money going to enhance the experience not maximizing revenues of the ad industry.

      • dhimes 8 years ago

        And if they didn't have to support and innovate the tracking stuff think how much simpler the company could be.

    • mch82 8 years ago

      I'm always surprised by how little services charge to remove advertising. YouTube will do it for $9.99/month.

      • jhasse 8 years ago

        Only in the US, Australia, Mexico, New Zealand, and South Korea though.

  • IshKebab 8 years ago

    This isn't about Facebook selling data. Why does everyone think it is?

ntnsndr 8 years ago

I briefly spoke with Wu some weeks ago about platform cooperativism. I suppose he wasn't impressed.

https://www.vice.com/en_us/article/qvxbgq/its-time-for-mark-...

supermatt 8 years ago

What a naive article!

The reality is that we can either have a paid-for walled garden so that bad actors cant leach data, or a decentralised and trust-driven network.

It only takes a "friend" using a nefarious client/implementation to send all your data to a 3rd party.

  • sgk284 8 years ago

    Even a paid-for walled garden is likely not sufficient. Plenty of services you pay for and/or are the customer of still resell your data (see: banks & credit card companies).

chx 8 years ago

Better will be hard. If you want people to come, you need to build something that Facebook doesn't provide. I have no idea what that will be but I do not think just privacy protection would be enough. By far.

narven 8 years ago

Do we really need another crap to replace it? just shut it down.

herbst 8 years ago

Why even replace it? Pseudo chronological single wall views are simply not a modern way to consume information anymore.

Not to mention, which crazy brain even proposed to fix it?

jenkinsjOP 8 years ago

I don't necessarily agree with the sentiment but respect Dr. Wu's option. I'm also interested in the HN community's options.

jacinabox 8 years ago

A quick research job has revealed that most of the interesting features of facebook, in particular "liking" posts and friend suggestion, are patented by facebook. It would be difficult therefore for a new entrant to copy its features.

  • Slansitartop 8 years ago

    > A quick research job has revealed that most of the interesting features of facebook, in particular "liking" posts ... are patented by facebook.

    I find find this hard to believe. Don't competing networks have similar functionality (e.g. "hearting")? What exactly about "liking" has Facebook patented?

    I'm much more ready to believe "liking" is trademarked, though I'm still skeptical of it, given that it's an everyday word used with its everyday meaning.

    • carlmr 8 years ago

      Facebook has likes, Reddit has upvotes and downvotes, I don't know the name on HN or Stackoverflow.

      Just calling it something different seems to be enough.

yy77 8 years ago

If privacy is really a concern, one should live like Jack Reacher, even not use credit card. Current situation is that, we want to happy share and attract attention on facebook. If it did something wrong, let the court sues it.

ravenstine 8 years ago

NY Times was among the numerous media companies that slobbered over Facebook for years and gave them free publicity. And now I'm supposed to listen to them when they say to replace Facebook.

billconan 8 years ago

I think my ideal social network would be something like reddit + medium + slack.

and it will be for expanding my social network and finding people alike, not for watching daily bullshit from existing friends.

jyriand 8 years ago

Orkut, please come back.

nso95 8 years ago

It will neither be fixed or replaced

pcunite 8 years ago

I don't want my stuff in the "cloud", I want it shared from my lawn. My own personal space to where people can access my stuff, that I share, and we can converse over whatever that is ... my own GDPR rules.

  • TheAceOfHearts 8 years ago

    Have you seen Beaker [0]? It doesn't require you to setup a complex web server and configure a bunch of stuff, you just run the browser and it'll start sharing your website. It's a move back to a truly decentralized web.

    [0] https://beakerbrowser.com/

    • Pamar 8 years ago

      Didn’t Opera offer something similar in the past? A small “private space” you could optionally share with others (as long as they used Opera too).

      I ask because Beaker claims to be “the first and only...”

      • skocznymroczny 8 years ago

        Opera had Opera Unite, but it was basically a webserver with extensions in the browser, it didn't require the other person to use Opera.

    • newscracker 8 years ago

      I actually tried this a while ago, and found that the audience also had to use Beaker to access the content. That's a huge barrier if current browsers don't support this.

      • TheAceOfHearts 8 years ago

        One must start somewhere. You can use DatHTTPD [0] to mirror your site on HTTPS. There's also additional tools available on the project website [1].

        They're also writing specs and working on adding support to Brave [2], or so says the third footnote on that article. Brave also has ongoing work to support IPFS [3].

