I think the only reason this hasn't become a monster shitstorm is because the vast majority of users don't realise how their page looks to people who aren't their friends, and don't yet know how exposed they are.
It's also hard to spot the changes to profile picture settings unless you notice that in search results you can now click on the profile picture: the page otherwise looks identical to how it did before, when you couldn't.
I was bitten by this, and consider myself fairly savvy. I carefully read the entire new settings roadblock, and made sure all of my old settings were kept. Nonetheless, a day or two later I double-checked, and after drilling down four levels, discovered that all of my profile pictures were set to "friends of friends", which is massively too loose.
Facebook wants to open up, but has it forgotten that it only became the size it did because it was the first place on the web that older and untechnologically savvy people felt they could trust with their personal pictures and data?
They break that trust at their -- and our -- peril. People burnt by the exposure of pictures they thought only a private and vetted list of people could see will be very wary of trusting any of the services some of us are trying to build.
Actually, I believe album privacy was not affected by this change at all.
Go here : http://www.facebook.com/settings/?tab=privacy§ion=pr... - notice there's a separate setting for Photo Albums. That (the album privacy) interface has existed for at least a year. Your profile photos should be an album under there.
Photos /of/ you, where you've been tagged is a separate setting that is called out on that page, which I believe was in the recent privacy changes dialog.
A further confusion is that the current Profile picture is publicly available information, as per the recent changes.
This was definitely poorly communicated in the changes dialog; hopefully these things will get better in further iterations.
You can click on the 'Preview as' button to see your profile as it will appear to another user.
Well, we've got a facebook clone here (vk.com) where the profile is open by default and the growth rate is not worse than of the Facebook. (Taking into account the language of the network).
So I think that the growth of the Facebook has nothing to do with the privacy settings.
I don't get it. (caveat/disclaimer, I work at Facebook, and this is entirely and completely my opinion only. I did not work on the privacy settings project).
The process was as far as I can tell, _completely_ upfront. No dishonest changes were made. There has been considerable prior notice, huge amounts of press; the interface forced you to look at it and make your own choice, every reasonable privacy setting was made possible.
The default selection was based on users' previous settings where things mapped cleanly, and where they didn't/where it made sense, the recommendation the site made was to make more things public- because Facebook believes that's the best way to provide utility to the user. Which isn't outrageous- there are obvious features that would be bettered and enabled by having more sharing in the system.
Why is it deceitful/duping users then? Are you claiming that every software/website that shows you a EULA is cheating you into using the service?
This whole argument is based on the prejudice that (a) Facebook is out to be dishonest with their sharing practices (b) users are dumb (c) the best way to use the internet is to batten down the hatches and live in a bunker. I disagree with all of these.
The process was misleading. The default selection was based on users' previous settings only if they had changed them in the past, and as Facebook has pointed out, only 20% of people have done so. That forces the rest of users to make a choice that most neither understand nor want to make.
People see Facebook as a way to privately share their life with friends. That's the foundation on which Facebook was built - that's the core aspect that convinced people to abandon other social networks for FB - and now they are idiotically abandoning that core principal and needlessly exposing their users.
Personally, as a web app developer, I'm confused about the process myself. The privacy dialog seemed to suggest that no matter what my settings are, my name, profile picture, and friends list will be public to all. If I'm being given more choice about my privacy, why is this choice being taken away from me? Until this point, I had the choice of being pretty much invisible from anyone but my friends.
Back when people used Myspace, it was quite open by default as well. The difference is that on Myspace your name could be Donald Duck, your location could be set to Antarctica and nobody cared. You could invent your own privacy controls where they didn't exist. Try doing something that on Facebook and your account will be instantly suspended.
This is not about users being dumb or not. Many intelligent people don't know (or care to know) the intricate details of web apps.
