[HN Gopher] Ask HN: What is with the new URLs on facebook.com?
___________________________________________________________________
Ask HN: What is with the new URLs on facebook.com?
Hi HN, I've noticed recently Facebook has started using URLs which
seem to include encoded information. For example, this URL to
Vice:
https://www.facebook.com/VICE/posts/pfbid02XdVziPTwhmPU9XzBq...
It's a pretty URL with some kind of hash at the end beginning with
"pfbid." Whereas they used to look like basic sharded URLs:
https://www.facebook.com/random.username/posts/1020832750980... Is
this for more targeted tracking on posts and links being shared, a
new sharding scheme, a combination of both, or something else
entirely? Appreciate any insights the community can provide.
Author : thrusong
Score : 193 points
Date : 2022-07-16 12:47 UTC (10 hours ago)
| groffee wrote:
| Firefox recently started stripping out tracking URLs [0] and the
| most prevalent one is Facebook with it's ?fbclid= so it looks
| like they're encoding it straight into the URL now to bypass
| that, Medium does similar also.
|
| [0] https://www.engadget.com/firefox-can-now-automatically-
| remov...
| dom96 wrote:
| Do you have any evidence to say that this is the case other
| than speculation? It's also possible that they just changed the
| URL format. FWIW `pfbid` seems to be a shortened version of
| "post fb id" so why would it include the "cl id"?
| aaomidi wrote:
| Multiple other companies doing the same thing would point to
| a trend.
| isametry wrote:
| Rule #n of the internet: If Meta does anything which doesn't
| _explicitly_ protect the privacy of users, you can safely
| assume that it harms the privacy of users.
| danijelb wrote:
| I went to Vice's fb page, found the same post that OP linked
| to and checked the URL. The pfbid part is exactly the same to
| me. The URL by default has some additional params attached
| like __cft__ and __tn__, which can be stripped, and those are
| probably tracking-related. Based on this, I don't think that
| pfbid is connected to tracking
| tedmiston wrote:
| Are you sure about that? It's not the same for me.
|
| OP: https://www.facebook.com/VICE/posts/pfbid02XdVziPTwhmPU
| 9XzBq...
|
| Me: https://www.facebook.com/VICE/posts/pfbid0TbuHEaGP2fLTR
| DFRTu...
|
| There were also a bunch of other query params junk after
| that I omitted here for brevity.
| tyingq wrote:
| If I were Meta, this is how I would implement this. First,
| get everyone used to the new opaque base64 encoded blob, by
| using it just like the previous numeric post id. Then,
| after all the initial speculation dies down, encode other
| stuff in it.
| drexlspivey wrote:
| what's the reason to change from the old format if that's all
| it does?
| zo1 wrote:
| Facebook will Facebook, that's a given. But why aren't FB
| employees (anonymously) responding here and explaining how
| this "pfbid" thing can be circumvented or even what it
| contains? Where are the _actual_ privacy activists that will
| do a grep through the FB sourcecode for pfbid and give us the
| scoop??
| __derek__ wrote:
| It looks like one already explained what this is:
| https://news.ycombinator.com/item?id=32119684
| zem wrote:
| probably takes a certain mentality to still be working at
| facebook and the people who cared enough to do this sort of
| thing left instead
| thrusong wrote:
| Makes a lot of sense-- thanks!
| ape4 wrote:
| I suppose Firefox could remove this new encoding too
| bamboozled wrote:
| Here is a good way to do it, block the entire domain :)
|
| Piece of s**
| blibble wrote:
| presumably they've encrypted/MAC'ed it, so you can't without
| breaking the link
| bencollier49 wrote:
| They literally just announced they were doing it.
|
| https://gizmodo.com/firefox-update-stop-url-tracking-
| chrome-...
| nchudleigh wrote:
| Wouldn't be the first time they implemented direct anti
| Facebook features.
| Mordisquitos wrote:
| Not that easy, unless the URL _pbfid_ thingy can be easily
| parsed into separate "post id" and "tracking id" parts --
| which I bet it cannot.
|
| One alternative, which would require significant effort and
| investment but would be a brilliant way to outsmart
| Facebook's crap, would be to accumulate _pbfid_ s in a common
| pool such that, if a given _pbfid_ points to post _X_ , fetch
| a different random _pbfid_ that points to post _X_. If the
| initial _pbfid_ is not recognised, add it to the pool once
| the post is determined, either as a new alternative for a
| known post, or as a novel entry.
|
| Of course, FB would hate it and would either try to expire
| old _pbfids_ (and risk breaking "legitimate" links) or use
| legal threats, which would require them to openly admit that
| they don't give a shit about people's privacy preferences.
| omegalulw wrote:
| Not really. pbfid needn't be a hash. You can take the plain
| text url, which can be ".../random.user/post/post_number",
| happened a random salt, and encrypt it using a key which is
| a function of "f(random.user)". That way you get unique
| encodings for each shared URL and every time you decrypt
| just discard the random bit. Defeats all pooling/reverse
| engineering efforts and offers perfect user isolation (each
| user has their own key).
| cmg wrote:
| > try to expire old pbfids (and risk breaking "legitimate"
| links)
|
| Or encode some versioning scheme, and keep trying various
| versions until one comes up with a valid link. If we can
| think of these things in seconds, so can the engineers at
| FB.
