This basically illustrates one of the biggest issues with the privacy debate. Generally, "enforced transparency" advocates (who are against things like pseudonyms, like that Google CEO) are often privileged people who have little to lose through not being private, and cannot understand or appreciate the need for privacy by people, for instance, activists who's identity who is kept private to shield them from personal attack, people with a sexuality that isn't accepted by people they know - transparency advocates forget that we don't live in a perfect world and that everyone has the right to shield themselves from irrational people who would destroy them on finding out certain things about them.
I speculate that, in a world of total transparency, things like this will become much less important as everyone realizes how weird nearly everyone is. I think that, to an extent, everybody thinks that the general population is much cleaner and more "normal" than they really are, and that in an environment where everybody can know everything about everybody, revelations like this will cease to be interesting.
However, I certainly could be wrong, and I'm certainly not advocating for anything in particular here.
Your relative normalcy gives you the privilege of thinking how weird "nearly everyone is", and that having no privacy wouldn't be such a big deal.
There are many groups of people who still experience tremendous bigotry...for example, having everyone be completely transparent doesn't make transgender folks any less rare, or any less subject to prejudice and hostility. On the whole, having everyone "come out" about whatever it is that takes them outside of "normalcy" might be good for society. But, for an individual who isn't ready to be out, or who has safety concerns about being out, the total transparency argument is pretty hollow.
I know you're not campaigning for anything here, so I'm not really arguing with you. But, I am highly mistrustful of Facebook, and consider some of their tactics and goals deeply unethical, so I wanted to point out that what many are viewing as a neutral "technology marches ever onward" sort of thing is really more a situation of a few companies extracting value from exposing people's private lives, and constantly being on the look out for more ways to extract that value and more ways to profit from that erosion of privacy. It isn't neutral and it isn't accidental. Facebook (and Google to a lesser degree) wants to own your private life and sell it to the highest bidder.
"I speculate that, in a world of total transparency, things like this will become much less important as everyone realizes how weird nearly everyone is."
Seems like very wishful thinking. It seems to be hard-wired into human nature to be suspicious of, and consequently antagonistic toward, noticeable differences. Forcing those differences out into the open probably won't significantly alter the impulse toward hostility. It seems just as likely that the differences will come out into the daylight, but the prejudices will sneak into hiding. I'm not sure if those prejudices are more dangerous when they're naked, or when they're cloaked.
I think you raise an interesting point, of course. I guess I just have a more cynical and pessimistic view of the result.
I can't imagine a world where I'd be comfortable with publicly displaying the entirety of my Google search history.
I guess this is complicated by the fact that our actions don't necessarily reflect our beliefs or identity, and a public display of actions or even just words (posts) can present a misconstrued image of ourselves to the world (or at least one that is ripe for misinterpretation).
You are totally ignore physical and psychological violence that people throw out towards others for very baseless and primal reasons, often for just acting differently, disrupting a social pattern, making another feel less secure in there world view.
People are often hiding aspects of there life not for embarrassment, but for protection. Then there is always the entire "blame the X" that precedes many great atrocities.
You may like to think the world is a utopia or not far off it but genocides are going on right this minute, its the last thing the world needs is more exposure to vulnerable people.
Quite the opposite. By summing up people with different traits together, what you get is a normal distribution around the "completely average person" (central limit maybe?), and that's what people compare everyone with. As others stated, that's what happens in small towns where everyone knows everyone. You lose the sweet anonymity of the city.
> I speculate that, in a world of total transparency, things like this will become much less important as everyone realizes how weird nearly everyone is.
We've done this before and it doesn't work that way.
Back in Colonial New England, say Massachusetts in the latter 1600s, nearly everyone in a given small town would be essentially 'transparent' to pretty much everyone else. There was so little room, and so few people, that there wasn't space to have much privacy.
And social norms were horrible. You couldn't get away with being of the wrong religion, with being suspected of adultery, or a lot of things that are either ignored or not considered problems now.
People didn't learn to accept others. They forced others to conform. And the revelations never stopped being interesting to those who enforced conformity.
Yes, you could indeed leave the only world you've ever known, destroying your ties to everyone you've ever loved and respected. You could also kill yourself.