Time will prove you right or wrong, but I believe that people will in general adapt to the way the web changes. I think it's a challenge to educate users so that you can have a featureful app without causing them harm, but I don't think it's impossible. The web populace has grown vastly more informed in just the last five years- why should we decide they won't be able to grasp this extra control?
Facebook is ambitious; it wants to be a lot of things. It wants to continue to be the service where you talk only to your friends, but it also wants to be other things. We believe we can do other things as well as we've done friend-only social networking. That may be a misjudgement, we'll find out.
Re: The other settings that became publicly available- I think it was a call they made, balancing what is good for the network and what is reasonable for the individual on a social networking site. Some of it had to do with what privacy was feasible to enforce (given that you had to have Search on the site, and different levels of indexing etc), and I don't necessarily know all the details here.
The primary goal was to /simplify/ privacy settings, and make it more fine-grained, which they've clearly done.
The other settings that became publicly available- I think it was a call they made, balancing what is good for the network and what is reasonable for the individual on a social networking site.
Who your friends are and what groups you are a member of is potentially consequential information. This was the fatal flaw in Livejournal's privacy system. Sure you could make your journal entries friends-only but your profile - your friends list, your interests, your groups and your profile pictures - were always public. If you were involved in anything that you maybe didn't want your current/future employer/cow-orkers (say) to know about, the ONLY safeguard was to keep your username a secret. Well on Facebook, you're supposed to use your real name...
"People see Facebook as a way to privately share their life with friends."
Fits what people in my family think (I'm not a user). I haven't thought it was a good choice for that, because huge sites tend to attract hacks. If private sharing is the reason most people go there, then I'd think FB would want the UI for privacy to be very transparent (at the "here's what happens when you click this, and here's what non-friends will see" level).
Twitter's UI surprised me. I used the 'public' setting; as their docs described it, I expected @someone messages would be seen only by people following me -and- the recipient. Wrong. When I googled my t-name, all my tweets, including those @ messages, were wide open to the whole net. Whoa!
"best way to provide utility to the user" in aggregate only. For those who want privacy, what existed was just fine. Same as 'obvious features that would be bettered". Twitter defaults to everything-open and we all knew that from day 1. Facebook keeps trying to "increase utility" for me. I don't want that - I just want to share info with my friends. MySpace has maximum utility because any pr0n star can friend you. Do not want.
The article doesn't say EULA's are cheating you, it says that Facebook is destroying the trust users have that most sites will treat your privacy carefully.
Pretty much every feature Facebook adds has encountered this reaction. I think that on average, the subsequent usage and adoption statistics do not support your claim that users don't want increased utility.
It is true that a few things have become less private, but on the whole, the privacy of things on Facebook is easier to control, finer-grained and clearer to people.
My point is not that increased utility is bad, it's that what you consider increased utility is not what I might. Reduced privacy is a reduction in utility to me.
Now, note - I'm a FB app writer. I'm happy I can see more of this info. My own privacy settings are tighter than most, so I don't lose out there either. However, if FB wants to provide utility to users, educate them much more about the implications of each checkbox because most users still don't get why it's important.
Agree - I didn't have all my settings defaulted to _everyone_ - there were a few, but for the most part the "new" settings were the same as the old ones.
What really did piss me off, however, was the re-classification of my profile picture and friends list as publicly-available information. Maybe I'm misreading the policies, but it seems like there's now no way to not share/make available to third-party apps my picture and friends list - which I previously didn't share with any non-friends.
This post describes a checkbox to hide or show the list on your profile page. It goes on to say that regardless of the setting, the friends list is now public information. That means that even if you choose to "hide" it, anyone can hack a URL to insert your facebook ID and see your friends' list. It's a confirmation that privacy regarding friend lists is gone, which is really unfortunate.
My impression is that this change was actually driven by implementation feasibility- for reasons I'm not completely clear on, search indexing and the interface could not unambiguously respect privacy for friend lists (since so much of the indexing depends on what paths are reachable). The choice then, was to upfront about the lack of privacy in this respect, or to just hide it from profile and pretend it was private. Facebook chose the former.