| texasbigdata wrote:
| Smart but now there's another third entity you have to
| trust to aggregate all this personal information from a
| slew of users just to... avoid the same situation
| initially? Sort of seems like only a marginal improvement.
| aaomidi wrote:
| The third party can't really do much with this data.
| johannes1234321 wrote:
| The third party can still see which users decode the
| exact same string, thus derive relationship networks. (If
| i regularily share links to my friends they all resolve
| it at the third party to te "canonical" form, that third
| party then knows that all those are my friends)
| aaomidi wrote:
| Assuming you can even decode it. Could just be an
| encrypted string.
| yjftsjthsd-h wrote:
| It doesn't even need to be that. If I were facebook, that
| string would just be an index in some internal Facebook
| key-value store.
| Someone wrote:
| Problem, I think, is that only Facebook can know the _X_
| such a url points to without accessing it.
|
| So, upon seeing a new one, you'll have to resolve it. Only
| then would you be able to tell what other URLs it's
| equivalent to.
|
| One way to gain anonymity there is to do that from a proxy,
| but such proxies would be detectable from the amount of
| pages they request from Facebook.
|
| It also looks like they already thought about replays of
| URLs. For me, https://www.facebook.com/VICE/posts/pfbid02Xd
| VziPTwhmPU9XzBq... currently says:
|
| _"It looks like you were misusing this feature by going
| too fast. You've been temporarily blocked from using it.
|
| If you think that this doesn't go against our Community
| Standards, let us know."_
|
| So, chances are they also thought about users exchanging
| URLs (e.g. by having each running instance of Firefox read
| Facebook URLs for other instances). It is possible that (a
| part of) your Facebook user ID also is encoded in each URL.
| wahnfrieden wrote:
| Sounds like this calls for some browser extensions
|
| Beyond privacy I'm interested in generally a browser
| extension that disables things that provide free labor to
| for-profit enterprises, such as hiding the moderation queue
| (which even has an annoying persistent badge) on
| StackExchange sites, the one that asks me to provide unpaid
| labor to private equity and has various rules that sound nice
| if it were a public utility but primarily work to improve
| their SEO.
| pronlover723 wrote:
| free labor lol, they're providing a service. For free where
| free = no money, They give user a way to share with each
| other, ways to organize events, ways to sell things, ways
| to send messages with each other, ways to make calls to
| each other, ways to have video chat with each other, all
| for free (again free = no money). In return they put ads in
| your face and to make those ads more relevant they look at
| whatever data they can gather.
|
| I don't like be spied on but gees, they aren't getting free
| labor. They're paying like crazy. As someone that once at a
| > $1000 phone bill it's amazing to me I can video chat with
| friends all over the world via FBs services and pay no
| direct money to do it and that to keep up with them I can
| now just post to fb instead of send out a newsletter or
| write each individual person
| ipaddr wrote:
| Many sites offer these things for free without the need
| to track you around the internet. Facebook's business
| model breaks social expectations of privacy. They make a
| lot of money because they sell other people your data
| through ad targeting.
|
| Facebook controls the barely tech literate crowd by
| offering an aol type experience.
|
| These services are popular with the masses. No one cares
| that they give data to facebook so they can be sold more
| things and leave them poorer.
|
| You end up paying facebook no direct money but you have
| less money and spent when you didn't need to.
| winternett wrote:
| The only time I fill out pop-up surveys is when I want to
| enter wildly inaccurate data bout myself. That time back
| when Facebutt forced everyone to use their government
| names (as if it was an authentic requirement) I was
| shocked at how many people caved into entering their full
| name.
|
| Companies are having a field day with all this data
| collection. I hope they get real karma for the deception.
| wahnfrieden wrote:
| I don't care, there are ways to build public goods
| services
| remram wrote:
| Isn't answering on questions providing free labor to
| StackOverflow too? Providing way more value to their
| company? Do you draw a line between answering and
| reviewing?
| wahnfrieden wrote:
| yeah I would like to have a public space to help my peers
| and am trying to build that in adjacent spaces
| daniel_iversen wrote:
| Most likely can't be fixed by an extension and also to the
| parent poster, Firefox can't strip this info out because
| the encoded string (how I read the original question)
| includes the actual metadata about what's to be displayed.
| Looks like fb won this round.
| winternett wrote:
| Not true if people just choose to stop or slow their use
| of Facebook. Most of my friends there are barely active.
| I never use the app, only desktop with ad blocking, but
| still, nothing there is really interesting to me, so I'm
| rarely on FB at all. Across the web I never use it to
| authenticate, and if a private company asks me for any
| personal info, it's usually inaccurate info that I enter.
|
| I have remembered a fake birth date, fake home address,
| and other details that I use for all these sites, unless
| they're related to commerce or legally justified
| purposes. We do not need to provide accurate info to
| private companies that mis-use our data (provided it is
| not required for our own reputational purposes).
| tyingq wrote:
| At least for now, facebook has an endpoint that converts
| from new to old.
|
| https://www.facebook.com/plugins/post.php?href=URL_ENCODE
| D_N...
|
| Returns references to the older style url in the returned
| html.
|
| I also noticed it's calling that new style base64 string
| a "story_token" in places, and uses it in conjunction
| with "page_token" set to "VICE" in this case.
