[mudkip]

This is a topic that I'm intimately familiar with, thanks to a bizarre set of circumstances (and a ton of reverse engineering). Story above, technical details below:

Part 1:

A couple years ago, I noticed that the number of photos I was tagged in kept going up and down, as a couple of people I knew would disable their accounts occasionally, and re-enable them a couple weeks later.

I manually the images from them, but wanted a way to automatically scrape any images I was tagged in, so I wouldn't need to do this manually.

I got myself a Facebook Graph API key and created a sample app with full account permissions, only to discover that Facebook won't let you export photos you're tagged in (that you didn't take). The numbers the API reports are wrong, and there's no indication that it's being purposely redacted.

As a result, I wrote a tool that crawls a profile given a set of authenticated cookies, and essentially clicks the download link automatically on every photo. This worked decently well for a couple years, and continues to work to this day.

Part 2:

I had some spare time on my hands in December 2019, and wanted to write a tool to browse chat logs from across a variety of services (Facebook Chat, Hangouts, SMS), such that you'd be able to click a name and see a chronological discussion, regardless of what service it was on. I downloaded the Facebook data dump, figuring that was the easiest way to get access to my Messenger data.

The Messenger dump revealed a few things that surprised me: * The character encoding is messed up, and requires decoding as Latin1, then re-encoding as UTF-8

* Some messages are straight up missing, despite being in the UI. The dump is supposed to include attachments (images are included), but is missing audio messages / voice snippets, presumably among others.

* If a user has deleted their Facebook account, the username will appear solely as 'Facebook User', so now you need to figure out who you were actually talking to. Some conversations were very obvious, but others involved wasting a ton of time on and involved dumb techniques (like finding Adium logs of the same chat from an old computer).

To identify certain conversations, I started scrolling back through certain Facebook posts (which I wrote), to figure out who had been at certain events with me (to narrow things down). I read a bunch of comment threads that didn't appear to make much sense to me, until I realized that anyone who deletes their account also has their comments removed, so basically all old comment threads are somewhat nonsensical if anyone in the conversation has since deleted their account. For comparison, deleting a reddit account changes the ownership of a comment/post to [deleted], which seems much more appropriate.

Presumably wall posts (including happy birthday messages) from people who have since deleted their accounts are also removed, which is exceedingly shitty - if someone sends you a greeting card and then dies several years later, it's not like the post office comes to your house to take your cards back in the middle of the night.

Part 3:

Because of this, I figured that the only way to mitigate future data loss on Facebook is to consistently archive things. Since the 'download your data' tool is basically useless, I started work on a tool that scrapes the site and "decompiles" pages into raw directed graph DB rows, which can be re-rendered into a new version of the site. It features a reasonably complete implementation of Facebook's TAO (https://www.facebook.com/notes/facebook-engineering/tao-the-...) on top of PostgreSQL, and works decently well - notably, it also maintains things like proper links to profiles and stores all assets offline.

Writing a bug-compatible "decompiler"/"recompiler" taught me several things about how the site works (or rather, doesn't). Here's a small list of errata I've discovered along the way:

* Objects can have multiple FBIDs

* FBIDs can contain comments/reactions

* Since there may exist multiple FBIDs for a given object, it's quite common for multiple comment threads to exist for a given item, such that commenters on one don't see the responses on the other (and vice versa). Several of my friends have confirmed finding disjointed discussions on their posts after discovering this bug.

* Facebook has several types of deprecated reactions that they store in the DB, which cannot traditionally be viewed from the site anymore. Sucks to be you if you reacted to something that way.

* Certain objects can get lost in their UI, with no easy way to find them. Uploading a photo in a post will put it in your Timeline Photos album, but uploading a photo as a comment to someone else's post will basically make it impossible to find again.

* The number of reactions/comments on a given post is often wrong - this isn't the traditional bug due to eventual consistency, but rather is due to not adjusting the counts for items when a person deletes their account. To a certain degree, this will show you how many people that interacted on something have departed the site.

[gravitas]

I'm glad to hear the last section of Part 2 works the way it does. In reverse, if a person deactivates their profile, all comments you made on their posts completely disappear from your controls. If they reactivate, your comments are back.