The lack of compassion here is stunning. Regardless of what you think of suicide, the fact that suicide rates are currently astronomical among LGBT youth in America should give you pause.
The solution is to this is to build, as I was asked to design once in a job interview at a major tech company(!) a communal dossier that collects sighting reports and tracks the movements and details of these people, and see how they react to a site like whereiseric.com that shares his life details with us as much as Google snarfs our details.
The issue isn't Facebook's controls, it's user behavior, and there's little anyone can do about it.
I don't use Facebook because of this. There's not much the company can do to prevent people from making things public about you that you'd rather keep among friends. How is Facebook to know the implications of you being at one party vs another? Sharing is sharing. Just because you keep your profile locked down doesn't matter when someone else can share whatever they like with whomever they like. I understand not having a profile doesn't completely prevent this, but it helps make it a lot less public. Nobody will receive a notification linked to my profile that I was tagged in a photo because there's no profile to associate. We're past the point of being able to prevent this entirely, but I'm not going to make it any easier.
If I add you to my group (without you even knowing), the system should not be sending out notices to all of your contacts that you 'joined' my group. You didn't join, you were added - there's a huge difference.
I agree this particular feature should be fixed, however fixing it doesn't solve the core issue of your contacts sharing information about you. This is the core functionality of Facebook I can't agree with, no matter how their privacy controls work.
* the system should not be sending out notices to all of your contacts that you 'joined' my group*
- that's up to Facebook, and the parent is quite correct, if you don't your private life out there for all to see, don't put it on a social networking site because you don't have any control, other that what Facebook feel is in their interest to have. You give up that control when you put it online.
I have no sympathy for people that get found out because they put the information on Facebook and someone they didn't want to know saw it. People have to start taking responsibility for their own privacy and not crying to Facebook whenever this sort of thing happens. Also I tend not to believe most people because its an easy way to tell a burning secret without actually doing it, the confessors version of suicide by police.
tl;dr - don't put your secrets in the hands of facebook's whims because they aren't your best friend, they are a commercial business and your privacy isn't their concern, except when it suits them to be.
The point is that the users who were outed didn't "put secrets in the hands of facebook's whims" [sic], they were outed, when someone else assigned them to a group that the other person had created.
Simply put, you when someone assigns you to a group, by default you should get a notification along the lines of "So-and-so has added you to a group x. Are you part of group x?" Very much like how tagging in photos currently works, though I think there the default is to allow tagging.
I guess you're missing the respondent's POV - don't put anything, ever, in facebook, because ultimately they don't give two shakes about you or anything else other than making money.
Total answer to this is if the person wasn't on facebook, none of this would have happened.
True. But that's not a realistic solution for most people. It's like saying "don't have a cell phone". I mean, you can not do it, but you're out of a lot of people's loops.
The point of the article was that these people did everything right apart from that. They DIDN'T put anything on Facebook. They were added to a group without their approval.
Well, that could be the "answer" to every situation where someone got victimized. Participating in society of course opens you up to the possibility of being victimized.
How is the answer "don't participate in society" instead of "make society a better place?"
you should get a notification along the lines of so-and-so has added you to a group x
- so says you, but what you're entirely missing (again) is that it's entirely up to facebook what notifications they send and just because you think they should, because of your privacy concerns, doesn't mean that FB will because their concern isn't your privacy, but rather making money for their shareholders.
It's very simple. If I'm friends with you on FB I can create a group called "Gay HN users" and add you. If the user list of the group is public than and while you're sleeping all your friends will be notified that you're a member of the group even if you put them on restricted, because it's public.
They did put just enough information to be dangerous on Facebook. The girl in this case did the following:
Joined FB and added her details (real name etc) (first mistake)
Added her dad as a friend, even though he objects to her private life (second mistake)
Added the Queer Choir group leader as a friend (third mistake)
So she now has two FB friends with diametrically opposite views, and wants to keep them completely compartmentalised. Trusting Facebook to do that given the beacon fiasco, and the multiple privacy slip-ups since, is not wise. Yes this is FB's fault for having bad defaults, but you can't trust FB to keep all your stuff private, because they really don't care, and have made this clear many many times in the past. Their business model is predicated on sharing your data with as many corporations and people as possible.