| wahnfrieden wrote:
| Thanks for digging this up! Looks like a path forward
| rvnx wrote:
| Nit picky but isn't this action actually illegal in some
| jurisdictions ?
|
| For example in France: << Obstructing or distorting the
| operation of an automated data processing system is
| punishable by five years' imprisonment and a fine of
| EUR150,000. >>
| wahnfrieden wrote:
| maybe! lots of reasonable anti-capitalist action is
| illegal. it's good to be aware but nothing to be
| respectful of
| hdjjhhvvhga wrote:
| I was actually wondering why the big trackers haven't
| implemented this yet and how much time it will take them
| to switch. I mean, the tracking part of the URL is so
| obvious it's just sitting there and asking to be removed.
| Most tech people do that, also some extensions, and now
| Firefox. So it was just a question of time.
| Hydraulix989 wrote:
| By your same logic, participating on HN is free labor to a
| VC firm. I don't see how you can draw the line with a
| general-purpose extension other than simply actively
| avoiding things you don't want to do through your own
| volition.
| wahnfrieden wrote:
| I agree with the logic, and am free to criticize even if
| I engage as an individual without power
|
| I think a good place to start would be with user
| awareness
| Hydraulix989 wrote:
| That's called hypocrisy :)
| wahnfrieden wrote:
| I'm well aware and don't give a shit, I'm not the one as
| an individual causing the problems in the first place and
| have no individual power to correct it. But you're free
| to go spend your time and energy attacking victims of
| these behaviors as complicit, like a "gotcha" for why
| these powers deserve to go unchecked
| nonsensikal wrote:
| shultays wrote:
| Even if it can, it won't the next one. Which fb simply
| encrypts to url (assuming it is not encrypted already)
| lwswl wrote:
| Facebook could also just make it completely opaque, and just
| add random data to their urls(by which I mean a+b=c, not
| a+b=ab), and then subtract it on their end. Then you
| literally might not be able to see anything, not even the
| webpage directory.
| nchudleigh wrote:
| +1 this is likely the situation. I would bet that the rest of
| the url resolves to the old format with the search param after
| some decoding.
| shultays wrote:
| That was such a naive move by firefox tbh
| shultays wrote:
| Perhaps a bit more explanation is needed considering the
| downvotes: https://news.ycombinator.com/reply?id=32118663&got
| o=item%3Fi...
|
| This is an arms race firefox would lose. I think if anything,
| firefox trying to race it is now negatively affecting anyone
| that were able to manually remove tracking id themselves (or
| use a browser extension)
| sangnoir wrote:
| Ad-blocking, like content piracy, are activities that are
| ignored and can flourish _in the fringes_. Once they go
| mainstream and become threats to profit margins,
| considerable resources will be brought to bear to fight
| them.
| eurasiantiger wrote:
| So the ultimate question is: how do we make sales
| executives look like a threat to profit margins?
| sangnoir wrote:
| The only way I can think of is to make profits above a
| certain level unprofitable by taxing them at a high rate
| with ratcheting without bracketing (i.e. any amount up to
| $X billion taxed at 10%, but anything greater than $X +
| $0.01 will be taxed at 60% for the _entire_ amount,
| resulting in a tax graph that is discontinuous for profit
| vs. tax). Profits can be tinkered with, so perhaps do
| that with revenue instead. Then, for companies of a
| certain size will have no need for sales executives, and
| will be punished by Wall Street for exceeding optimal
| sales targets.
| vorpalhex wrote:
| It is enough for Firefox to make the trackers have to be
| more invasive.
|
| I don't have to defeat you if I can make you look bad
| enough to all the observers.
| madeofpalk wrote:
| Tiktok does the same thing when you get a URL to share a video
| tedmiston wrote:
| Instagram does the same as well with your user ID as a query
| param when you share or copy a link.
| david_allison wrote:
| As does StackOverflow
| Nextgrid wrote:
| You could argue that SO at least gives you _some_ benefit -
| there are badges you can earn for popular shared links.
| thih9 wrote:
| FB also claims their tracking is beneficial, they can
| show you more relevant ads this way.
|
| Perhaps there are benefits to everything; is the cost,
| i.e. losing privacy, worth it?
| Nextgrid wrote:
| True but the same can be achieved with just asking the
| person about their needs/interests or using only _public_
| data for ad targeting.
|
| Second, this only applies to Facebook _users_ , and yet
| they also track non-users despite them not even going to
| be showed any advertising.
| remram wrote:
| It's not encoded though, your user ID is right there and
| you can strip it out. I agree that it could be clearer like
| /question/1234?utm_user=5678 instead of /question/1234/5678
| tedmiston wrote:
| The end user viewer can also strip the sharing user ID
| easily if desired:
|
| https://stackoverflow.com/q/10982911/149428
|
| -
|
| https://stackoverflow.com/q/10982911
|
| -
|
| https://stackoverflow.com/questions/10982911/creating-
| tempor...
| OJFord wrote:
| Amazon does similar, along with a generally crap
| description of the product that isn't necessary, you only
| need the 'dp...' ID.
| benreesman wrote:
| ByteDance has done a really good job making me reconsider
| whether I'd ever work for Big Tech again.
|
| I have some serious reservations about social media
| generally, which is why I left to begin with, but between
| TikTok and Instagram I know _hands down_ who I trust more.
