[rictic]

We briefly added these measures, but after thinking it over we've decided to disable them.

From a technical standpoint they're a fig leaf. This isn't a complex server-side app, it's a minimal UI on top of the JSON results Facebook returns for these searches: http://graph.facebook.com/search?q=control+urges&type=po... . This is frankly the least scary use of this data. For example, it would be trivial to start crawling this data and building your own indices to enable far more invasive searches.

Our goal is to draw attention to this so that people become outraged and Facebook changes their privacy settings. The security community has been having this conversation for a while (more info: http://en.wikipedia.org/wiki/Full_disclosure ) and the only reason not to disclose a security or privacy problem is to give the company involved time and resources to fix the system.

This is not the case here. Facebook made this privacy-affecting change quite deliberately, and I think it's clear that they did so with full knowledge of the implications. If there is not an outcry, this will not be fixed. Right now, from Facebook's perspective, the system is working as intended. The longer it stays this way the worse the privacy breach becomes.

[tokenadult]

Our goal is to draw attention to this so that people become outraged and Facebook changes their privacy settings.

Your link to your project is the most fascinating thread I have seen on HN since the thread about how HN was hacked, one of the all-time top karma submissions. But, amazingly, after playing around with your tool for about half the three hours that have elapsed since you posted it, I'm LESS worried about Facebook than I was before. Pretty much since I joined Facebook I have been posting links (including yours today) to my profile about Facebook privacy. Among my circle of Facebook friends, it is cool to have carefully considered privacy settings, and to be circumspect in what to post online. I have good conversations about interesting links on my profile and on my feed (much like HN), and didn't turn up ANYTHING by searching on my own name, my son's name, keywords strongly associated with my friends' interests, or anything else likely to turn up something we wrote out of turn. Now I'm actually beginning to trust Facebook privacy settings again--at least for smart users--after using your tool and the new Give Me My Data app

http://givememydata.com/

to see what can be seen about me on Facebook.

Great work to make such an interesting tool. And, yes, putting the "rectal surgery" example on your webpage is funny and gets the point across very well.

[hamstersoup]

Here's an example of the fig leaf in action: http://willmoffat.github.com/FacebookSearch/?q=HIV%20test&#3...

We decided the redactions reduce the impact without actually offering any privacy at all. (That's up to Facebook and the users).

[aristoxenus]

"Full disclosure" is a discussion about the ethics of publishing an exploit. Publishing exploits is customarily done in a descriptive manner -- I've never seen it done by publicly sharing the spoils of using that exploit.

Did you try publicizing it without the full identifying data available and measuring the response? Did you consider a strategy of escalating outrageousness, instead of going straight for this course of action?

What about automatically contacting the affected users first, and attempt to rouse them to action?

I'm sorry to be so harsh in a public forum, but when someone takes it upon himself to say that the affected lives are going to suffer for a good cause, then he'd better accompany the resulting campaign with a very thorough -- and thoroughly-vetted -- piece of argument explaining exactly why the ethical balance is in his favor. Two guys deciding they'd get more pageviews by going with plan A, and leaving the moral debate for blog commenters after the fact is not a thorough vetting.

There were already numerous forces at play which could potentially result in FB getting things straight. Your app won't have accomplished anything that wouldn't otherwise have been accomplished, except perhaps to cause a few more people to suffer.

[rmc]

> What about automatically contacting the affected users first, and attempt to rouse them to action?

You mean contacting 98% of facebook's users?!?