There are other ways to share photos and events which are not a ghetto cut off from the web, so it's better just not to join a club which insists all your acquaintances must join in order to share and then lets them know the intimate details of your life automatically.
arguably, the fact that they had a profile on facebook at all means they 'put the information on facebook'. It's a weak argument, imo, but it's being made.
Except that's not correct. If you're on FB then anyone can tag you or put you in a group or any thing else they want. The simple solution is not to use a social networking site if you want to keep your social network private.
Whilst I find this whole privacy setting issue unpleasant and frustrating, I am continually amazed that people would be Facebook friends with parents and relatives - from whom they would prefer to keep things hidden.
I would not let my parents sit in the room whilst I chatted with friends, or listen in on phone calls. I would not let them go through the photos on my phone, nor those of me on the phones of friends.
I think the point of a social network is to stay connected to people with whom you are comfortable being yourself.
I feel incredibly sorry for the people in question though.
> I think the point of a social network is to stay connected to people with whom you are comfortable being yourself.
The problem is that people you barely know add you, and if you reject the friend request you're indeterminately labeled as an asshole. This has happened to me several times to an extent where I was called out on it in person. My rule of thumb was that I don't add people from whom I wouldn't appreciate a call at 3am.
I had to break this because apparently the fact that it says "friend" doesn't repel people who I haven't seen in years. SO right now I'm using lists and I've put tons of people in 'restricted' but still, this mentality is annoying as hell.
Regarding family: I'm friends with my grandmother and I hate it. She doesn't understand most of the stuff that I post about but she still comments stupid things on my posts and pictures. Well now she's on restricted but if she'd ever found out I'd be in trouble.
Off-hand the following categories occur to me: co-workers, classmates, random people at user groups you attend (or any other club-like group), family members. In all these cases, you don't have control over the complete set of people you interact with, so "wanting to be in the company" of them is not relevant.
I guess the biggest problem is that Facebook is now the place where everything comes together. You suddenly end up having your boss, parents, coworkers as friend along with the guy you used to do drugs with during your teen years and that trashy ex-girlfriend. And it's not easy to keep those things apart with the real name policy facebook has. It's also not easy to reject a lot of friend requests. Sure somebody you haven't seen in ages you can easily ignore but with coworkers it can get unpleasant. I'm glad that my parents are too old for facebook but for a lot of especially young people rejecting a parents' friend request is probably impossible as well.
Sure you can try to have different profiles. But they easily spill over. And facebook collects a lot of data. The worst thing are probably the phone and address books of your friends. Someone has stored your email address or phone number associated with your real name on his phone and installs the facebook app and suddenly they now. Or people are stupid enough to give facebook access to their email account. They even started to ask friends of you what your real name is.
I recently had to delete my account because they realised I was using a fake name. I don't know if somebody "squealed on me" or they got the information elsewhere.
In the past your online identities were easily separated because everything was in a different place and it was easier to be anonymous. You could have several IM profiles for friends and family separated. With other people you'd only communicate through one of your many email addresses.
> Whilst I find this whole privacy setting issue unpleasant and frustrating, I am continually amazed that people would be Facebook friends with parents and relatives - from whom they would prefer to keep things hidden.
> I would not let my parents sit in the room whilst I chatted with friends, or listen in on phone calls. I would not let them go through the photos on my phone, nor those of me on the phones of friends.
Same with most people. Most people have different personas for different groups--they have their family persona that they present to their parents and other relatives, their casual friend persona they present to most of their friends, their intimate persona they present to close friends and lovers, their work persona for co-workers, and often others.
Facebook has purposefully decided to ignore that, and insist that you have a single Facebook persona. That gives you a couple poor choices for how to use Facebook. You can pick one of your personas and make that your Facebook persona, and do not "friend" anyone with it who does not belong with that persona. This is hard to explain to those groups that you use the other personas with.
Or you can try to use Facebook's poorly designed, poorly implemented, poorly documented, frequently changing, and laughably inadequate privacy controls to try to beat their "one size fits all" persona approach into something approximating the reality of any normal person's life--and if you ever trip up, you have a good risk of blowing up some aspect of your life.