        Long-term, I'm hoping browsers will improve support for registering new protocols through extensions.

        [0] https://pfrazee.hashbase.io/blog/announcing-dathttpd

        [1] https://datproject.org

        [2] https://pfrazee.hashbase.io/blog/universal-publishing-and-th...

        [3] https://github.com/brave/browser-laptop/issues/9556

      • omnimus 8 years ago

        True but i think that their plan is to get into web standards and have IPFS and DAT in other browsers. Beaker is just first implementation. I believe Firefox people are already doing some work on those protocols.

        It will be interesting see Googles position on those protocols. Chrome might be huge weapon against those iniciatives. Google can simply kill the whole initiative if they won't support it.

      • staticvar 8 years ago

        Beaker uses Dat protocol as opposed to HTTP under the hood. Dat protocol support is coming to Brave browser, probably Firefox next. The P2P web is about to take off.

        • indigodaddy 8 years ago

          I like the idea of dat/ipfs/p2p web, however , I'm hesitant to use my personal computer as the "peer" for this sort of thing.

          Can you just host/peer your ipfs/dat webpages/services/stuff from a Linux VPS/server?

naskwo 8 years ago

For photo sharing, I set up www.famipix.com in 2005...

feelin_googley 8 years ago

Prof. Wu makes a couple of assumptions when he gives suggestions for Facebook alternatives or successors. I dont see those suggestions as the most important point of his argument however. I believe the most important point is that there must be competition, that trying to "fix" Facebook will not suffice.

Nonetheless, these are the assumptions I see:

1. The software alternatives or successors must be commercial.

2. The software must attract a certain quantity of users to be viable.

3. The software must enable networks comprising large numbers of people, perhaps in the millions or billions.

This scale is far greater than the average size of any Facebook users group of friends.

Over the years Facebook may have morphed into a "public square" for exercising "Free Speech" but in the beginning as I recall it was not a means to broadcast to other users outside of ones social circle.

Its primary utility is arguably still in enabling communication within small groups, not enabling broadcasting to the general public.

Wu's assumptions point toward a Zuckerberg-like centrally-managed approach to what I see as historically a locally-managed activity: the human tendency to form small groups.

For many years, gamers and others have been writing software to enable small groups to communicate over peer-to-peer networking, without any funding from advertisers.

Wu writes, "So what stands in the way of a genuine Facebook alternative? It isn't the technology."

Thats exactly right. IMHO.

  • eadmund 8 years ago

    > This scale is far greater than the average size of any Facebook users group of friends.

    Yes, but only an individual Facebook user. The problem is that my friends' friends' friends' friends' friends' friends encompass the entire human race: at some point, as I invite people who invite people who invite people, the underlying technology has to be able to support all mankind.

    Indeed, I suspect that this — not some momentary privacy-failure flash-in-the-pan will be what leads to Facebook's actual downfall. It's ultimately building a proprietary Internet (in the sense of a fabric which connects people), and that's extraordinarily expensive. At the end of the day, the actual Internet is able to do that far more cheaply.

    I imagine that the replacement for Facebook will be something like email: something under the control of its users, something anyone will be able to add himself to and anyone will be able to block.

    • indigodaddy 8 years ago

      Could a viable Facebook competitor be built on a distributed/p2p type network, perhaps something like ipfs and/or mesh networking?

      • toomuchtodo 8 years ago

        Have you heard of Mastodon?

        https://joinmastodon.org/

      • fabianhjr 8 years ago

        Yes, scuttlebutt even works great over mesh networks and intermittent internet.

        http://scuttlebutt.nz/

        https://ssbc.github.io/scuttlebutt-protocol-guide/

        • im_dario 8 years ago

          Although Scuttlebutt is a nice solution, I think it fails to replace Facebook because:

          1. Different use case: trying it out it reminded me more of a Slack/IRC/bulletin board than anything else.

          2. Different framing: it uses a public square (Twitter) framing (follow, follower, channel) instead of a personal relationships framing (friends, groups, etc).

          3. Too complex for casual users: this is kind of ironic because Scuttlebutt is modeled after real life interactions but in a way it ends being too complex with pubs (public and private), long and cryptic user IDs, etc.

          These are some reasons but there are more. Happy to discuss them.

          • netchkin 8 years ago

            I have been intrigued by scuttlebutt for a few months now, and these are pretty interesting comments you make. Did you try to discuss them with the community around scuttlebutt?