| sneak wrote:
| This sort of nationalism is not useful; when pattern of
| life data is used to quietly blackmail or extort you it
| doesn't really matter whether it's your own or a foreign
| government doing it.
| azinman2 wrote:
| I would disagree here. The incentives are quite
| different, as there are many foreign governments who are
| actively hostile and use the internet for extremely
| effective psyops. Social media is the #1 place for psyops
| with great success.
| autoexec wrote:
| > The incentives are quite different, as there are many
| foreign governments who are actively hostile and use the
| internet for extremely effective psyops.
|
| How does this differentiate them from domestic
| governments exactly?
| benreesman wrote:
| Why would you assume I was being national (implication:
| racial) about it. The national and cultural loyalties of
| the people working on these two products is _highly_
| similar.
|
| I trust Instagram more because I was in the room when we
| said "using dwell as the signal and turning the online
| learning rate to who-the-fuck-cares is a bit much even
| for us".
|
| FB/Meta/IG's bad, bad misses are just policy at
| ByteDance.
| chrischen wrote:
| Nationalism is not racial. The implication is that you
| have more of a problem that China is seeing your data vs
| America just because it's not _your country_ , rather
| than both being equally bad (third party seeing and
| potentially using your data against your best interests
| or not compensating you for it).
|
| Nationalism is the belief that your country is inherently
| better than others just because it is your country.
|
| If everyone held this view then there would be no path
| that doesn't lead away from national conflict, because
| all Chinese would choose China and all US people would
| choose US in these situations, rather than focusing on
| objective bad actors.
| kelnos wrote:
| Are there even any _good_ actors, when it comes to
| national governments?
|
| Not saying that's an excuse for badness, but let's also
| not pretend that all governments are equally bad. I would
| rather the US violate my privacy than China, if those
| were my only choices.
|
| Granted, currently I'm more or less physically out of
| reach of China's law enforcement, but well within the
| US's reach. So China having my data -- at least in the
| short term -- probably can't hurt me all that much. But
| longer term? Who knows.
| benreesman wrote:
| FB deliberately didn't build this product because it's
| kind of intense even as social media goes. Well ByteDance
| has decided that we're all selling crack cocaine to
| 13-year-olds.
|
| If anyone is going to display a modicum of social
| responsibility around this new lowest common denominator,
| it's almost certainly FB.
|
| It's weird to find myself defending FB but in this
| instance it's merited.
| azinman2 wrote:
| What's your exact concern with TikTok?
| dataflow wrote:
| Not sure if this is theirs, but [1]:
|
| > "Everything is seen in China," said a member of
| TikTok's Trust and Safety department in a September 2021
| meeting. In another September meeting, a director
| referred to one Beijing-based engineer as a "Master
| Admin" who "has access to everything." (While many
| employees introduced themselves by name and title in the
| recordings, BuzzFeed News is not naming anyone to protect
| their privacy.)
|
| [1] https://www.buzzfeednews.com/article/emilybakerwhite/
| tiktok-...
| dawnerd wrote:
| It's really creepy too if you don't know the share url can
| leak your account name (if you were trying to keep that
| private)
| root_axis wrote:
| Just to add some clarity, it's not that it "can leak" your
| account name, it deliberately pops up your account name and
| profile photo above the video to anyone that clicks the
| link.
| type0 wrote:
| It is but try to explain this to a regular user and they
| will call you a tinfoil hat nerd
| thih9 wrote:
| I don't think this is that big of a problem today, after
| so many privacy leaks people are a bit more aware, at
| least in my experience. Also tiktok actually shows a
| popup that the link contains information about your
| account.
| jjeaff wrote:
| Ya, most people get that there is no privacy. Where I
| think you get more of the "tinfoil hat" accusations is
| that a lot of people don't care or don't recognize the
| far reaching implications of lack of privacy.
| udp wrote:
| Not that it makes it any less shitty but you can disable
| that behaviour in the settings
| tartoran wrote:
| Until that setting dissapears when things get suffled up
| after an update or something like that.
| wahnfrieden wrote:
| It's opt-in behavior. So Facebook is explicitly countering opt-
| in requests for privacy (without informing you)
| akagusu wrote:
| This is the kind of thing that should be illegal.
| Jasper_ wrote:
| How many "this should be illegal"s are we going to see on
| this website before people realize that powerful platforms
| have the money, power, and politics to lobby their way out
| of everything? A huge chunk of this _was_ made illegal
| through the GDPR, and for years on this website everyone
| said it was a massive overreach. Or maybe we make this
| spend 5 years making this specific thing illegal and they
| circumvent it all in two weeks. Or they just ignore it and
| pay the paltry fines as a cost of doing business.
|
| Not to mention the giant groups of people working at FAANG
| here, directly complicit with this behavior, afraid their
| salary and stock options will tank if anything changes.
|
| Companies have the willpower and money to fight any sort of
| check on their power, well after the rest of us are all
| beyond exhausted.
| [deleted]
| rurp wrote:
| So we should just give up? Yes it's a hard problem trying
| to regulate the behavior of companies with the resources
| and determination to subvert consumer rights, but it's
| not binary, incremental progress is possible. If you have
| ideas for a better approach perhaps you could share them
| here.
| baby wrote:
| You should be a able to change how URLs work for your own
| website. They're not making any promise of stability here.