I remember the first time I got tagged in a picture by a friend on Facebook. I deactivated my account immediately because it felt really unsettling that people were "checking me in and tagging" me at places I didn't even know I was being tracked at. Alas, given enough peer pressure in my circle I reactivated it simply because it was easier "to invite all friends at once to parties and other events", and I was missing out on most of then unknowingly without even getting an invite. One might say I need better friends, but I sympathize that when you have 25 people to invite or more, that you are going to miss people. The tagging still unnerves me.
9 Sep 2011 [1] seems to be the date at which they introduced that. I have since set that setting as you recommend, but I was definitely on Facebook before that. I guess the unsettling feeling (combined with this and all the incidents where changing an arcane library of settings is quite often bound to leave an open passage) has just stayed around since then.
>> "EDIT: Just made a double-check now, guess what? An open passage:
Note: You can still be tagged, and tags may appear elsewhere on Facebook. I can't review the tags if they are found on someone else's timeline."
I think this changed when they upgraded to timelines. You can approve tags before they appear on your timeline but you will still appear as tagged on the photo which will appear on the person who tagged you's timeline. So you are 'protected' from your friends seeing it but mutual friends and the taggers friends will see it.
This is one of a several privacy controls Facebook diluted. I used to be able to say exactly when groups of people could/couldn't post on my wall. This was really useful. Then they changed it to allow me two options - friends (i.e. everyone) or only me. Had to hack together a weaker solution through multiple privacy settings.
Yes, and it's pretty surprising that the same mechanism isn't used for group affiliation.
The default behavior should be that other people can't release information about you without your approval, whether it's photos, location, group membership, reading habits, etc. This shouldn't be a tough concept for FB.
This comment thread is a perfect example of the problem with fb's privacy control system. HN readers are generally tech-savvy and privacy-aware, especially relative to the typical fb user. Yet this thread is full of many comments exhibiting confusion as to how these settings behave under difference circumstances.
When working with unheralded amounts of potentially publicly consumable personal information, the bar for appropriate privacy handling that most of us expect is very high. And our bar is clearly higher than facebook's internal bar.
Yet, we usually conflate these discussions with asides about their motivations - financial gain, genuine ideological belief in open identity, or just mistakes from product leadership. Those are distractions, in that they often lead to speculative discussions that can make stakeholders revert to defensive positions. I would rather focus on functionality - pretty much every action a user takes on fb has potential privacy consequences, so we should be asking:
* How obvious are those during the action flow? (pretty much not at all - and clearly the culprit here)
* When building features, at what point and in what detail are the privacy consequences analyzed? (currently unknown but the impression continues to be that some privacy issues are intentionally reactively)
Aside: my personal experience with facebook employees is one of tremendous socio-economic homogeneity. I do wonder if the culture their building internally is qualified to handle the real diversity of 1B+ people. (If someone were to quote Danah Boyd's subaltern vs. hegemon model of social network interaction here, I would begrudgingly not cringe, just this once).
Pretty depressing story, both Facebook and the group owner have their own faults here.
In this case I don't know why the group owner didn't think it was more appropriate to ask people "Hey, want to join our facebook group?", not to sign them up in bulk, given that it's obviously a touchy subject for some people.
That may have been exactly what the group owner thought they were doing. I'm not sure when Facebook switched over to "Add People to Group" instead of "Invite People to Group," but I vaguely recall that Facebook groups used to do the latter, which is a behavior that, at least to me, makes a lot more sense.
How is this different from Mr. Acosta tweeting "Welcome Ms. Duncan to the Queer Chorus!"? Sure, it was explicitly messaged to the father... but what if that tweet had gone viral somehow, or otherwise found its way to the father?
Facebook is clearly wrong for making it unclear that group membership was publicly available information, that it is in essence a tweet of that information. But is it wrong for understating the fact that publicly available information can be publicly distributed to interested parties at any time? People need to know that this is the direction in which Facebook (and the Internet) is moving, and that they should just assume that anything they publicly post will be distributed to interested parties (of which the father surely counts). Sure, a lot of the blame falls on Facebook, but not all of it - if you don't want to be outed, tell your friends to make sure that anything they post about you is explicitly marked as a private share (which group membership is not).