I'm sorry, but there could be no "implementation feasibility"-based justification to make this data public. The same check to determine whether to grant access to a single status update could be used to determine whether to grant access to a friend list.
It's true that someone could figure out a partial list of who you were friends with by spidering the friends lists of others who had chosen to share their list, but that is no justification for removing privacy.
I don't know the actual details here, so I can't really comment.
Re your second point though: I think it's much more important that people understand where they really stand in terms of what is private, even if that isn't everything they'd like- as opposed to discovering later that something they thought was private could be accessed via a workaround.
That's like saying "Well, since it's possible for someone to social engineer the password of my server, I might as well remove the firewall, switch to telnet and chmod everything to 777."
It's important to tell people to know where they really stand in terms of privacy, and then continue to do your best to protect it. The fact is that privacy - like security - is not a binary. It's something that you protect with various overlapping strategies that reduce the risk as much as possible. Few people expect Facebook to provide them with total protection of their data; instead, they expected them to do the best they can. And that's what Facebook has done for the past five years; they went far beyond anyone else in terms of protecting privacy, and even after they were miles ahead of the competition, they continued to improve it. Now they've destroyed all of that progress in the scope of a few days.
It's a question of how difficult the workaround is. In this case, I think it maybe had to do with showing mutual friends in search results- not showing them made the results very difficult to pick through, and showing them was a privacy flaw. This isn't a very effective protection. I believe that the basic idea of protecting privacy as far as possible has not changed, but of course I'm going to say that :)
Yeah, I think it's clear that friend lists are public information (unless that's not what you're getting at). The discussion was whether this should be the case.
"Perhaps I’m being hyperbolic (who me?), or maybe they are a little of both, but the fact remains they screw up on important issues almost as if it’s a 'best practice' to do so."
That's how it is beginning to look to me, like Facebook has INSTINCTS that guide it to make the most sleazy or annoying changes it can.
Those "instincts" are looking like someone's ego dominating over everyone else in the company.
Are they going to turn Facebook into a really big "reverse catalog" company. By that I mean instead of grouping goods into a catalog and sending to one person, you send one good to a lot of people (via Facebook) with the added requirement that the good in question matches with the "preferences" of the Facebook person? Would be interesting to see if that works.
Presumably their previous "blunders" have worked to increase media coverage and thence signups. More blunders then = more users and presumably more revenue.
As a side note, he raises an interesting question that has been floating in my head for a while. Two hundred years ago, politicians were the most educated and informed people around. We could rely on them to make good informed decisions. But with the explosion of information and ever-accelerating development in technology and therefore our every aspect of our lives, it seems politicians are reduced to the common denominator knowledge and understanding and quality of their decisions is less and less sufficient to lead a country.
[citation needed] - seriously though, I'm struggling to believe that politicians used to be any more competent a couple of hunderds of years ago. It's just that the incompetent ones aren't remembered. The United States had it's fair share of incompetent presidents in the 1850s for example.
This is a special case of the "they don't make things like they used to" fallacy. You only see the old stuff that was so exceptionally well-made that it survived.
It could be based off the same argument for why there are less polymaths now, and that's simply because we know too much. Politicians need to know more to achieve the same level of well-roundedness as they did in say, the 1700s.
So politicians in the past were more informed because they had an easier time informing themselves. Those capable of being more well-rounded may have found politics to be a better fit since it was still manageable at that time. But now with more advancements in every specific area, it's harder to be well-rounded and perfectly up-to-date. So politicians nowadays cannot keep up and become more educated on issues because it requires more effort to thoroughly understand diverse topics. Is that what he meant?
My point was that back then it was probably easier to be more generally educated to a useful degree relative to the general population. So the elite would have occupied the political positions while still being able to maintain a useful degree of general knowledgeness (forgive the made up word), whereas now it doesn't matter who goes into politics because he/she will have a hard time because it's so much harder to be knowledgeable about everything to the same useful degree as they did back then.