I used "Social Book Manager" in the chrome store to (painfully, repeatedly) flush out all content from my account down to the last Like. Walk away and your account appears 100% empty until a reactivated friend occurs, then all your stuff linked to their content magically reappears for you to try and delete again. So I sat on it for another year, periodically logging back in to flush out whatever hidden content had reappeared.

Having now (this Jan.) deleted my supposedly "empty" 10yr old account, it's good to know the hidden content is being removed properly, as my intent was to 100% scrub myself from their service and boy did I try.

[mudkip]

When you interact with a piece of content owned by someone else (or transfer ownership of your content to someone else), you shouldn't expect to retain full ownership of your contributions. If I make a post and then delete it, all comments (from everyone) should be deleted because the parent object is now gone. However, if Bob makes a post on Alice's Timeline (e.g. a Happy Birthday message), Bob shouldn't expect to fully control that object anymore - Alice's friends can now fully see that post (regardless of what Bob's privacy settings are set to). In fact, if you look under the hood at Facebook's DB, you'll see that the row that Bob created has ownership transferred to Alice (AUTHORED_BY/AUTHORED <-> Alice), with a secondary pointer to Bob that's used to draw the "Bob > Alice" text.[0] Bob should not be able to delete this anymore because he no longer owns the object. You can argue that Bob should maybe still be able to edit the content (and replace it with something new), and I wouldn't disagree, but Bob should not be able to delete the fact that the row ever existed. Comments on someone else's post by a comment author that deletes their account should be transferred to a [deleted] account, because that maintains the integrity of the discussion for everyone involved - it just drops 'who' wrote a particular line of text. If you want to literally replace all of your comment text with something like '-', I'm not going to argue with that desire (or suggest you shouldn't be able to do it). However, it's insane that the rows themselves disappear, because there's no indicator that anyone else ever participated in that discussion (and thus most old comment threads appear schizophrenic).

[0] One hilarious side effect of replacing the object's ownership is that technically, all of the messages Alice received wishing her "Happy Birthday" appear to be written by herself. You have to find the additional TAO edges to reconstruct the true post author.

[dwild]

> If I make a post and then delete it, all comments (from everyone) should be deleted because the parent object is now gone.

Why does the ownership start at the post level and not the comment? If you consider that comments shouldn't be removable, that the post is now the owner of its child, what about the higher hierarchy. Is the forum category creator is the owner of the post too?

> However, it's insane that the rows themselves disappear, because there's no indicator that anyone else ever participated in that discussion (and thus most old comment threads appear schizophrenic)

If the cost of staying owner of what you post is a few comment threads that "appear schizophrenic", it doesn't seems like an high cost to pay.

[mudkip]

There are some valid points to keeping comments for posts that have since been deleted, and I don't necessarily disagree with them. For the sake of simplicity, however, I'm assuming that all of the comments on a typical Facebook post aren't going to be relevant if the post itself is deleted. On Hacker News, however, if the URL for this post stopped working, I think it's pretty clear that the discussion below continues to hold merit.

The ideal solution to comment threads would be to replace the usernames of people who simply delete their account with [deleted], but keep the content unless someone explicitly overwrites it. The biggest issue isn't that the content is gone (any given comment), but that nobody knows how many things are missing. It would be much better (with no loss in privacy) to at minimum just replace those comments with null text and a null owner, to at least show that 3 rows used to be here, between these existing rows.

[dwild]

> There are some valid points to keeping comments for posts that have since been deleted, and I don't necessarily disagree with them

Then your argument isn't about parent-child relationship, but value of the actual content. I can assure you, even if you don't give it value, there's one.

The funny thing, this is most probably why it's important to delete it if someone want to delete his content. It's his value, not yours, not Facebook's, no one else.

> It would be much better (with no loss in privacy) to at minimum just replace those comments with null text and a null owner, to at least show that 3 rows used to be here, between these existing rows.

I don't care about this.

[HappyDreamer]

Facebook is like a mail server and address book, that at any random time deletes emails you got from someone (when s/he quits Facebook), and deletes that persons name and phone number. Like a phone book, that sometimes self destructs one page here and there, and then you notice some time much later.

Better download & backup messages regularly, and also exchange email addresses or something else with the other person.

[zwegner]

Great post! Thanks for all the details.

