Everyone who was impacted is getting a notification at the top of their feed. Looks like it isn't showing up for everyone immediately though, I first heard about it two days ago and I just saw it today.
That presumes that users log in and use facebook regularly, and that a users who's data was leaked 3 years ago still has a fecebook account.
That's not how breach notifications are supposed to work - send me an email for crying out loud! I realize they don't classify this as a 'breach', but come on..
Is "duh" really a meaningful statement here? We're discussing this because Facebook is already in "trouble" for scummy tactics. Doesn't "duh, of course they want you to login" sort of accept one of those tactics?
Imo, yes - email should totally be possible, without logging in ideally, if they wanted to truly save face. The fact that they aren't is, of course, a clear indication that they aren't being honest, instead they're primarily concerned with using this as a scummy tactic to get their hooks into your brain again.
So.. no, not duh, imo. If we accept "duh", we start lowering our expectations, in the same way that American politics has as of late. We lose our base position, indicating when we should be outraged/etc.