Facebook: Nice iOS app of ours you have there, would be a shame if you had to pay for it The number of Facebook and Instagram users on iOS agreeing to be tracked by the social networking behemoth for targeted ads has fallen drastically in the week since Apple's iOS 14.5 debuted – and Zuck & Co have hit back. The App Tracking Transparency framework in iOS 14.5 requires companies to ask permission to observe the …
Exactly. None of the FB using folks I talk to (not via FB) would be willing to pay for FB access. Most would, in fact, drop FB like a radioactive lump of shite.
Go ahead Zuck, try & charge your users for access. I'll be standing on high ground to watch the ocean of blood your bottom line spurts out in its death throws.
Not so sure. People love their fb sadly, which is why states have a hard time recovering taxes: the main means of leverage they could use (ban fb it in the country till it complies) is out if reach. So my hunch is that users are hooked enough thst a good proportion would be ready to pay.
Then they'd be customers of course, which fb doesn't want. The customer is king. Supposedly.
Don't forget, they could still hit paid users with ads, and still track them as people outside the phone app on IOS. Making them pay, while still serving them ads, and still tracking them though every post about them, every photo that is tagged, and every non-apple device in earshot. How's that sound?
You think a checkbox on a iPhone gets you off the hook? Not in this town. All it takes is the dumbest person you know hitting yes and they get enough data about you to target you, track you, and monetize you.
To charge only on iOS would violate the App Store rules which say you can’t charge less on other platforms for the same digital services. If they tried, Apple would simply kick them out the store and third party clients (sans-tracking and maybe even sans-ads) would pop up to replace it. They are over a barrel and they know it.
Also, as I keep mentioning... IPv6 will herald the direct communication revolution and the rise of peer-to-peer messaging will happen once again, this time with glorious rich formatting, GIFs and audio/video calls to boot. It really is only a matter of time until a decentralised WebRTC-equivalent steps up and replaces all the siloed tools we use today. Back when we all had (garbage) USB modems powering our glorious 1Mb broadbands, we all used NATless direct communications... letting us share and share alike without any barriers; bringing music and movie industries to their knees. We’re all about to go completely NATless once again and maybe this time we can Zuck the life out of these tired old social networks.
Even were none of the above to come to fruition, folks have plenty of superior ad-free options for socialising like Discord, Teams and Slack. It is painfully obvious that Facebook needs a scapegoat for their impending doom. Maybe a frivolous lolsuit or two so that investors don’t all pull out at once?
If you don't have NAT, you have a firewall doing what it does anyway. Opening ports to anyone who asks is risky if you don't understand the risks, and unfortunately there are many who don't understand the risks. The benefit of NAT is that it makes the process of opening a port harder, meaning more people will check whether they want to, but that's not very important. The real security benefit of NAT is aggregating data from a network into a single outbound IP address meaning that tracking individual devices by IP doesn't work as well. For that reason alone, I will continue to use NAT on my IPV6 network for all the devices which don't offer public services.
This is all well and good BUT...
If you are connecting over WiFi AND your WiFi network is not IPv6 compatible then this feature is a total waste of time.
It will be years and years and years before the piece of crap routers that ISP's use will be IPv6 enabled.
That sorta defeats the whole thing, doesn't it?
Hmm. The device I rent from AT&T does IPv6, and has for years. Comcast around here also rent devices that do IPv6. Users can get rid of the Comcast devices for their own, Comcast doesn’t like it but can’t stop it. Unfortunately I can’t do that with AT&T, due to the way that tv, phone, and internet are managed by the AT&T device.
Should I be silly enough, I could even set up a local, in house, network using IPv6 instead of the 192.168.x.y IPv4 net the device uses by default.
This is a good feature, but there are two problems with it. First, networks can be configured to reject it and supply the dangerous address which embeds the MAC address. Most users won't have a clue how to check for it--for that matter, most users won't have a clue what it is. Second, even if you are using a temporary address, it usually changes every day or so, which is long enough to correlate information if servers are tenacious enough. Also, you need only one session to persist across days for the new address to be linked to the old one. The privacy extensions are very needed, and if used they help solve the largest problem, but they're not perfect.