Because you do not have a choice about being added to groups. The article talks about facebooks privacy settings but those are essentially fine. What's not is their completely fucked up group system.
You can only opt out of groups but everyone / allowed members can add you to it.
Even better, get added to a very active group and wake up to 700 notifications.
I could create a FB group called "Gay hackernews users" and add you to it (provided I have you in my friendlist) and it would be published to your friends. You could leave it afterwards, but first you'd join and it'd be published.
In that case it would just be Mr. Acosta being insensitive/inconsiderate. Twitter is understood to be public. Facebook is (wrongly) believed to be private to some degree.
Facebook has a feature (and apparently there is no way to opt-out), wherein anyone you are friends with can post a tweet-sized message to all your friend walls by creating an appropriately group and adding you to it.
(1) this is basically the same as those email hack/viruses that email a spam link to everyone in your address book.
(2) how is this not already massively abused for spam? it is nearly identical workflow to the email use case: Gain control of an account, create a group, send message to all the vector's contacts.
It's not going to post to your friends walls. If a friend of yours adds you to a group, it will appear on your wall (and so also on the news feeds of anyone who hasn't chosen to not see your activity) that "John Doe was added to XXX group" or similar. (I don't want to spam a friend by testing the functionality myself, but I'm certain that there's no way you can trigger a post on friends of friends walls)
The issue is that if you (as the LGBT youth) have your father as a friend, they can view your wall and will probably see that activity appear in their newsfeed.
In fact, facebook does have two different methods of reducing what someone can see. Either placing a contact in the "acquaintances" category and then only allowing "friends except acquaintances" to view posts on your wall, or manually adding an individual to the "restricted" list, which quietly blocks them from seeing anything you haven't explicitly made public would work.
If you have something that needs to be private don't put it on a web site. And certainly don't put it on a web site that is designed for sharing things with the people you are connected to.
They did not do that. What happened is it appears a friend who did know added them to a group and before they connected to joining that showed up on their feed. They did nothing. They were passive, and they were still outed because facebook didn't ask for permission and broadcast that they had been added by a third party to a group to their wall.
I did read it and I was making (poorly) a different point: the problem here is that you see the solution as technical ("Facebook should have better privacy controls") whereas I see the solution as personal ("Do not use Facebook"). I do not believe that it will be feasible for Facebook to both add functionality over time and preserve privacy and so the only solution is not to use Facebook at all.
"There are a lot of people who are essentially forced to be on Facebook due to social obligations."
While I don't agree with John in this case (which is unusual), nobody is forced to be on Facebook. You have the option to choose between privacy and social pressure. Many of us have chosen to not create an account and haven't suffered in the least because of it.
All the examples in this thread of reasons you're "forced" to be on the site amount to missing parties and not seeing pictures -- and it's a really vapid argument. It might suck to not see those pictures, but there's nobody forcing you to do so. It's still entirely up to you.
To clarify, I am not victim blaming. This argument is addressing the claim that a Facebook account is a requirement of youth. It is not. Choosing privacy over pleasure might be an unattractive option for some but it's an option all the same.
> But social events are not mandatory was what I was after.
Again, it depends on what quality of life you can live with, and how you're able to achieve that quality of life. Most people would be in serious emotional pain if forced to live as hermits, which is what happens to you after you alienate enough of your friends. Depending on your circumstances, Facebook (and the leaving of it) could play a large role in that.
If somebody is really to that level of social dependency then it's a choice between being a depressed hermit and having privacy. It's still a choice. Just because one option is more obvious for some people doesn't mean the choice disappears.
> You have the option to choose between privacy and social pressure.
Well, that depends on the nature of the pressure, now doesn't it? Most people can't go through life without their support network, and by 'can't' I mean can not. If being part of your network means friending them on Facebook to avoid alienating them, then that's what people have to do, isn't it?
Facebook isn't a human right or requirement. "Need" is too strong a word, you need food, water, oxygen, sleep... you "want" Facebook.
Facebook offers a service, use it or don't. It has settings, set them and if it still doesn't work for you then don't use it. Noone is "forced" to use Facebook, "forced to..." is not equivalent to "it would be really nice to...".