Do you have any plans to release this? I could understand if you don't want to, since it might violate fb's ToS or get blocked in some way. But certainly many others would find it useful.

[mudkip]

There's a few issues that prevent me from currently releasing all of it:

The code is currently in two repositories - the first is a generic runtime I wrote that provides certain subsystems to a bunch of unrelated plugins (a small percentage of the total number of plugins relate to social networking), so I would either need to open source that repository as well, or port those plugins to something else. While I legally own the code for the first repository, it currently forms the basis of a company I founded (the social network plugins were written as a joke for personal reasons, and have no business use case - it was just easier to do this way), so I'd rather not release that just yet. I'd either need to replace the calls in those plugins (not too difficult, just annoying), or release those plugins without patching those calls with a disclaimer saying something like "drop replacement scheduling service here". Almost all of the runtime calls used by the social networking plugins are basically just for scheduling how frequently they should re-scrape things, and use almost none of the other features.

The second repository is in charge of actually viewing/browsing the data, and doesn't concern itself with repeatedly obtaining it. This repository will likely be open sourced soon, once I make the UI nicer and fix some bugs. It also contains some 'one and done' import code, for loading in data from things that just need to run once (importing from legacy chat systems, like Hangouts, Windows Phone's SMS DB, Adium, Pidgin, and a few IRC clients I no longer use anymore).

As for the social networking plugins in the first repo, these fall into one of two categories: the first are "things that access legitimate APIs, or otherwise just grab public data (e.g. YouTube)". The second category, which is mostly just Facebook, is "this logs in as you with your username/password and downloads a bunch of shit by actively impersonating you". The first category isn't really encumbered in any way, only the second one is.

In the case of Facebook, there's a few specific issues that I have to deal with. The first is that there's a bunch of exploits that it uses in order to scrape everything, and they could theoretically be patched if someone at Facebook sees what I'm doing (which is also partially why I'm not using my real name here). The second is that some of the code may or may not be correct - I've had situations while developing it where I made a basic assumption that turned out to be wrong (like objects having one primary key, comments only going two layers deep, or guessing the wrong author of a post by the username in the URL). Since this is mostly guesswork, I occasionally have to mark a bunch of rows as 'untrusted', and invalidate them if I find that an assumption I made turns out to be very wrong. This has happened a few times, and it wouldn't be nice to tell people that their DB dumps have a bunch of errors and they should just throw it all away. Scraping is hugely problematic if you don't fully understand what you're grabbing (as an example, if you just download the HTML for a given page, you can't necessarily grab the images later as all the URLs have expiry tokens in them, so the HTML scraper also needs to be aware of photos). There are certain object types that I haven't fully figured out how to decode, and I don't want to have tons of people constantly re-indexing the same URLs over and over again because some code I wrote is buggy.

[KozmoNau7]

I take an opposite tack, so I've enabled tagging approval and every time someone tags me, I remove it.

On top of that, I use a tool that goes through my activity log and deletes all my posts, comments etc. from a selected period of time. I remove everything older than six months, nothing on social media is worth saving, it's ephemeral and transient.

[wormseed]

Please stop this. This is a huge violation of your friend's privacy. Just because a friend has shared something with you on facebook doesn't mean they expect it to be in someone's personal cambridge analytica forever.

[mudkip]

I'd be curious to hear from other people with similar viewpoints, but I personally disagree. Cambridge Analytica was bad because it was a third party receiving data from others, and those people had zero reason to think that their data would ever be shared with a third party. In this case, all of the data I've obtained is either public, or was explicitly shared with me by those people in the first place. If you're arguing that I shouldn't be able to hold data that someone else wants removed, then I'd ask at what point we should be deleting your memories of events that someone else wants repressed.

To be clear, if I want to create the equivalent of a data-hoarder bunker, I don't think there's anything wrong with that. I do, however, agree that sharing things with people that couldn't see it themselves (expanding the original audience) isn't something anyone should ever do. I'd also like to point out that once someone removes something from Facebook (or any other service, for that matter), the authenticity of copies of that information is now debatable - I could scrape a bunch of stuff and show people, but you have no way of proving whether or not that information is authentic. For all you know, my script makes any posts%5 super racist.