"One day of one IP is worse then all of your devices using one single IP for the duration of your DHCP lease how, exactly?"
In IPV4, all my devices use the same address so my network can be tracked. This is annoying, but there's little I can do about that. In IPV6, my network will assign addresses in the subnet allocated to me, so the same system can still track my network by looking at that prefix. My network is trackable either way. However, with individual addresses allocated to devices, the tracking can also track those devices. In addition to knowing they came from my network, they can also know what else they've done that day. It also lets them correlate a fingerprint on one activity to all activity from that device.
For example, with NAT if they fingerprint a browser running on one of my devices, they won't be able to identify traffic from another program on the same device. For all they know, that program is running on a different device in the same network. With individual addresses, they know exactly which device used it, and they can use that fingerprint to identify devices when the addresses change assuming they have a method which persists across days.
"For that reason alone, I will continue to use NAT on my IPV6 network for all the devices which don't offer public services."
If you have a /64 (nearly useless) prefix then use NAT with ULA to enable multi VLAN usage. Otherwise that sounds horrible.
If you are capable of spinning up IPv6 and NAT then you really should be able to manage an edge firewall and ideally host based firewalls. The Windows one works out of the box if you don't turn it off. Linux has plenty of them (GUIs) - firewalld is my current go to. Apples probably do it out of the box and just work - no idea 8)
"Have a +1 for realizing that NAT is an obstacle that needs to die and not some fake security shield that people mistake it for."
Have a downvote for not understanding that many of us don't want "blackbox" devices on our network that anyone can trivially access from anywhere. NAT pretty much prevents that. Inelegant? Perhaps. But setting up and properly maintaining a firewall is a complex task that I and many others would prefer to avoid.
How about you run your network your way (assuming that you have the ability to do so) and let us run ours our way?
"Have a +1 for realizing that NAT is an obstacle that needs to die and not some fake security shield that people mistake it for."
Have a downvote for not understanding that many of us don't want "blackbox" devices on our network that anyone can trivially access from anywhere. NAT pretty much prevents that. Inelegant? Perhaps. But setting up and properly maintaining a firewall is a complex task that I and many others would prefer to avoid.
I'm confused here? For years consumer routers came with uPNP enabled, which basically bypassed NAT. Why would you assume an IP 6 router would be more or less secure by default?
If by default it blocks incoming traffic and (statefully) passses outbound traffic then that's pretty much what a NATing IP4 router will do now by default.
Properly maintaining a firewall may be a complex task, but I'm not sure the suggested alternative of 'just trusting that box they give you' is any better.
Personally I'll take that over the mess that is NAT at the moment. (Just think how much faster the net will be when there's not a million and one devices between you rewriting packets). It should save a few watts here and there too.
Nobody ever told you how or how not to run your network. If you want run DECnet or AppleTalk, then Bob’s your Uncle! I’m just trying to defeat the FUD surrounding IPv6 and NAT.
1) My machines behind a /48 are no less secure than my machines behind a /28, and didn’t require any configuration to do it. The default deny any inbound that the stateless firewall that your NAT router is doing works just as well without the NAT.
2) Most consumer devices ship with UPnP enabled, which means any piece of software can punch holes into your NAT like Swiss cheese without your approval.
3) Disable the UPnP and have fun with manually pinholing just to play online games on your console.
4) NAT breaks the Internet badly. All kinds of nasty workarounds like STUN are required for RTP and SIP sessions. So much “cloud” stuff is only required because of NAT issues!
5) The only networks that force stateful addressing and disable privacy addresses are corporate networks. On those you have much bigger issues to worry about privacy wise!
6) It’s a lot easier for Google to track your one NAT’d IP for weeks (your DHCP lease time) than it is for them to track 2^64 of privacy IPv6 addresses daily!