It all depends on what the "Or else" is, doesn't it? If it is just parties, then that's one thing. If it's being ostracized from your peers and family, that's a steep price. People have done terrible things to avoid ostracism like that.
Let's recommend people don't use a site which does not recognise the concept of privacy, expands the realm of the public versus the private at every opportunity, and spams their friends about their activities without their permission. People (not just LGBT people) should avoid FB entirely unless they want to be exposed to embarrassing situations like this, as FB continually tries to erode their privacy.
Using a public site like Twitter or Blogger is far healthier, as then it is clear that all content is public all the time.
One thing's for sure: it will be a lot more "feasible" if Facebook actually tries. Right now, they are manifestly not trying, or rather, trying to do the opposite.
I believe that throwing in the towel is appropriate because in the early 1990s I was deeply involved in research into the mathematical foundations of computer security (that's what my doctorate is in) and there was a paper written by a guy called Jeremy Jacob(1) that proved that security and functionality are at odds with each other. Thus my basis for my belief that as Facebook adds functionality security will worsen is the underlying theory.
You may not think of security in this context (calling it privacy) but it's all about the same fundamental thing: the control of information flow. In the privacy context it's information flow about people. Jacob's theorem shows that Facebook's privacy will worsen over time as new functionality is added.
> that proved that security and functionality are at odds with each other. Thus my basis for my belief that as Facebook adds functionality security will worsen is the underlying theory
You are making a huge assumption that Facebook is as secure as it can be at its level of functionality. It is easy to see that they could add a tiny bit of functionality that barely hurts security and fix the "add any of your friends to groups" bug that their security and functionality would increase.
I haven't read the article in full yet. So far it appears that the theorem is explicitly about "preventing unauthorized modification of data." Here we're talking about unauthorized read access, not write access. Can you comment on that?
Just because you say it does not make it true. Social considerations are some of the most powerful forces. People considered me "weird" because I wasn't on Facebook for a long time. Eventually I re activated my account, because I was tired of explaining to people why I wasn't on, and because I was missing out on photos and experiences and events that were only shared on Facebook.
I agree that you can sometimes seem cool by seeming aloof to what everyone else is doing, but when it damages your social life, most people aren't going to do it.
In the context of what actually happened in the article (did you read it?), your advice amounts to "If there is anything about you that needs to be private, don't have an online presence."
You don't have to give up all forms of online presence to maintain your privacy. You just have to avoid being on a site where information about you can be leaked without your consent. For example, writing a blog doesn't open you up to the kind of privacy breach described in the article. Neither does posting on Hacker News, for that matter.
I second that, and think a fairly obvious extension to it should be "... and DEFINITELY don't put it on Facebook."
At this stage, I think it should be a given that anything you put on Facebook (and perhaps any other web service) will eventually end up public to the world.
Please read the article. They didn't do anything. Someone else added them to a group called Queer Choir. They were not prompted to join. Then it was added to all their friends' timelines that they were now in this group, including parents. At no time, did the student do anything. In fact, they had privacy controls setup to not show have updates posted to their parents timeline be default.
For what it's worth, my response wasn't to the article, but to the GP from jgrahamc.
I acknowledge that the event in question wasn't a result of something the users in question did -- but that illustrates my point all the more that Facebook should be avoided.
Somewhat more ontopic, I'm a little hesitant to accede that someone adding you to a group makes you a member of that group in spirit. Sure, perhaps it convinces some folks that it's true, but so what? If somebody adds me to an open group entitled "People who hate women", I think it's easy enough for me to say "I didn't join this group, and I don't hate women. If I happened to actually hate women, I could see that being slightly more touchy, but whether or not anyone joins me to said group doesn't do anything to stop someone from simply accusing me of hating women, which is the same net effect (I believe).
I'm sympathetic to those affected, but am generally unforgiving of anyone surprised that Facebook screwed something up.
You might see a change if one of Zuck's friends adds him to the "I LIKE SMASHING KITTENS" group. And another adds him to the "Fuck you, I'm rich." group.
And what would that achieve in that case? Nothing!
Just as not being on Facebook achieves nothing — you'll just be completely defenseless if someone tags you in an image (which is horrifying — as far as I'm concerned, the only acceptable solution is to allow only tagging of actual users, and only the ones who consented to that).