| pessimizer wrote:
| You can. The problem is that they're changing them to
| actively and intentionally circumvent the expressed wills
| of people visiting their site.
|
| I'm allowed to move my arms like I want, but that doesn't
| give me the right to push people off cliffs.
| jefftk wrote:
| Should we also ban sites formatting their pages so that
| you can't easily block their ads?
| zakki wrote:
| I believe the problem is not the ads but the tracking.
| jefftk wrote:
| Formatting pages to make ad blocking difficult is another
| example of websites making a conscious choice to thwart
| user intent.
|
| In both cases, sites are attempting to tie content
| consumption to content monetization, and users are
| attempting to get the content without the monetization
| because they dislike side effects of the monetization.
| teddyh wrote:
| Intent matters.
| jefftk wrote:
| Many sites do this very intentionally, including
| Facebook. Look sometime at the markup on their
| "sponsored" disclosures
| chrischen wrote:
| I guess they should just be done with it and say if you
| don't opt in don't use FB.
| Beldin wrote:
| There are laws against it (in certain parts of the world at
| least). Of course, those laws do allow tracking in certain
| situations. Of course that makes enforcement harder -
| enforcers need to figure out if this is not an allowed
| case. Moreover, enforcement agencies vary in execution,
| with the Irish DPA so bad, their actions are
| indistinguishable from actively undermining GDPR.
| ehnto wrote:
| See also: all the companies scrambling to circumvent App
| Tracking Transparency, in which they are not only being
| duplicitous, they're also breaking the new agreements formed
| with the app store and the customer.
|
| Tracking has been a grey area in technology. Now that
| regulations and users are trying to scrape back some control
| over their privacy, it's going to be a lot clearer to see the
| line between moral and amoral behavior in companies.
| Nextgrid wrote:
| App Tracking Transparency only forces you to do what you
| must have already been doing to comply with the GDPR (and
| potentially even the earlier ePrivacy Directive).
|
| Any complaints about ATT should've been considered
| admissions of guilt by the EU regulators and promoted
| investigations.
| gnu8 wrote:
| Why on earth would Facebook think it is ok to bypass that? This
| should be considered a violation of the CFAA. Start putting
| Facebook execs in federal prison.
| autoexec wrote:
| I'm all for throwing facebook execs behind bars, but what
| part of the CFAA would cover encoding tracking data in a URL?
| sebastien_b wrote:
| sebastien_b wrote:
| I can tell there's a few Facebook/Meta[stasize] fanbois on
| here.
| NelsonMinar wrote:
| I have a feeling Facebook looks at URLs as an unfortunate
| requirement for running their walled garden in browsers. The more
| opaque, the better for their business.
| cmg wrote:
| Along these lines, someone else mentioned that Tiktok embeds
| direct tracking into URLs already.
|
| Twitter recently started adding a 't=' param to their share links
| [0] as well, and I can only guess that it's some kind of similar
| tracking scheme. From watching browser traffic it appears to be
| generated when you click the share button, but I might be wrong
| about that.
|
| [0]
| https://twitter.com/NanoRaptor/status/1548301612246249474?s=... -
| the first thing in my feed. Link works fine without any of the
| query params, of course.
| propogandist wrote:
| the params are included when sourcing a shareable link from the
| website/app (direct links don't have this). This is a move to
| mimic tktok's aggressive tracking practices.
|
| Twitter appears to be just analyzing who shares what with whom,
| but haven't moved into using it for 'growth hacking' like tiktk
| yet (i.e. join cmg, who shared this link on Twtr)
| tyingq wrote:
| It appears the the old urls still exist, they are just sort of
| hidden.
|
| Your VICE link is also here, for example:
|
| https://www.facebook.com/VICE/posts/6037626766270531
|
| Edit: To find the old style url, use /plugins/post.php with the
| new style url passed as a url encoded param value for "href",
| like:
| https://www.facebook.com/plugins/post.php?href=https%3A%2F%2...
|
| Then, there's a timestamp like "10 minutes" ago in the returned
| page that leads to the old url.
|
| I imagine you could make a browser plugin out of that.
| thrusong wrote:
| Cool find-- thanks!
| saos wrote:
| People still use Facebook
| ehPReth wrote:
| billions of people, yes.
| baby wrote:
| if that's a question: yes I do!
| [deleted]
| wahnfrieden wrote:
| This is Facebook actively circumventing their users' explicit
| requests to not be tracked :) They have no respect for you
| cainxinth wrote:
| The feeling is mutual
| texasbigdata wrote:
| Your annual cost is $0, tbf
| lucasyvas wrote:
| I don't agree. If the data is worth something, I think they
| owe its users a share of it. So I'd argue the users are
| being forced to leave money on the table and it's actually
| a negative transaction.
| googlryas wrote:
| The users get a share of it by being able to use Facebook
| for free
| wahnfrieden wrote:
| aka a shit deal
| googlryas wrote:
| It's entirely their choice to make.
| blantonl wrote:
| Your ability to participate is also optional.
| boesboes wrote:
| Until you cannot contact companies and organizations via
| anything but facebook and whatsapp. I've stopped using
| facebook 10 years ago and have ran into this several
| times. A lot of information is only available on
| facebook.
|
| Also, your argument is basically vicitim blaming imo
| [deleted]
| blue_cookeh wrote:
| Debatable given it's well known Facebook are tracking
| users not logged in or even signed up to their services.