"Also, as I keep mentioning... IPv6 will herald the direct communication revolution and the rise of peer-to-peer messaging will happen once again"
I doubt it. P2P is useful in a variety of cases, but most of those cases are already covered just fine by existing systems. It will do little for Facebook. P2P communication is great only when you want communication between two devices who already know how to find one another. Deviate from that path and you'll have difficulty proportional to the distance from it. Here are some examples:
Videocalls between two people over 2P work very well. The only issue is finding one another, but the users can figure that out if they want. A videocall among ten people doesn't work so well. Under the current system with a centralized server, each user only needs to maintain one bidirectional connection, with the server either constructing the feed for each or at least aggregating the encrypted feeds if it's a secure one. With ten on a group P2P call, each person would have to maintain connections to nine other systems, meaning a lot more bandwidth is needed.
Now what happens when devices don't know how to find one another? Why do we use centralized communication systems now? It's not because we couldn't send P2P messages. A lot of the time, it's because our devices don't work as well for it as they did in 2003. In 2003, the computer was a desktop and could be left on to receive messages and keep up a connection. In 2021, we have devices which move a lot and have inconsistent access to the network. If I am using a laptop on the go, the address will change frequently and I'll be offline for long periods. A centralized server can find me when I come back online and can store my messages in the meantime. A P2P system can do neither. The solution to this problem is usually a central server which stores only usernames and current addresses, which helps with the first problem but does nothing for the second.
How about Facebook? Yes, some people use Facebook to send direct messages. Most people, however, use Facebook to publish information to anyone who wants to read it. P2P is completely useless in this regard unless you're going to host your own website (they won't). If you want to send a picture to any friends who read your feed, you need to host them somewhere. This is no longer simple communication. It's publishing and it requires the infrastructure of publishing. I therefore think that IPV6 will do nothing to weaken Facebook's business model. As much as I would like that to happen, it won't work.
With ten on a group P2P call, each person would have to maintain connections to nine other systems, meaning a lot more bandwidth is needed.
The one with the best bandwidth is chosen as the lead server and the rest of the participants each maintain one connection with the lead.
"The one with the best bandwidth is chosen as the lead server ..."
Upvoted. Not because I strongly agree. But because your downvoters appear to be the usual inarticulate clods who won't/can't lay out their probably nonsensical/self-serving objections for the rest of us to evaluate.
You aren't owed an explanation for why a stupid idea is stupid from random people on the internet.
It's literally how pre-MS Skype worked (search for the section on conferencing) unless all calling participants were behind a NAT and firewall in which case a supernode (a high bandwidth server not behind a NAT/firewall) was chosen instead. Presumably this will not be so necessary with IPv6.
But anyway, downvote away, peanut gallery.
"The one with the best bandwidth is chosen as the lead server and the rest of the participants each maintain one connection with the lead."
This is a lot like the original situation. It solves some of the problems encountered at first in the situation, but can still be insufficient. For a small group of people, with a participant who has a reasonable connection, it works. If all participants have poor connections, then there won't be someone with enough bandwidth to make this function. If everyone has a high latency, then using this model will increase everyone's latency significantly. If the group gets large enough, then the processing power needed to aggregate all the feeds will likely not be available using the machine of the person with the best network.
Once again, the idea isn't bad. If you want to have a videocall among five people with reasonable network, then this method will work well enough subject to the other problems I listed earlier. However, it doesn't scale very well so it will encounter problems if you ask for too much from it.
Great plan. Now I have to know where your desktop is, how to send requests to it, get your mobile's address, then send my message, then find that the address is old because you went offline, run a loop to check your desktop until you send another one, not get one because your mobile came online and still has the same address, but I didn't send another message because I thought you were still offline. That's the situation with the fewest things breaking. If your desktop goes down, your mobile is cut off as well. If your desktop is attacked, your mobile's communications can be redirected. And perhaps most importantly, there are very few people who are willing to go to the effort of bouncing requests for direction to communicate with you routinely. If we're evading a sophisticated adversary and we need to hide our communications, let's do that. If I'm checking if you want to get together for lunch, I'm not doing all of that when perfectly functional alternatives are available where I just need to know your email address or phone number.