My original point was that this doesn't need evidence because it can be reasoned out. But I guess that depends if my reasoning is faulty or not.
> My point was that back then it was probably easier to be more generally educated to a useful degree relative to the general population.
That's not the same as "So politicians in the past were more informed because they had an easier time informing themselves." let alone "Those capable of being more well-rounded may have found politics to be a better fit since it was still manageable at that time."
However, they do share common theme - you think that they favored those in political positions or the reverse more than they do now.
> My original point was that this doesn't need evidence because it can be reasoned out.
You're making claims about the relative ease of being a 1700s well informed farrier and 1700s politician and the relative ease of being a w2000s ell informed programmer and 2000s politician. How can those claims be evaluated without evidence?
"So politicians in the past were more informed because they had an easier time informing themselves."
I didn't mean that they were, quantitively speaking, more informed than they are now. I assumed it to be relative to the general population.
"Those capable of being more well-rounded may have found politics to be a better fit since it was still manageable at that time."
This is simply a related hypothesis to the selection of politicians back then based on the postulate that it was easier to be educated to a useful degree relative to the general population.
You're right, they can't be evaluated to an absolute, or even close certainty, without the necessary facts. But you can still come up with a hypothesis sufficiently close through deduction from facts we can both agree on. I was suggesting the latter for my argument.
Anyways I find this argument quite pointless. If you could do me a favor, let's stop discussing it.
> This is simply a related hypothesis to the selection of politicians back then based on the postulate that it was easier to be educated to a useful degree relative to the general population.
Even if it was (and I see no reason to believe that it was or wasn't), it doesn't necessarily follow that politicians then would have availed themselves of it more than they do now.
> Anyways I find this argument quite pointless.
My apologies. I thought that you made those claims because you found them interesting, which surely includes whether or not they're true.
Actually, it might be worse than the article says.
TFA says that it only changes your settings once you click through... but I have been getting new "friend requests" from people I have never heard of this weekend (since the change went into effect), I think because my profile and various other info had already been made public.
Facebook's entire thing (IMO) was that it was a safe and private way to share stuff between friends.
What they've just done violated all of the brand equity I had in them, and I am seriously considering shutting off my account. I have already maxed out the privacy settings.
It's this type of crap that causes a promising idea like Facebook to turn into a has-been in a matter of years because of mass flight of users.
"
TFA says that it only changes your settings once you click through... but I have been getting new "friend requests" from people I have never heard of this weekend (since the change went into effect), I think because my profile and various other info had already been made public.
"
That is highly unlikely, and if so, it's a bug (and you should report it). The code looks up your privacy settings at display time, it doesn't make some sweeping database change.
It's this type of crap that causes a promising idea like Facebook to turn into a has-been in a matter of years because of mass flight of users.
It's this kind of flailing around trying to figure out what kind of business to be that gives another company an opportunity to learn from Facebook's mistakes and then enter the market and seize Facebook's market share. The trick for the next new entrant is to figure out how to monetize less clueless company behavior.
So, my experience was the complete opposite to his. Had Facebook not forced me to view my privacy settings, I probably never would have. The settings they suggested were quite conservative and I definitely didn't feel as if they were trying to trick me into picking any particular privacy preference. At the end of it, I was actually appreciative of them.
How else would you have handled it? I think the way they dealt with it was the most upfront way. They couldn't have been more straightforward. It was in your face, and if you're the one who decided to skip over the privacy options they were making ridiculously accessible, then it's your fault.
Er, not for me. everything was going to be totally public unless i went through and reset them to where I wanted to. And you have to dig in a non-obvious place for photo privacy settings.
Apparently not all users had the same default choices... I don't know what the reason was (A/B testing? trying to get unbiased statistics?), but my girlfriend had all the default choices in the right column (leave the old behaviour), while I got the defaults on the left (new behaviour - "friends of friends" and "everyone").