| aaomidi wrote:
| I'm not responsible for the business decisions Facebook
| makes. It's their choice to make it $0. Can I pay if I
| wanted to? No.
| dredmorbius wrote:
| Facebook's 2021 revenues were $117 billion, virtually all
| advertising income.
|
| That comes from products advertised through FB, most of
| which are marketed toward the roughly 1 billion wealthiest
| residents of the world: US, EU, Japan, and a few other rich
| countries.
|
| Some complex maths suggests this works out to $117 per
| individual ($468 for a household of four), _whether or not
| they use Facebook_.
|
| Facebook is _not_ without costs, either in direct monetary
| support or externalised costs of the network.
|
| Facebook tracks individuals outside of its platform,
| including those who do not have accounts on the platform at
| all.
|
| The fact that _participation_ has no gated cost is an
| intentional design of the system --- Facebooks users are
| the product sold to Facebook 's customers, the advertisers.
|
| People have a right to criticize and protest independent of
| whether they are customer, product, unwilling supporter, or
| collateral damage.
| KineticLensman wrote:
| > Facebook's 2021 revenues were $117 billion
|
| > Some complex maths suggests this works out to $117
| billion per individual
|
| I think you might need some slightly more complex maths
| dredmorbius wrote:
| Wups, typo. Corrected.
|
| Thanks.
|
| Point remains that FB extracts a real and significant
| direct monetary cost.
| KoftaBob wrote:
| They can show ads to users in exchange for the users
| getting a service for free, without being incredibly
| intrusive in how they target ads.
| wahnfrieden wrote:
| 0 justification for privacy abuse, tbf
|
| As a user have no debt to them just because they offer
| something for free. Maybe you psychologically feel that way
| (reciprocity is a common psychological effect that is
| exploited in marketing)
| blantonl wrote:
| What is your expectation then? There is a really simple
| explanation to this: vote with your feet and don't use
| Facebook.
|
| This is akin to you saying you hate McDonalds hamburgers
| and then you grudgingly march on into McDonalds every
| Friday and order one. Make your own hamburgers dude.
| wahnfrieden wrote:
| don't care
| aaomidi wrote:
| Same way we have dealt with industry bad actors for
| hundreds of years. Regulations.
| noisy_boy wrote:
| That argument doesn't work in light of shadow profile
| etc.
| daniel_iversen wrote:
| It's the price you pay to use the platform because it's free.
| sebazzz wrote:
| It is interesting you say that because there are other means
| of advertising than user tracking. Take context sensitive
| advertising for instance, you currently look at an article
| about harddrives it is likely you may be interested in
| computer hardware - so let's display computer ads.
| dazc wrote:
| The behaviour of facebook and google for the past ten years
| suggests that revenue from tracking based ads must be
| multiple times that of plain old contextual ads, hence the
| continued push down this path?
|
| You don't suddenly decide to stop doing evil for just a few
| percentage points after all.
| autoexec wrote:
| > The behaviour of facebook and google for the past ten
| years suggests that revenue from tracking based ads must
| be multiple times that of plain old contextual ads, hence
| the continued push down this path?
|
| I'm not sure that's a given. It seems like mass data
| collection is profitable in a vast number of ways that
| have nothing to do with ads which could themselves be
| more than enough to incentivize google and facebook to
| continue collecting it.
| blantonl wrote:
| Facebook is in the _business_ as a public company to drive
| shareholder value, and one way they do that is by tracking
| users and generally abusing the privacy of their users.
|
| So, if you don't like that or have moral issues or whatever
| hangups you want to conjure up to hate on them: don't be a
| customer. And don't be an investor. Its as simple as that.
| p49k wrote:
| > don't be a customer. And don't be an investor
|
| No one has to accept this false dichotomy. There are far
| more options. Severely regulate this behavior, force them
| to break up into smaller companies, declare privacy a
| right and thus something you can't legally bargain away
| through accepting a Terms of Service agreement, etc, etc.
| wahnfrieden wrote:
| this is the classic "neoliberal" take: you as an
| individual of the poor or working class should focus your
| energy on fixing worldwide problems through careful
| consideration of your consumer decisions as individual
| actors (purchase this product instead of that one, etc.)
| blantonl wrote:
| This is _social media_ that we are talking about. Not
| food insecurity, access to clean water or healthcare, or
| a safe place to live.
|
| Please don't clutch your pearls and sit here and act like
| you are some champion of the poor or working class, _on
| HN of all places_ , over what Facebook does with your
| data.
| wahnfrieden wrote:
| I see we've reached your end of this conversation
| matthewmacleod wrote:
| I'm sure you appreciate that the reality is a bit more
| complex than that, for lots of reasons.
|
| For example, Facebook also abuses the privacy of people
| who _aren't_ customers (or more accurately, users). Or
| maybe cutting yourself off from Facebook would mean
| cutting yourself off from family or friends. Maybe
| WhatsApp is essential for your work, or for a community
| organisation you are part of. Or if you have a pension
| fund, it almost certainly invests in Meta. There are lots
| of conflicting priorities and issues that can come up
| when trying to think about the costs of being a users of
| a particular platform.