Me too. But now, if they did introduce a subscription option free of ads and tracking, then my response would be "seriously ? you expect me to trust you with that now ?"
Sadly, I can see the potential benefits of such systems - SWMBO uses it a lot and there's some interesting local history stuff (for example) posted on it. But given Faecesborg's track record, I'd never trust them now - they've comprehensively proved beyond all doubt that they are a bunch of lying (data) thieves.
Me too. But now, if they did introduce a subscription option free of ads and tracking, then my response would be "seriously ? you expect me to trust you with that now ?"
The problem with that is that it divides up the market in an undesirable manner. After all it is the people who are willing to pay who are the most desirable to the advertisers. There is generally no point advertising to freeloaders who refuse to pay for anything.
Maybe, maybe not.
But at the moment the advertisers only gets to advertise to the freeloaders - the ones who would join if and only if there were a paid option without the badness aren't there anyway.
I suspect the ral reason (or at least one of them) is that if Faecesborg did offer such an option, then there's the risk that their product (i.e. the users) might realise how badly they are being data mined when they meet up with a paying user and see the differences.
Here in the US some providers and phone makers have been reported as preinstalling the Facebook app on their Android phones, with no provision for uninstalling it. The app/apps can be disabled. Users reported that even without logging in to the app - or even having a Facebook account - the phone was still transmitting data to Facebook.
I wonder if that is still the state of affairs on the Android side?
That was the case with an HTC phone. The FB app could not be uninstalled without rooting the phone. If you disabled it, something in the background would wake it up again and start draining the battery like there was no tomorrow. I rooted the phone, got rid of FB and the battery life went from 8hrs to 3 days. Go figure.
I then moved to an LG phone. Same problem. That was it with Android for me. I moved to an iPhone 4S and I was free of Faecalbook at least.
I hope that Zuck starts charging for FB and everything else he runs. Watch the users head for the exits at a great rate of knots.
Zuck's 'Hotel California' can't last forever. Even tomorrow is too long.
If tracking and targetted advertising is so wonderful, why do I get the most stupidly irrelevant crap shot at me all the time? Someone must be stupid enough to believe that I could want things that are no earthly use for a mid-seventies male, but their employer must be even more brain-dead to believe they are good at their job.
I spend most of my moving-time walking a dog along boundary lanes adjacent to fields, the shopping opportunities there are 'limited'. I cannot believe anyone would try web shopping while dog walking, maybe they do. Otherwise, I am at home, where mobile access is rubbish, so the mobile is unused. In any case, using the mobile for anything other than logging my walking activity or receiving a very rare text message, is an exercise in rank frustration. Advertising makes it useless - and it lacks a 24" screen.
Why does anyone use Facebook, or any other such site? I may be slightly mad, but not mad enough to photograph cups of coffee or sandwiches and post the results.
It is not.
I've bought a car 1.5 years ago, had to provide an e-mail address and soon afterward got several messages from the dealer offering me a brand new car. I've complained and they mumbled something about "being automatic" and "from the marketing branch of the dealership".
I've also bought a new fridge online. Guess which type of advertisements from the seller I am getting? Fridges. Because if I got one I must love them and could buy another. If they were really smart they would advertise beer ("Do your new fridge feels empty inside? Fill it with beer!")
Targeted advertising is a fraudulent concept. There is no context on why one searched for or bought something. Was it curiosity? Was it a need? Need a new car? For a kid? I think normal people get the idea. Also, many purchases are essentially one-off. The new car, idiot box, etc. will last several years if over a decade. When the ad for a car for example would be effective is before you purchase; something the is very difficult to tease out.
"Targeted advertising is a fraudulent concept."