Same here. It seems pretty straight forward to me. There is a reminder about privacy settings after you're prompted the first time in case you've changed your mind or rushed through it the fist time not fully understanding the implications.
In addition to being somewhat trollish, this article is inaccurate. The change doesn't make everything public -- the settings vary by type of info and also I think it tries to preserve customizations (I'm not completely sure how that aspect works, but different people get different defaults as I understand it). A quick search turned up this screen-shot: http://images.smh.com.au/2009/12/10/960612/420-facebook-priv...
Also, I'm pretty sure his "search" theory is mostly nonsense. From what I can tell, the change is driven by a genuine belief that these settings provide greater utility for users. This has certainly been my experience sharing on FriendFeed (which is more public) vs sharing on Facebook, so I tend to think it's correct.
Indeed. Evidence shows that users understood the changes - 50% of users select something besides the defaults, and Facebook has been open with those numbers. This is after millions of users in countries like Turkey already had effectively public profiles.
An average user, certainly, has no idea what is going on by these changes.
He ignored the public stats in order to make a point.
Further, this change is important, and there was a lot of work and testing to make sure people understood the results. Jason assumes his intuition about what users understand is more accurate than this research.
In other words, he doesn't know what he's talking about.
50% of users selecting something other than defaults tells me that Facebook did act against the vast majority of it's users wishes and choose default settings that were not appropriate. Considering a substantial percentage would have just clicked through you probably have 2/3 of people NOT wanting the changes they made. How is that ethical?
Calling "suggesting a change and asking users up front to confirm or correct it" unethical strikes me as sensationalistic. The fact that a large percentage of users didn't just click through the thing (i.e. it wasn't some stealth decision forced on users) doesn't make it less ethical - if anything, it makes it more so.
I don't know if unethical is the right word. Maybe "shady" would be better?
If Facebook wanted to stay on the safe side of things, they'd have kept the default as the more private setting and then show some kind of prompt saying "Hey, this is a new Everyone setting. This is what it does. Would you like to try it?"
That stat does not convince me that users actually know what they're doing. Maybe you're privy to more research about this, but I suspect the majority of users who select something besides the default change everything to 'old setting' because they don't know what the hell this stuff is and just want to get back to Farmville.
I seriously doubt most people know what 'Everyone' means. Or what can happen to data that's syndicated to search engines and is no longer in Facebook's control.
I'm currently in the process of reaching out to my friends who don't follow tech news to make sure they know what they've signed up for with the new settings. After explaining the 'Everyone' setting, responses are usually along the lines of "Facebook is turning evil."
I suspected as much, and I don't think there is anything wrong with using facts to defend your employer, but he should follow your example and disclose his affiliation when making comments like the one above.
ivan has been around this community for quite a while- he was one of the people who built tipjoy, and his move to facebook was much discussed. perhaps he assumed people would know.
Also, clicking on his username indicates this clearly (at least now).
I didn't think I was expressing opinions about facebook, just bringing up things that others have brought up.
I probably should have mentioned I work at facebook and all comments are my own - mainly to insulate myself. I just added this to my news.yc profile "[every comment on this site is my own opinion, and not that of current or past employers]"
I think it is silly to suggest as some have that every comment requires a caveat. The comment replied to Paul Buchheit, also at facebook, who made no caveat. My profile is a click away, as is google http://www.google.com/search?q=ivankirigin
People get overly sensitive about this. I don't think my employment changes my original comment at all.
They are a business. Some of their actions might be unethical, but the term "greedy" doesn't really mean anything when you are talking about a business.
If you have, which probably anyone concerned with privacy has, they default to "not everyone" choice.