[wormseed]

People post on facebook assuming the privacy model of facebook, where they have revokable control of who sees what they share. What do you think your friends would say if you told them you're keeping a personal copy of their photos even if they try to delete them?

[mudkip]

I've actually shown this project to several people with varying degrees of technical knowledge. The technical people have generally already considered the privacy implications of what they've shared on the internet, fully expecting most things to become public thanks to crappy code/policies. They're usually more interested in what a rewrite of TAO looks like, or how you decompile rendered frontend code back into accessible JSON.

As for the less technical people, they tend to be significantly more annoyed at Facebook when I tell them that their old comment threads / messages are likely incoherent junk.

[logfromblammo]

The friend published on an Internet public platform and added metadata to tag ancestor poster.

Where is the reasonable expectation of privacy?

If you share anything at all over Facebook, you should expect it to be in someone's personal dossier of you, forever. It's not always going to be just the people who know you and presumably bear you good will, either.

That's exactly why I don't post photos on Facebook.

[wormseed]

> If you share anything at all over Facebook, you should expect it to be in someone's personal dossier of you, forever.

No, they shouldn't, and this why we have privacy laws.

[logfromblammo]

You think that everyone always obeys the law?

Please tell me how you expect to enforce such laws without intrusive surveillance on everyone's networks and storage that would entirely defeat the purpose of having them.

"Three can keep a secret, if two of them are dead."

Even if Alice sends a file to Bob that is entirely safe from Eve while in transit, Alice has no recourse whatsoever from within the channel if Bob then turns around and just hands it over to Eve once he recovers the plaintext. Facebook is an untrustworthy recipient. Once you hand over any data, you lose your absolute control over them.

They have the capability to hand over your data to untrusted third parties, there are no safeguards in place to prevent them from doing so, no surveillance in place to detect when they have done so, and no effective recourse for any individual who feels that they may have been injured by it. We have sufficient evidence to believe that Facebook has done it in the past (Cambridge Analytica being just one well-publicized example), without even needing to know whether it was intentional, accidental, or paid business. I therefore conclude that they are still doing it now, and will continue doing it in the future.

Anything you say or do or remember in front of Facebook can and will be used against you in the court of commerce. The machines will process it all to squeeze the pennies out, and your privacy is an issue only insofar as it may impede the flow of data you willingly hand over to them in the future.

[jyrkesh]

Unless you're referring to something outside of GDPR, those laws explicitly exempt individuals not acting as processors.

[dantillberg]

How is this a violation of the friend's privacy?

The friend shared with Facebook, and Facebook intends to store the data forever. The friend shared via Facebook with the GP, and GP could go and read/view the data as often as they wished via Facebook.

Yes, GP shouldn't subsequently share this data with other parties, and GP should take care to secure this data. But why shouldn't GP store the data for their own use, though? Is this any different than archiving emails from the friend?

[wormseed]

Facebook deletes the data when a user asks. OP is explicitly trying retain a copy of people's data against their wishes.

[jyrkesh]

When you share something, whether it's publicly or within a closed loop of social media, it is inherently not within your control anymore. You can NEVER create any kind of guarantee that clicking "delete" erases every potential copy of the data. Folks need to have that in the front of their mind when they create and share data on the internet. Full stop.

Now, morally, I could maybe understand where you're coming from. It's more of a "jerk move" than it is subverting a technical promise.

But I backup my Telegram messages occasionally through their data export tool. Are you proposing that I cross-reference my own backups with messages that get deleted from our chats? Same thing with WhatsApp.

Assuming I'm not commercially monetizing those backups, I consider it well within my rights to have a copy of conversations I've held with people in the past. And in fact, it may be by design that I don't want them to manipulate the "cloud copy" of our conversation in the future.

[Aachen]

> someone's personal cambridge analytica

We're talking correspondence logs, not private investigators. Similarly, GDPR applies to a company tracking birthdays but not the one on your toilet. That your visitors can see all your friends' birthdays is not a personal Cambridge analytica, that comparison doesn't make any sense.

Should I delete that we talked to each other today in a few days when it is no longer relevant? As it is, this will be here in perpetuity, doesn't that seem dangerous as well? (I'm genuinely curious where you'd draw the line since your example isn't in line with what virtually anyone else would feel.)