            • im_dario 8 years ago

              I left a similar comment in a random discussion around this topic in Scuttlebutt. I'm not really sure where I could address for a proper discussion as a) they have their idea, which is legit and b) they don't have any incentive to listen a random guy with some random thoughts :)

      • marknadal 8 years ago

        Yupe, and you can start building your own in as short as 4min and 40 lines of code - https://scrimba.com/c/c2gBgt4 (interactive coding tutorial, meant to go along with this article - https://hackernoon.com/so-you-want-to-build-a-p2p-twitter-wi... )!

      • jrs95 8 years ago

        It seems unrealistic because people would have to make the effort to publish their content on that network to keep it available. Or pay someone else to do so. A distributed approach to this is definitely interesting, but it's more technically challenging and it's not a silver bullet.

        The big problem is how to fund a social network that doesn't rely on selling it's users data, IMO.

    • feelin_googley 8 years ago

      "... the actual internet is able to do that far more cheaply."

      "I imagine the replacement for Facebook will be ... something under the control of its users..."

      This is what I am trying (poorly) to articulate. I use a very small proof-of-concept application to accomplish something like this; no website, no third party managing a "service". I paid nothing for this application.

      Zuckerberg says, "The reality here is that if you want to build a service that helps connect everyone in the world, then there are a lot of people who can't afford to pay."

      Its difficult to understand what he means by "a service that helps connect everyone in the world".

      Users already pay for internet access. This internet service is what allows the subscriber to connect to everyone in the world. What he is describing sounds more like a central registry of contact details.

      What was the most elusive "starting material" to create a Facebook alternative: the contact and other personal details for most of its users. However this information is, as the world now knows, no longer in the sole possession of Facebook.

      For example, 420 million profiles from 2007-2010 were expropriated some 10 years ago. See https://news.ycombinator.com/item?id=16724375

      Today in response to media pressure, Facebook announced publicly "most" of their users have likely had their account info expropriated. "We believe most people on Facebook could have had their public profile scraped in this way."

      Moreover, with the recent changes Facebook has made, every user now has the means to easily export her data in a portable format.

      As a user, I might look up a contact in the "Facebook directory" (of which there might be many copies in many places) and then choose to communicate with her through a different channel, one that Facebook does not control.

      This channel does not need to be managed by a third party seeking to profit from selling advertising. It does not have to appear anything like Facebook or any of it subsidiaries, although it could.

      Once the contact and I are in touch there is no reason to involve Facebook or any other ad-supported web company going forward.

  • guelo 8 years ago

    The useful feature that's missing if the network isn't large is being able to easily friend a new person. The extra friction of convincing a new acquaintance to join your social network means that it doesn't happen in a lot of situations.

feelin_googley 8 years ago

"Poll: Do you trust Facebook?

...

THIS MORNING, IT emerged that nearly 45,000 Irish Facebook profiles may have been affected by the giant data breach involving as many as 87 million accounts harvested by UK data intelligence firm Cambridge Analytica.

Those 45,000 accounts could have been breached due to just 15 Irish people accessing a questionnaire app, thisisyourdigitallife, which included in its permissions the granting of access to all an individual's friends' profiles."

Source:

http://www.thejournal.ie/poll-do-you-trust-facebook-3941194-...

feelin_googley 8 years ago

"These days, you might get more applause for not being on social media than for reaching a follower milestone in Europe's liberal hubs such as Berlin or Paris.

...

The mechanisms used by Cambridge Analytica and the "malicious actors" cited by Facebook appear to have been legal and do not constitute a data hack, but rather a deliberate exploitation of information through tools or loopholes Facebook itself provided in the past.

...

At least two foreign governments, Australia and Germany, threatened or launched investigations into the practices on Thursday.

...

Meanwhile, in India, where more than a half-million users are estimated to be affected, the allegations have resulted in a governmental request to Facebook and Cambridge Analytica for more detailed information, with a Saturday deadline.

Even though India is now Facebook's biggest market - ahead of the United States - no Indian media outlets were able to ask questions in a conference call with CEO Mark Zuckerberg on Wednesday.

The heavy U.S. focus immediately triggered criticism because privacy advocates are still looking into reports that Cambridge Analytica may have used Facebook data to influence Indian politics, as well.

...

German justice minister Katarina Barley already called for an E.U.-wide investigation into the misuse of Facebook's data by Cambridge Analytica and other companies on Thursday.