|
| In reality it's totally fine to think that a service you
| use is doing something wrong, to complain about them
| doing it, and to want them to stop. Some might choose to
| leave the service; others might want to spread awareness
| about the issue, or call for regulation. And others might
| shrug their shoulders and accept it anyway.
|
| I'm not sure why you seem so convinced that the only two
| valid positions are "silently embrace anything they do"
| and "cut yourself off entirely".
| type0 wrote:
| > only two valid positions are "silently embrace anything
| they do" and "cut yourself off entirely".
|
| How about bots, can you use your account sometimes and
| other times give it to your bot essentially simulating
| activity and throwing gravel into machinery or will they
| shut you down?
| wahnfrieden wrote:
| there was a browser extension that showed up on HN some
| years back that intentionally sends misleading spam to
| tracking endpoints as you browse
| type0 wrote:
| adnauseam
| autoexec wrote:
| I see this idea thrown around a lot. Random browsing,
| random posts/comments, etc. I'm not convinced that anyone
| collecting your data cares about how accurate it is, and
| it's clear that the people using that data against you
| don't care all that much either.
|
| Maybe if you could find a way to fill their logs with the
| kinds of data that actually matter (fake your precise GPS
| location, fake contacts/friends/relatives with detailed
| fake histories and fake contacts of their own, fake
| credit card statements showing fake purchase history,
| etc) it might be more worthwhile, but you'd still be
| taking a chance because ultimately your life is going to
| be changed because of what ends up in the logs being
| collected.
|
| You could get turned down for a job because your fake bot
| was a little too interested in drug/alcohol related
| websites, or maybe you'll be charged more or denied
| healthcare coverage because your bot made it appear that
| you were living an unhealthy lifestyle. The fake location
| data you sent might get you arrested by police if you
| were one of only a few people logged within a 2 mile
| radius of a crime.
|
| You can't break down the system by messing with the
| specifics in your dossier. The system will process your
| data (the real and the false) just fine and keep right on
| running. Real or fake, that data will follow you for the
| rest of your life and it will be all be used against you
| any time someone thinks it might benefit them to do so.
| bagacrap wrote:
| Does providing targeted ads have to be a privacy
| violation? If no human ever learns my interests then do I
| care that a server somewhere "knows" I like fishing rods?
| dazc wrote:
| Your religion, political affiliation, taste of porn, etc
| could also be on a server somewhere too.
| wahnfrieden wrote:
| that knowledge is actively used for precisely targeting
| things like inciting genocide lol. we're not all coddled
| and gentle hobbyists
| coffeeblack wrote:
| That's what AdSense did for over a decade. Then they
| switched to user interest based ads, because they convert a
| lot better.
| LunaSea wrote:
| This doesn't work because articles articles about hard
| drives don't represent enough ad impressions to fullfil the
| volume requirements of an ad campaign.
| wintermutestwin wrote:
| > It's the price you pay to use the platform because it's
| free.
|
| ? That doesn't make sense. It is most certainly not "free"
| and the real price is one that is far more than the costs of
| providing their services. The problem is that joe user
| doesn't understand the value of what they are paying so
| Facecrook is selling trinkets to the natives for land.
| hexo wrote:
| "free"
| rockbruno wrote:
| Are you implying they would not do it if it was paid? The
| Samsung TV I paid for is filled with ads in the home screen.
| I pay $30 a month for cable tv and I'm still forced to see 30
| minutes of ads for every mere 5 minutes of actual content.
| They would absolutely still do this even if Facebook was
| paid.
| tut-urut-utut wrote:
| They would not stop tracking you even if you pay. There are
| countless examples of this.
|
| The only way to win is not to use term.
| Agamus wrote:
| If only it were that easy!
|
| The only way to win is to bend over backwards to block all
| of their various tracking garbage that is hiding in the
| majority of internet websites.
|
| And I suspect that even the most stalwart soldier in this
| fight is probably still losing somehow.
| wahnfrieden wrote:
| I don't use the platform, and I don't accept that cost
| blantonl wrote:
| this is the way
| jefftk wrote:
| But if you don't use the platform then this new link format
| doesn't affect you?
| wahnfrieden wrote:
| so what, jesus christ
| type0 wrote:
| they still collect a dossier on you, shadow profile.
| jefftk wrote:
| I thought we were talking specifically about the privacy
| implications of the new link format? Which is entirely
| orthogonal to shadow profiles.
| rwalle wrote:
| Define "use the platform"
|
| Do you know that almost every "share on Facebook" button
| on a random news article/blog post collects data from
| you, if you don't have strong privacy protection enabled?
| That means even if you have never registered a Facebook
| account, Facebook could gather your page view data and
| use that to show ads targeting you on another page.
|
| Same thing here.
| jefftk wrote:
| We are talking about a new style of Facebook link that
| has built-in tracking parameters, so that when you click
| through to a page on Facebook it gets logged in
| connection with how you got there. If someone never
| visits Facebook, this new style of link does not affect
| them.
|
| I agree that Facebook also collects data in other ways,
| but this is entirely unrelated.
| iso1631 wrote:
| Except facebook still tracks you, knows who you're friend
| are and knows where you've been (even if your friends
| weren't there you're in the backgorund of a strangers
| photo)
| hdjjhhvvhga wrote:
| FB is an advertising platform that depends on the number of
| eyeballs. This number is already dropping. The more user-
| hostile they become, the worse for their bottom line in the
| long term, in spite of potential short-term gains, if any.
