Just as Facebook can be an important vehicle for positive change, they are, like most technologies/services, a double-edged sword. One can argue that Facebook is just contributing to further awareness that such harassment takes place. But in reality this draws attention away from such issues because the central theme then becomes "Facebook is evil... Facebook makes it easier to harass", etc. Such conclusions are unfair--these things will happen with or without Facebook. That is, the key take-away from this article is that they're making themselves a bigger target with their senseless privacy policies and their unreasonable comments about privacy.
They're playing with fire and they will get burned.
[Disclaimer: I work for Facebook, but obviously I don't speak for it].
It is unclear to me which "new" policies they are referring to in this article: (a) Pages you fanned have always been public. (b) The "Religious Views" and "Political Views" fields on your profile were not included in the conversion to Page connections, explicitly to avoid this sort of thing. (c) I'm also not sure how they decided that profiles were being automatically deactivated based on reports. (d) The article doesn't really clarify how these "targets" are being identified -- that seems somewhat important to decide whether Facebook's "new" policies are making harassment easy...
I've stopped using facebook after the recent changes, but there was an option that the pages you are a fan of or like was visible only to a set of people (chosen by you) which is not possible now. Further, even if you set the visiblity to limited, you are still visible on the fans of the page section which can allow you to be identified there.
True, but this has always been the case. Page connections have always been public. You can still control their visibility on your profile.
Separately, while it is true that you can be seen on the Fans section of a Page, the chances that this will happen are pretty small- try this Page: http://www.facebook.com/pages/The-Lord-of-the-Rings-film-tri... . I believe the six or so images of non-friends are random each time.
> True, but this has always been the case. Page connections have always been public. You can still control their visibility on your profile.
Don't you think that is a little misleading? You provide users with a privacy control that in reality doesn't do what you say it does. You are tricking people into thinking that they have control over visibility and then you go and share that with anyone. Who cares if the connections that are shown are selected randomly? It doesn't change the fact that you ignore the privacy control that you have supposedly given your users. I think that's what bothers people. If you don't think people would care, maybe you should put a warning on the privacy settings that says it only applies to your profile.
On the profile yes, but on the page, no! Which is the problem in this case.
The chances are small, but there is a chance as demonstrated in the article. Consider this profile (random, and I'm not connected to him) http://www.facebook.com/profile.php?id=1189567657 where all his profile info is public and linked to "pages". It wasn't the case earlier.
The Fans box on the Page has always been the way it is now. When you fanned a Page, there was some small chance that you would appear in that box, and the users who appeared in that box are random on each page load.
I'm not convinced that the article demonstrates anything yet -- it doesn't really explain how this targeting was done, just vaguely claims this is because of some "new" changes in connections privacy. My whole point is that there isn't anything new about the way Page connections behave.
What is new, as you said above, is that the plain text boxes where users put in their favorite movies etc, are now links to Pages. Previously, these movie strings were actually links to a search for users who mentioned the same text. What has changed is the target of this link -- it is now a Page instead of a search result. And as before, you can still control the visibility of these boxes on your Profile.
<i>I'm not convinced that the article demonstrates anything yet</i>
Sorry, nothing personal against you, but then that is the same line taken by the upper management in FB who say that there is no real loss of privacy. And yet, I ask you to just do a time bound google search/YC search and you will see HOW many people are raising concerns with FB's recent changes. And this hasn't even gone to instant personalization yet or the forced opt out instead of opt in (I'd really like if you actually addressed this opt out policy if you choose to respond to this comment)
<i>And as before, you can still control the visibility of these boxes on your Profile</i>
Please tell me how? The privacy options themselves have become so convoluted that I am not sure if it is set as I desired. And I have no way to check it as well. You know why? Cos my profile URL shows a 404 if I'm not logged in to FB. Check it out: http://www.facebook.com/anantj - Try with your logged in browser and another which you've never used to login to FB.
Why is it that I can't have free form text at all? Why _must_ it be linked to pages? At least give me an option to prevent that for movies, tv, religion etc
If you're interested in seeing if your settings are working, you can try the "Preview my profile" button on that page.