"Facebook has gambled away people's trust," Barley said.

...

But in Europe, Germany's justice minister and others already fear that the latest regulations aren't enough."

Source:

https://www.washingtonpost.com/news/worldviews/wp/2018/04/05...

feelin_googley 8 years ago

"Do these hundreds of millions of people who cannot wait to tell the world what they are doing practically minute by minute not realise that anyone with an ounce of brain can find out everything about them just by reading their posts?

As the FBI admitted a while back, Facebook was the best thing that happened to collecting intelligence and saving money (because everything is in the open).

By having "free" access and use of Facebook, these people have made Mark Zuckerberg a multibillionaire."

Source:

https://www.businesslive.co.za/bd/opinion/letters/2018-04-04...

feelin_googley 8 years ago

"Australia's privacy commissioner has launched an investigation to determine whether Facebook breached the Australian privacy act.

...

Facebook has admitted 311,127 Australian users are likely among the up to 87 million users worldwide whose data was unknowingly and "improperly" shared with the British political consultancy agency."

Source:

https://www.theguardian.com/technology/2018/apr/05/facebook-...

dreamygeek 8 years ago

It's too messed up now anyways. The privacy settings sucked right from the beginning of Facebook. And it just kept getting worse. Guess people are just used to it now just like slaves get used to slavery and can't get out of it.

feelin_googley 8 years ago

"In 2013, Brandon Copley, the CEO of Giftnix, was threatened with legal action after using the technique to demonstrate how personal information could be easily gathered at scale.

"Multiple Facebook profiles were extremely easy to scrape," he explains. In a series of conversations with Facebook security developers Copley explained the issue and was told there was "no security vuln here, even though it does seem like one on first glance."

The method of scraping can work in multiple ways but largely relies on feeding Facebook's API a list of phone numbers or email addresses that have been automatically generated. These could also have been obtained from data breaches or leaks of information online.

"Just query Facebook as often as possible until they ban your IP for querying too fast, and at that point you just slow down until the queries stop," Copley explained in an email. "I was doing my work purely for research and exposing the vulnerability for Facebook".

...

The issue was again raised by researchers in 2015.

Reza Moaiandin, who founded cybersecurity company CyberScanner, published a blogpost about the "loophole". he said he was able to gather thousands of users personal information by guessing their mobile numbers. Within this information were details of names, locations, and profile pictures.

In response Facebook told him it didn't "consider it a security vulnerability" but had controls in place to stop it being abused. Zuckerberg's most recent statement goes against this, admitting Facebook's efforts to stop malicious actors hadn't worked."

Source:

http://www.wired.co.uk/article/facebook-news-data-scraping-m...

"A few months ago, I discovered a security loophole in Facebook that allows hackers to decrypt and sniff out Facebook user IDs using one of Facebook's APIs in bulk - therefore allowing them to gather millions of users' personal data (name, telephone number, location, images, and more). This post is an attempt to catch Facebook's attention to get this issue fixed.

By using a script, an entire country's (I tested with the US, the UK and Canada) possible number combinations can be run through these URLs, and if a number is associated with a Facebook account, it can then be associated with a name and further details (images, and so on).

...

For those of you who are wondering why I haven't notified Facebook about the issue, the truth is that I have - back in April (2015).

Although I did receive a reply, initially the engineer I was in contact with was unable to reproduce the issue himself, and therefore failed to understand the technical details of how it should be fixed.

...

After a couple of months of waiting, I initially thought someone else will look into it and fix it but I heard nothing, so I raised the flag with them again. They finally came back to me and told me that this is not a big issue - they have set limits and I should not worry about this problem. But frankly, I am very worried.

...

Comment from reader:

Great blog post. I reported an almost identical issue (albeit a different API) to Facebook in January 2014 but faced similar difficulties getting them to recognise the scope for abuse. I was able to lookup contiguous blocks of mobile numbers (in blocks of 5,000 at a time) with no discernible rate-limiting - I could pull them down as fast as my connection could handle (maybe ~50k numbers/min).

If you make any headway with Facebook let us know and I will try pinging them again. It was especially worrisome as the number range I tried (NYC) had a hit-rate of about 20%."

Source:

https://salt.agency/blog/facebook-security-loophole/

exolymph 8 years ago

Normies don't care about privacy enough to stop using Facebook.

Keyboard Shortcuts

j
Next item
k
Previous item
o / Enter
Open selected item
?
Show this help
Esc
Close modal / clear selection