| dredmorbius wrote:
| There can be a lot of pain and harm delivered before the
| market becomes rational.
| wahnfrieden wrote:
| I wouldn't expect a market solution for privacy woes
| googlryas wrote:
| Having an extension or something that removes query string
| parameters is not an explicit request to not be tracked.
| baby wrote:
| Not sure why you're getting downvoted, but yeah there's no
| public API and promise of stability there.
| [deleted]
| benreesman wrote:
| I don't have any super-special insight here, but FBID is
| facebook's global integer ID namespace (fun fact: Zuckerberg's
| account is 3, back in the day he was always getting random friend
| requests from people's unit tests). Don't know what a "p"-FBID
| is.
|
| I know symmetric encryption is reasonably cheap these days, but
| anything times "Facebook edge requests" is a lot, I bet any of
| the cryptographers on here could find out pretty quickly what's
| in that blob.
| jaromir_ wrote:
| 4, not 3
| benreesman wrote:
| Haha that's right, good catch. You can tell it's been awhile
| since I tested in prod. :)
| sedatk wrote:
| "p-FBID" probably means "path FBID" in contrast to query string
| ones.
| tester756 wrote:
| Cannot somebody reverse engineer it?
| notriddle wrote:
| If Facebook engineered this competently, and I'm sure they have
| competent engineers, it's either encrypted or totally opaque.
| If you can break this, you can probably break TLS.
| blantonl wrote:
| joeferraro wrote:
| What an embarrassing take. So your retort to people crying foul
| over privacy is to call them hypocrites?
| blantonl wrote:
| It's _social media_ dude. We 've not talking about access to
| clean water or some other basic human condition where you are
| trading your privacy for a basic human right.
|
| Yes, you are damn right I'm calling out some of you as
| hypocrites, because as some of you around here build and
| scale your products and begin to build out social components
| of your businesses, you will absolutely walk right up to the
| line of regulation when it comes to your user's privacy over
| making your investors happy.
| smarkov wrote:
| > do everything they can to extract as much value out of you as
| a non-paying customer as possible
|
| And that leads to a worse user experience in many areas. You
| use it for free but it sucks and you sacrifice your data. I'd
| honestly rather pay $2-4/month for a social media that doesn't
| suck and doesn't harvest my data.
| cypress66 wrote:
| That may be the way you think. But no everybody here thinks
| that way. Some of us have no interest in giving away our
| business to investors so they can then push you over and do all
| kind of crap. And in addition some of us have no interest in
| extracting the absolute maximum value per user even if it
| involves unethical things. Because without doing so you can
| still live an extremely luxirous life.
| blantonl wrote:
| I concur.
|
| I run my businesses with this in mind, my user's privacy is
| at the utmost importance to me, and the way I approach
| managing my business is to gain the good will of my customers
| first and provide a quality product. And my business is
| wildly successful.
|
| But I'm under no illusions to the reality of the situation,
| and I've been around HN long enough to know that the
| hypocrisy here can be deafening sometimes with regards to
| social media. The downvotes on my post prove it.
|
| Edit: just to bolster my point, the vast majority of ANY app
| developer around here on HN will have been to integrate every
| ad supported SDK in their apps, which literally invades the
| privacy of those users probably worse than Facebook does, all
| for a little bump in revenue.
| pessimizer wrote:
| You might be a great and ethical person whose cynicism
| about the behavior of others grew from experience, but "the
| vast majority of ANY app developer around here on HN will
| have been to integrate every ad supported SDK in their
| apps" is just making up a statistic and getting angry about
| it.
| xiaq wrote:
| Good will has business value too.
| blantonl wrote:
| I completely agree with this. I have direct experience in
| good will to my users on my businesses.
|
| I completely removed advertising from one platform, and for
| my paying customers, I have made the conscious decision to
| not automatically charge and bill my customers for their
| subscriptions unless they explicitly opt-in for reoccurring
| charges. Those two "good will" components have generated
| enormous good will with my customer base at the expense of
| significant revenue.
|
| The flip side of that is that unfortunately good will doesn't
| really have much business value if you are completely revenue
| and profit driven in a competitive marketplace. And if I'm
| wrong, and good will eventually does win out over something
| like Facebook's privacy practices, and the free markets
| determine the winner, then never forget that the markets can
| stay irrational longer then you can stay solvent.
| bloqs wrote:
| Social pressure to make business more respectful of human
| rights when the business is financially incentivised to ignore
| them is a force for good. Someone has to clutch the pearls.
| js2 wrote:
| I wonder if this is related to why mbasic.facebook.com links are
| regularly breaking now.
| terrytibbs wrote:
| Retr0id wrote:
| Are you a GPT-3 bot?
| ynx wrote:
| I'm 90% certain the old number was an FBID. The new one looks
| like a different FBID encoding scheme - possibly with the type
| info included ('p') to reduce the overhead of a second data
| fetch.
|
| FBIDs are a globally unique id system that they've been using for
| almost as long as they've been around, if not actually from the
| beginning.
| FollowingTheDao wrote:
| Oh it's nothing, just something to make your life easier. Oh, and
| to make your life better as well. Just ignore it and keep using
| Facebook.
___________________________________________________________________
(page generated 2022-07-16 23:00 UTC)