Btw, I found that page under top right Account->Privacy.
- I wasn't involved enough with the Instant Personalization product to be comment on it competently.
- As for criticism, you can be sure we're watching very closely. IMO, much of it is because people don't really understand the changes or what is affected (as you point out, this stuff is insanely complicated, and we need to do a lot better at explaining and clarifying it to people).
- You can absolutely have free form text. The "Bio" field on your profile is free form.
Why can't you have it in the "Favorite blah" boxes?
(a) Users simply used Pages to do this a lot more than they used the free form text. That stuff was edited once, and it wasn't convenient to maintain as your likes and dislikes changed.
(b) We think there is significant utility that we can provide to the user from having this information in a structured format. Instant personalization aside, going to Pandora and hearing your favorite music play is pretty cool. We think we can do a lot more here.
Religion is already not in this set -- it was not included in the Connections change recently.
You've created publicly accessible aggregations of members expressing interest in a potentially limitless set of categories (whatever you may choose to call them). You've taken previously private profile information and pre-emptively linked it to these public categories. Even where some of this information was previously publicly visible, it wasn't so conveniently publicly indexed; someone would have to visit individual profiles in order to turn it up.
By the way, religious and political views do not only express themselves in the fields you mention. What disrespectful soul there decided to take my "Favorite Quotes", with access previously restricted to "Only Friends", and plaster them -- without so much as a warning -- all over my public profile?
I've been pretty cautious, and there was nothing very incendiary or damaging in them, but it still caught me out.
For me, it was the last straw. I hope FB, or at least its current Management and, ahem, "policies", follows MySpace into a death spiral, taking their accumulated financial equity with them before they have a chance to cash out.
I hope HN will pardon a bit of unusual vehemence from me, but Facebook has come to be, simply stated, slimy. I guess I write this comment in the vague hope some fraction of the message might get through whatever reality distortion field they're currently running in-house.
Finally, as a few commentors have started to point out, as Facebook continues to publicize their members' data, those members more and more tightly control their expression. The result is that the site continues to become blander and blander, less and less "personal". There's only so long people will continue to find novelty and interest in generic updates.
Control over privacy. Personal expression. What brand-building feature are you going to kill off, next?
I remember when "everyone" was on AIM. Even if you preferred another platform, you used AIM because that's where the bulk of the general (U.S.) population was, for IM; they'd "won" the IM platform war. I don't think I've even signed on to the thing in a year or more.
A lesson for any "winner".
P.S. As for fanning being public, it used to be someone would have to seek your ID out on those different fan pages. Then, around the end of the year, Facebook decided to (pre-emptively, again) display that information in aggregate for each user on their public profile. Maybe googling might have exposed some or all of it previously, but you sure made it a lot more convenient. (E.g. for that HR staffer looking for a quick means to winnow a stack of resumes.) And I'm not even addressing the publication of everyone's friends, etc.
If you've read this far, thanks for taking the time to consider my response. It's not meant to be personal. (Well, except against those setting these policies at Facebook. Even then, it's the policies that elicit the response; the people I don't know personally.) It's strongly phrased to emphasize the points, and the frustration they cause.
" Even where some of this information was previously publicly visible, it wasn't so conveniently publicly indexed; someone would have to visit individual profiles in order to turn it up."
Previously, the text in these boxes was a link to a search result for users who mentioned this text. Now it is a link to a Page where a small, random set of the users who mentioned the text are displayed. You can still control the visibility of these links on your profile. You'd still have to either visit a lot of users' profiles (and they'd have to have set their interests to be visible), or you'd have to reload a Page a lot of times.
(As for "Favorite Quotes", I will look into what is going on with it).
"As Facebook explains, "Keep in mind that Facebook Pages you connect to are public. You can control which friends are able to see connections listed on your profile, but you may still show up on Pages you're connected to." Likewise, "While you do have the option to hide your Friend List from being visible on your profile, it will be available to applications you use and websites you connect with using Facebook." Because Facebook deems this information "public," it reserves the right to share that information with its business partners and third party websites, regardless of your visibility settings. "
"regardless of your visibility settings."