I had not read about this, signed in last night to get a message from my sister-in-law about Secret Santa arrangements for this year, and got hit with the prompt. It defaulted me to everything being public. I don't know whether I count as "anybody concerned with privacy" or not, but my understanding on Facebook has always been that when you Google for my business you do NOT see how long it has been since I broke up with my girlfriend. The fact that that would have changed if I was not extremely thorough at clicking my way through their roadblock was upsetting to me.
It reset my permissions to default and I didn't click through as most people probably did. I went through my privacy settings afterward and found my application settings reset to allowing any and all applications to see all my data. I had a good number of applications blocked and my blocklist was purged. A few other important settings were reverted from private (me only) to public (everyone). I immediately fixed the permissions and deactivated my account. I am not putting up with this.
> From what I've read, the new updates default to share with "everyone" only if you have NOT modified your privacy settings in the past.
I have set all my privacy settings to very private settings in the past and my defaults are all to share with everyone. So at least for me, this is NOT the case.
If this change stands, the majority of Facebook users affected by it haven't signed up yet, so your first point doesn't have a lot of bearing on whether the move is ethical or not.
I think I understand what they are trying to do, & it is not all that bad. The implementation is just a bit sleazy. For social networks (especially upstart little ones), one of the best traffic sources will probably be your members getting Googled.
If you are active on half a dozen sites & you Google your name, Facebook doesn't tend to do too well.
Apart from that there is also chatter of various sorts that may drive some search engine traffic & perhaps some Twitter-like real time stuff.
It must be frustrating that with all the long tail relevance of the site, they are letting all this traffic go by.
I'm not convinced that it was the "Golden Child" who instigated the change, and that the "adult supervision" failed to stand up and object. My impression of dotcom execs is they're generally more rapacious, unethical and greedy than any founder.
Traffic per user is decreasing that is why you are seeing moves like this to boost traffic. Their business model relies on traffic per user going up not down. They will continue to do immoral things like this until they go all out and change the terms of service and sell all your data to advertisers.
I went through the same process as Calacanis and most of my content had been automatically set to Friends Only. Maybe it's Calacanis who's unlucky... or clueless, or et cetera.
Most, but not all. When I went through, there was only one option up at the top that was not set to "Friends Only". No big deal, right? Just one thing out of 10 or so?
Except that one thing included all my status updates, links, and pictures. I switched it off because I'd heard all the hoopla and knew to read carefully.
Calacanis is totally correct. Many (most?) people will just see that it's "only one thing" and assume that Facebook picked sensible defaults. I would have, if I hadn't been warned ahead of time.
> Most, but not all. When I went through, there was only one option up at the top that was not set to "Friends Only"
I'm staring at the screen in question right now. I hate Facebook and have set it to not let anybody see anything in the past. NOW THE DEFAULTS FOR ALL THE TOP ITEMS ARE SET TO SHARE WITH EVERYONE. ie. Family and Relationships, Work and Education, Posts I Create (includes photos, etc.) and About Me are all set to share with everyone.
Looks like Facebook is either doing A/B testing or intentionally sending conservative settings to a small percentage of users to confuse discussions of this issue.
Facebook is trying to dupe hundreds of millions of users they’ve spent
years attracting into exposing their data for Facebook’s personal
gain: pageviews. Yes, Facebook is tricking us into exposing all our
items so that those personal items get indexed in search
engines–including Facebook’s–in order to drive more traffic to
Facebook.
I would say that Facebook doesn't really care about attracting traffic through natural SEO. It's not like people are going to sign up because they found a random Facebook profile when searching for something else. There are a lot of obvious benefits to FB if users are more open about its details, but it seems like the author of this article hasn't actually thought about what they actually are. Less politely, he's just a troll.
Facebook has had a couple of innovations in their history, like their
application layer and news feed (which is now gone), but for the past
couple of years they’ve given up on innovation and focused on stealing
ideas from Twitter and out-executing them, while not caring about user
rights.
How many ideas can you steal from Twitter? Focusing more on status updates is about it.
The popup dialog box was fine. It would have been better though to have more of the defaults tuned to more privacy enhancing options.