Not entirely. If, for example, I'm searching the Internet for lawnmower parts, it's probably reasonable to assume that I likely have a lawn and might be more interested in lawn products than someone picked at random. I don't much mind advertising related to my current activities as long as it isn't too intrusive, doesn't use too much bandwidth, and doesn't use scripting. Fair exchange for providing me with a decent search engine I think.
But the user profiling practiced on the modern internet is bizarre to the point of being ludicrous. I don't care if it's profitable. It's still inexcusable.
Past time to shut it down. My suggestion is to tax retained data on users beyond that necessary to support account activities. --- and make the tax substantial -- and tax it at the same rate in every country where the company does business.
The point is context of the search. In some cases the context is much easier to infer but other cases it is not as easy. Spare parts are pretty easy. It is more than likely you are searching for parts for either a repair shop or yourself. But a search for a computer or lawn mower, not so much. Who was the purchase for is part of the context. One might be buying a lawn mower as a gift for someone outside the household. Also, the timeline of the purchase, if any, is important. Is the purchase planned for the future or is it more immediate.
Because there are more adverts for X than there are people who want to buy X. Consequently many people who do not want X will see an ad for it.
Also, marketing departments are insane/stupid/drank the ad industry kool-aid.
Where I've worked with marketing there has always been a constant battle between data driven analysts targeting better and sales/marketing execs wanting 'more volume' in their campaigns. The move from direct mail has massively reduced the cost per contact and changed that dynamic in favour of higher volumes.
Privacy should be the default on a device. It doesn't stop companies selling advertising to people with privacy but it does mean that the likes of Google, Facebook et al can't track people across sites and monitor their browsing in order to deliver targeted advertising.
Now, that said I'm sure Apple aren't doing it for 100% altruistic reasons because Facebook & Google are their competitors and this hurts them, but it's still a good thing.
Telling me where I can buy more of something I've just bought? Nope.
Telling me about suppliers I have used? Nope.
Telling me about stuff I have already looked like and decided not to buy? Nope.
Telling me about stuff a bit like any of the above but not actually like any of them at all? Nope.
Telling me what other people bought after buying what I just looked at? Nope.
Telling me whats "Trending"? Nope
Telling me that People in (close geographical location) are going mad for (dumb item or product that is so shit it can't sell on its own merit)? Nope.
It goes on and on.
Personalised ads are an utter irrelevance. I repeat: an utter irrelevance.
Dear Zuck
Piss off and die.
Yours with extreme prejudice.
"Personalised ads are an utter irrelevance."
Shouldn't that read...
"Ads are an utter irrelevance."
To be fair, I have had one thing in the last few years for which an advert has been helpful - but that is so striking that I can remember it! And there is nothing I am aware of that would have generated that particular advert (it wasn't targeted at me either, but someone I know well).
At least adverts which are targeted to content rather than the user are usually vaguely relevant (in that they are rarely completely stupid).
"Nor is it illegal to ask a user to pay for a service if they opt-out of the sharing of their personal information."
Hmmmm. I seem to recall that if it was provided "free" (by sharing your intimate secrets) it should be free of you told them to f-off. But maybe that's wishful thinking.
AFAIK, it is the case for websites at least.
Now imagine a future where Putin's opponent in the next election doesn't end up in a prison's hospital, and actually survives long enough to get elected. Yes, yes, I know. That's a bit of a fairy tale story, but you never know. It just might happen. And in the same way that an avalanche of previously secret documents came to light after the fall of the Berlin wall, we might get to see the damning evidence of how facebook sold several nation's elections to the highest bidder.
Me thinks the future of facebook lies not on the events at Cupertino, but the revelations that might come from an honest election in Russia.
I suggest investors start linking facebook's valuation with Putin's shelf-life.
Facebook is getting a taste of it's own medicine here.
They've been playing fast and loose with their own advertising systems for years, shafting small businesses in the process. Their latest changes plus the pandemic has caused many such businesses to fail.
So cry me a river Zuck.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