So, we can "hides these links on your profile" from our friends, but we can't hide them from Facebook's "business partners and third party websites, regardless of your visibility settings?"
Isn't that completely backwards from what people would want from a social site? If my understanding of this issue is correct (and I confess, I haven't been able to hold FB's privacy policy and settings regime in my head for some time), then this would be like hiding my street address from my friends but broadcasting my address to junk mail companies with a hearty "Catalogs? Send 'em here!"
Thank you in turn for your response and consideration.
Separately, I'll mention the following just in case it is of any interest or use.
Last night shortly before 11 pm Pacific time, I "fell" into what appeared to be the public view for a profile named "Everyone". My memory's hazy, but I believe this happened as the page flow returned to me when I was backing out of the privacy feature/page that allows one to view one's profile as it appears publicly. I backed out by clicking the button "Return..." dedicated to that purpose on that page.
I'm not certain this is how the flow occurred, but it seems to be what I remember. If it's not the precise flow, it happened somewhere in the flow I used to view my publicly visible profile.
If this is a concern, I can provide you a bit more in the way of details, out-of-band. (I doubt it would be the case, but in case this exposed some test or "magic" ID (the ID does look unusually long).) I just browser back buttoned to a former page and clicked "Home" or whatever to resume what I was doing.
I, too, am considering ditching facebook. I get very little value out of it in return for the hassle of having to closely watch every update, every new feature and every policy change just to keep tabs on my privacy.
"By the way, religious and political views do not only express themselves in the fields you mention. What disrespectful soul there decided to take my "Favorite Quotes", with access previously restricted to "Only Friends", and plaster them -- without so much as a warning -- all over my public profile?"
I'm just a software engineer. I'm sorry you think that I'm doing a poor job of defending Facebook, because I think in that a lot of the criticisms are inaccurate and come from a poor understanding of the privacy policies, the motivations and implications. Admittedly, this is mostly because they are insanely complicated, and we need to do a much better job educating people. We (where that includes me and all the people I know at Facebook) care very much about doing the right thing for users while still innovating and giving users the most utility we can. I know it's easier to just think of us as an evil corporation out to suck your private secrets and sell them to the slimiest buyer around, but that just isn't true.
[Where there are valid criticisms, you can be sure we're taking them very seriously.]
Here are my criticisms, would you please let me know which ones are inaccurate? If you don't want to explain fully why each one is inaccurate, you can just give me the numbers, and I'll do my own further research.
1. New features are rolled out without advance notice and without prior explanation of their privacy implications.
2. The privacy policy changes without advance notice, often towards ensuring less privacy.
3. Features that expose more personal information are frequently enabled by default (opt-out rather than opt-in).
4. With instant personalization, social plugins, and the 'likes' feature, FB has switched to making no distinction between 'public if you look for it' and 'publicly broadcast'.
5. These features also indicate that FB has started tracking users browsing habits across the web. It's not enough to know everything about a person's social life, FB wants to know as much as it can about their private life, too.
6. FB asks to inspect user's email address books while suing a company that uses the same basic technique to manage FB profiles on the user's behalf. This is staggeringly hypocritical.
7. That same Friend Finder feature does not explain what gets pulled from your email account, and it does not adequately explain that those email addresses are stored and may be used not only to help that user connect with people who already have FB accounts. It does not explain that FB treats the information it pulls from email accounts as a shadow social graph.
8. There is no easy way to export user data.
9. The privacy settings are lengthy and confusing, and there's no simple way to restrict everything in one go. To ensure your privacy, you literally have to wade through page after page, and you have to do so on a relatively frequent basis as new features can undo your work (see #1,2,3).
While the motivations of the creators of the privacy policies and options might be pure, the fact that the settings are confusing enough that people are exposing information that they want to keep private is pretty damnable.
If Facebook cares about protecting the data of their users, making the privacy settings more intuitive would be more productive than worrying about needing to "educate" users. This includes having default options that hide data instead of making it public.
