privacy

Ok, Facebook, you’ve crossed the line

I have always been a huge fan of Facebook. I’ve come to their defence many times. Over the News Feed controversy, I sided with them (if you don’t want people to see something, why are you posting it on Facebook?). While people were complaining about Facebook opening its doors, I welcomed the change (networks and privacy settings overcome any issues there). When people were afraid of the API and Facebook “selling your personal information to third party companies,” I came to its defence by explaining the nature of an API to non-programmers.

But this time, they’ve gone too far.

The news on Facebook Beacon just keeps getting worse and worse. Facebook Beacon is a service that runs on third-party sites, publishing user actions to the news feed. For example, if you go to eBay or Blockbuster and make a purchase, this will show up in your Facebook mini-feed. This is problematic for many reasons, for example, Christmas shopping or embarrassing personal purchases. It’s one thing if a user has taken an action on Facebook.com – that is expected to be shared in some way. But this is on third-party websites.

Furthermore, Beacon tracks Facebook users when they’re logged-off and it even tracks non-users and users with deactivated accounts. Whose bright idea was that? This was discovered by security researchers, not announced by Facebook.

Facebook initially responded by changing Beacon to request a user’s permission before publishing a story, but calls for a universal opt-out have been ignored.

Until now. As I am writing this post, I am stumbling upon news of Zuckerberg’s post from this morning on the Facebook blog. An apology and a universal opt-out was certainly in order and has now been delivered.

We’ve made a lot of mistakes building this feature, but we’ve made even more with how we’ve handled them. We simply did a bad job with this release, and I apologize for it.

At first we tried to make it very lightweight so people wouldn’t have to touch it for it to work. The problem with our initial approach of making it an opt-out system instead of opt-in was that if someone forgot to decline to share something, Beacon still went ahead and shared it with their friends. It took us too long after people started contacting us to change the product so that users had to explicitly approve what they wanted to share. Instead of acting quickly, we took too long to decide on the right solution. I’m not proud of the way we’ve handled this situation and I know we can do better.

Is this becoming a pattern? Once was commendable, but you’d think they might have learned their lesson. There is a lot of potential for Facebook to provide value for users and monetize itself in the process, but it has to take privacy more seriously. Whose bright idea was it to make Beacon opt-in by default? And with no opt-out? If you look at Google, they’ve been successful at making money off people’s personal data (e.g. Gmail contextual ads) without compromising privacy or being intrusive. At the very least, Facebook needs to learn to err on the side of caution.

Let’s hope this is the last time Zuckerberg needs to blog an apology.

MPAA University toolkit for combatting “piracy” violates copyright laws

The Motion Picture Association of America (MPAA) recently released software which it urged some of America’s largest universities to employ in order to monitor their networks for unauthorized file sharing. Not only do the universities not owe the MPAA anything, but the toolkit was found by security specialists to raise some major privacy concerns. Steve Worona, director of policy and networking programs at EDUCAUSE, says of the toolkit, “no university network administrator in their right mind would install this toolkit on their networks.”

More interestingly though, the software in question was based on Ubuntu variant Xubuntu and also made use of the Apache web server. There’s enough irony in the use of free and open source software to enforce draconian copyright laws already, but apparently the MPAA was in violation of the GNU GPL, the license the majority of the software is released under, by not making the source code available. Matthew Garrett from the Ubuntu technical board contacted the organization about their violation of copyright which resulted in a removal of the toolkit from the MPAA’s website. It will likely be up again soon once they sort things out, but this episode is both ironic and embarrassing for the MPAA. Calls for stricter copyright begin to sound hypocritical when the MPAA fails to respect other copyright holders’ rights.

Oh, and apparently this isn’t the first time the MPAA has done this sort of thing. And aside from violating copyright, they may also be in violation of Ubuntu’s trademark.

I really hope they’re embarrassed, but I’m not holding my breath.

Why I Don’t Use MySpace

I strongly dislike MySpace. Unfortunately, as the de facto standard for online communication in the music world, it sometimes feels necessary. Though I maintain an account for my band, I refuse to create my own personal or artist account.

It’s not that I refuse to participate in “social networking”. I’m a bit of a Facebook fanatic and my friends can attest to that (though Facebook calls itself a social utility instead of a social network). It’s MySpace in particular that inspires loathing.

Security: Things like the Samy Worm, a cross-site scripting attack that took MySpace by storm in October 2005, make me feel uneasy about the freedom a user has to add anything to their profile. Although it was largely due to an Internet Explorer vulnerability (there are many) that Samy was able to get his code to execute (which thankfully, was not malicious), there are other security holes which are MySpace’s fault – such as the ability to view a user’s private data – which go unpatched for months.

Privacy: Ignoring the huge security holes in MySpace privacy settings that have existed in the past (mentioned above and here), MySpace simply has no hope of ever coming close to implementing the types of complex privacy controls that Facebook has; you can tell they just don’t have the infrastructure in place. There are no networks, no meaning to relationships such as “friend of a friend” (since it’s more common to be friends with a stranger than someone you actually know), and hardly any ability to separate off sections of your profile, since it’s largely a single section where anything goes. Privacy settings seem to consist of simply “public” or “private”, rather than having any real meaningful or useful control over your content.

Search: ie. lack thereof. Try finding one of your friends who’s not in your Top 8 and hasn’t posted on your profile recently. Enough said. It’s easier to find someone who you’re not already friends with on Facebook than it is to navigate to a friend’s profile on MySpace.

Design: MySpace design is practically non-existent. There is actually no bar that’s set because anything goes. The lack of any sort of unity between profiles breaks so many fundamental rules of user interface design. People can change the basic buttons (e.g. the “Add as Friend” or “Message” buttons), and even change/hide the main website header! And I don’t even have the patience to talk about the freedom to mess with the colour scheme. On Facebook, you can’t fundamentally alter the look or structure of your profile. That’s because the focus is on the profile content, rather than it being some sort of contest to see who can deviate from the standard most. It makes navigation and communication easy without limiting a user’s ability to “express themselves” in a meaningful way. True freedom is not an absence of any structure or rules. In order to drive, we all need to agree to some basic rules of the road. Without that structure, we’d have the freedom to do anything on the roads, yet we’d lose our freedom to use them for safe and effective travel.

Bugs: Now, as a programmer, I know that there will always be bugs in software. But for a website as big as MySpace to constantly tell me “You must be logged in to do that” when I am trying to log in, to have broken links in the inbox, to constantly serve up “unexpected errors” or to not warn a user when javascript is needed and not enabled just makes me feel embarrassed for them. I deleted a message from my inbox today from Tom assuring me that MySpace did “NOT DELETE” any of my friends. There was just a bug they’d discovered that rendered a friend count inaccurate, which, upon correcting, had lowered some people’s friend counts. How hard can it possibly be to maintain a friend count? And how hard can it be for a social networking site to develop a mechanism for making announcements to users that doesn’t involve spamming the entire user base?

Culture: Internet culture often inspires the lowest common denominator. MySpace inspires some of the worst. Case in point: my band received a friend request (and accompanying message) from this guy today. Somebody shoot me. Err.. $ombodyz sh00t me!!~~~ (Yes – I rejected the request.)

Intrusive Advertisements: MySpace needs a button to report inappropriate content on its advertisements. I have the desire to report ads much more often than I ever have the desire to report user content (unless it’s a message from Tom…). Someone needs to introduce them to the words “quality” and “control”.

Autoplay: I’m sick and tired of reaching for the mute button (especially since it’s never in the same place).

Pet Peeve: Is it just me or is the equalizer in the MySpace music player just faking it?


I’ll continue to maintain my band’s MySpace profile (as long as it feels necessary), but let me take this opportunity to reaffirm my resolve to boycott MySpace on a personal level. I’d much rather use more powerful, user-friendly utilities such as Facebook and Last.fm (see my artist page – who needs MySpace!).

I think MySpace’s days are numbered. Here’s to hoping that number is relatively small.

Creative Commons Attribution-ShareAlike 2.5 Canada
This work by Blaise Alleyne is licensed under a Creative Commons Attribution-ShareAlike 2.5 Canada.