Facebook is cool, though, and I check my home page a couple of times a week. That said, Facebook is more interesting as an application delivery platform, and their third party developer support seems to be pretty good.
Facebook's address book importer is no better - This is not the first time Facebook has done something like this (as the original email points out. I have been personally duped by facebook's address book importer before and have blogged about my experience here -
Hasn't anyone noticed that many Facebook users will friend everyone and anyone who asks? This suggests to me that they either do not care about privacy much or, more likely, don't use Facebook status updates for intensely private information.
No. The people who friend everybody are not real Facebook users. They are generally older people, already out of college/grad school who are unable to build a true network of acquaintances on Facebook and are just on Facebook to feel as though they are participating in social networking. Twitter is a more suitable option for these people because it doesn't require any genuine social interaction. Real Facebook users have hundreds of photos and thousands of wall posts accumulated throughout the years (of college). For them a Facebook account is actually an online profile of their actual lives. Most will want to keep this private.
And nobody cares about status updates. They're generally just an inane sentence about whatever you're doing. But isn't that all Twitter is? YES! Twitter's entire function is just a minor feature on Facebook. But remember, Twitter's purpose is to allow old people who can't make a real social network to delude themselves into think that they're on the cutting edge of technology.
You see this a lot in the mainstream press, some journo saying "what's the point of competing to see who has the most friends" or "who cares what some random people are up to" whereas in reality, no-one who is what you call a real user even thinks like this.
It is also true however that FB wants to cater to that group as well.
I'm a little unclear - I just logged in today and reverted everything to how it used to be (I think). Were the new settings active before I logged in? I.e., did I have publicly exposed info while I was away?
I’m sorry, what the frack just happened? I turned over my friend list,photos and status updates to everyone in the world? Why on earth would anyone do that with their Facebook page?
There's more than a few accounts of a poor mapping between old and new privacy settings (mine weren't what I'd imagine FB would have picked given I had extremely conservative settings). It seems most folks think there's no problem or that they're evil. I happen to think they just botched it - is that not succinctly conveyed in my comment?
It was mostly a play on the title that I found humorous, since it clearly meant to imply they were one or the other but you could negate both with one word.
But I do truly believe that Facebook is neither too.
"I’m sorry, what the frack just happened? I turned over my friend list, photos and status updates to everyone in the world? Why on earth would anyone do that with their Facebook page?
The entire purpose of Facebook since inception has been to share your information with a small group of people in your private network."
I don't know, maybe it's just me: I've always assumed that anything that I put on the Internet will be known to anyone. I've never turned on any of these privacy settings, and I'm pretty okay with that.
I resent Zuckerberg. He got extremely lucky and is massively overrated. I wouldn't be upset if he were just a millionaire a few hundred times over; who cares about that? But he certainly doesn't deserve to be the most successful member of our generation, and hopefully someone will eclipse him in that regard.
Facebook has some exceptionally good programmers, due to its financial fortune, but the mediocrity of vision and hubris at the helm persist. Facebook has some great technologists, but the leadership couldn't make a good decision to save their lives. Luckily for them; to this point, they've never needed to.
It's also hard to spot the changes to profile picture settings unless you notice that in search results you can now click on the profile picture: the page otherwise looks identical to how it did before, when you couldn't.
I was bitten by this, and consider myself fairly savvy. I carefully read the entire new settings roadblock, and made sure all of my old settings were kept. Nonetheless, a day or two later I double-checked, and after drilling down four levels, discovered that all of my profile pictures were set to "friends of friends", which is massively too loose.
Facebook wants to open up, but has it forgotten that it only became the size it did because it was the first place on the web that older and untechnologically savvy people felt they could trust with their personal pictures and data?
They break that trust at their -- and our -- peril. People burnt by the exposure of pictures they thought only a private and vetted list of people could see will be very wary of trusting any of the services some of us are trying to build.