"the fact that the settings are confusing enough that people are exposing information that they want to keep private is pretty damnable."
The information is being exposed, not because of confusion, but because Facebook wants the information exposed (to business partners and affiliates). The confusion leads to surprise, not exposure.
"making the privacy settings more intuitive would be more productive than worrying about needing to "educate" users."
This was exactly my thought earlier in the thread. If it's this hard to understand and explain, there's some simplification yet to be done.
Of course it would be best if the settings were so simple that no education were necessary.
But my claim is (a) for a site like Facebook to work "well" [where we can argue ad infinitum what "well" means], some information needs to be shared in the system, and some needs to be private. (b) this is often different for different groups of people. You now have to implement a privacy system that works for every piece of content, for every set of users that I want to define a setting for. I think you'll quickly come to something fairly complicated. There are very smart people trying to come up with abstractions and interfaces that make this easy to do, but I fear that at the end of the day, users are simply going to have to learn some new tricks if they don't want to be surprised. And that means, we have to figure out how to explain this complex system to them.
Frankly I'm a little hesitant to attempt to explain in too much detail, because I don't want to do a bad job and I'm not sure I'm seeing all the angles. I'll try to do a very high-level view. Keep in mind that this is just my perspective.
The most important thing is that although we started as a very simple profile-plus-friends social network, there are now a very large number of people connected in this manner.
We have the opportunity for the first time to really let a user define their identity in one place [their relationships to real people and entities in the real world, their likes and dislikes], and shape the content on the web around that identity.
We have the ability to share that opportunity with smart hackers everywhere -- but we obviously cannot just willy-nilly hand over the data to anyone. We need to define a usable API, a set of acceptable practices, a way to enforce these things so we respect the user's trust without completely destroying the app developer's ability to do something useful.
This is really hard. We're slowly finding our way to doing this well, but there are many unforeseen issues, especially because app developers have a lot of money at stake. We're iterating on our API, trying to change up the constraints on developers.
At the same time, several cool applications wouldn't be possible if everyone were to keep everything private from everyone -- you have to be social to some extent on a social network if you are to derive any value from it. So we're trying to get people using this complicated privacy interface where you can control publicness/privateness at a very fine grained level, but you need to understand many things to do this correctly.
We're also trying to set things up so that you can hide things as you want from the real people who might judge you for it or whatever, but at the same time, you can get functionality related to that interest from some application [for example, you may not want to tell your friends you like Britney Spears, but Pandora should still be able to play you Britney Spears and similar music].
There's a whole other dimension related to the Open Graph stuff -- building a "semantic web", having one graph where users and entities are connected and organized in a way that can be leveraged to do all these cool things that the web originally promised but hasn't been able to deliver.
There are tremendous engineering challenges to putting all this together.
As you can see, this is a lot of balls to be juggling. Our philosophy has always been to iterate quickly, correct missteps just as quickly, and not be afraid to innovate.
There are a few things I'm pretty confident we don't ever want to do-- the first of which is that we don't want to ever sell user data. That would be an incredibly stupid business decision for a company that wants to help you manage your identity on the web, and we recognize better than anybody that users need to trust us.
I think I've gone on long enough-- I'm not sure I actually answered your specific question. Hopefully my blathering was useful to give you some feel for our motivations though. If you want to learn more, you can listen to some of the talks here: http://apps.facebook.com/feightlive/ . I recommend the closing remarks by Chris Cox.
Is that true? Pages were not always public, were they? Didn't that happen last December[1]. Before that becoming a fan of a page meant getting updates from whatever you were becoming a fan of. Now it means announcing on your public profile that you like it. I have had to un-fan myself from so many pages...
What about "interested in" and "looking for"? Depending on where you live, and what you list there, they could be used to target people for harassment as well.
Someday, someone will be killed by a crazy person who takes advantage of an online service's lax privacy controls. That will prompt legal changes like those that followed the 1989 death of actress Rebecca Schaeffer at the hands of a stalker. He used California DMV records to find her home address:
