[lacker]

The cease and desist seemingly has no real legal basis

It seems pretty straightforward to me - the Facebook terms of service say that you won't make scripts that interact with the Facebook site except through approved APIs, the cease and desist is telling him that he is breaking this agreement. There's no lawsuit involved, Facebook will just enforce this themselves by banning the account and making the script not work. It's not a big deal, this probably happens hundreds of times a day for various bots that people make that manipulate Facebook in different ways.

[asdff]

I feel like websites shouldn't be able to just ban scripting. What if I have a disability and a custom script is the only way I can interface with fb?

[ethbr0]

Why do we need to appeal to the differently abled?

If I own a general purpose computer, and I purchase a connection to the internet, I'm entitled to interact however I desire* with an internet service, or the information it chooses to send me.

It is not entitled to have the information it sent to me displayed in a certain way, and it certainly isn't entitled to bitch when I choose to interact with it in a way different than its preferences.

If that's what it wants, then it's welcome to sell a sealed appliance that only interacts in allowed ways. And we'll see what choices people make.

* With the exception of actions that impact others, e.g. DoS, authentication bypass, malicious hacking

[NoSorryCannot]

If everyone is entitled to interact with the internet on their own terms, then why would that not include a service being entitled to act in a way that's adversarial to your desires?

[cybernautique]

In my opinion, it does! However, on my machines, I am the arbiter. Facebook cedes control to me the moment any of their content hits my browser.

[throwawayboise]

Except that when you signed up for a FB account you agreed to access the site on their terms, not yours.

And let's be honest, and I'm the last person to defend FB, but they are not likely to be going to be going after a lone user who has automated something for his own convenience with Selenium or whatever...

Once I decided I wanted to delete a lot of old email from a webmail account. There was no "select all" function so I wrote a one-liner in the javascript console of the browser. When that worked, I automated clicking the "delete" button, and then added a loop to do it over and over. This probably violated a TOS clause somehow, but nothing ever came of it.

[cybernautique]

I have not signed up for a FB account and yet they still try to deliver payloads to my browser, in the form of tracking buttons embedded in non-FB sites. They've likewise ceded all control of those buttons, and what I do with them, to me!

[dredmorbius]

How often have FB unilaterally changed those terms in the interim, after usera are already locked in through network effects and data?

[int_19h]

Given FB's near-monopoly position, any such "agreements" are effectively forced.

[nickff]

Is this a moral/ethical, polemical, or a legal argument?

Why are you entitled to all these things? What gives you the right to demand that others act in accordance with your desires?

[drdeca]

I’m pretty sure it isn’t meant as a legal argument.

What entitles me to control of my computer? “My computer is mine, and you cannot have it.”.

That being said, I’m somewhat more open to the validity of restrictions for how to interact with the server.

If someone e.g. is running an MMO with e.g. in-game items with real money value, and someone else is like, distributing cheats to get these items immediately, it seems fair that the MMO owner should be able to make them stop (though, like, ideally their game would just be secure?)

But if users are permitted to interact with the server in a particular way, I see no reason to allow requiring that users actually touch their mouse and keyboard while doing things they are allowed to do using their mouse and keyboard.

[6510]

But since they do require that now indirectly I have an idea....

Lets have a law that requires all large services to expose all account settings though an API(?!)

Basically, 1) you [as usual] get to set up the terms of service that your users must stick to, 2) you get to pick what account options you want to offer to the user. i.e. do you want to receive email notifications yes/no, do you want to upload an avatar yes/no, what url/email/phone number do you want to display on your profile etc 3) You do not own these settings and shall provide an API for the user to change them.

You could extend the concept with things like allowing the download of a contact list with the contacts who have this enabled and the information they chose to share. Or say offer TOS updates though the API.

But the initial goal should be for browsers to offer a uniform settings page for all websites you have accounts for.

Remember that unsolicited email check box just above that for to the terms of service? If you use the site all the time you might want to opt in but who wants to dig though a website looking for it? Maybe in hind sight targeted advertisement is just what you wanted? Maybe a feed of updated settings would be useful.

Or maybe you just want to delete your accounts in a convenient way.

[qwytw]

Sounds like a factual argument, if facebook provides access through an open website that implements standard web api's the users can interact with it however they want/are able regardless if fb likes that or not.

[TeMPOraL]

> Why do we need to appeal to the differently abled?

Because it's the only avenue we have. Providing accessibility tends to require creating holes in otherwise user-hostile UX, and big companies can't give up on accessibility due to PR reasons - which makes it a perfect beachhead for people who just want a sane and respectful computing experience.

[ben_w]

> With the exception of actions that impact others, e.g. DoS, authentication bypass, malicious hacking

It is very easy to DoS by accident with software; and while I’m in favour of totally breaking the economic model of FB in this way, doing so definitely has an impact on others (specifically the Other which is FB itself).

[ethbr0]

True, but the only way to prevent that is by stripping users of autonomy.

And in a choice between user autonomy and service stability, I can't side with the latter over the former.

[AlecSchueler]

Because we share society with people who have various interaction difficulties and the larger community has for a long time accepted that we shouldn't deny access to daily goods and services for those people. It's like a mandate that a shop needs disabled access, it's totsllu reasonable

[amelius]

Except FB will just ignore your argument and detect and ban your automated service.

[feanaro]

Agreed, but people seem to often miss this point. There is nothing special in browsers that allows them to do something that "scripts" cannot do. They are both HTTP user agents.

[asdff]

I hate the whole song and dance too with how you have to fake your user agent and add human like delay to interactions whenever you make a useful script on the web these days. You aren't stopping malicious behavior since they know how to penetrate these systems trivially, you just make it harder for the average user who has to learn as they go how to rope around these issues and hope they don't get IP banned along the way for making a website slightly more useful to them.

[nickff]

If you have a disability, and you can't use the site, you're probably entitled to make an ADA claim against them.

[dghlsakjg]

If Facebook makes a change to intentionally make accessibility harder, then you can sue Facebook under the ADA if you are an American.

There is a whole category of law where they just go around suing businesses for not being accessible enough. Quite a lot of money in it.

[lacker]

Disabilities deserve special protection, but in practice companies seem pretty good about working with usability extensions. AFAICT almost all cases where companies don't support disabled users enough, it's unintentional. There's a little bit of extra work like providing alt image tags that companies neglect, or they don't think to test on color-blind users, that sort of thing, rather than banning usability extensions for violating the TOS.

[KerryJones]

I agree with you that they shouldn't be able to ban scripting... but they're only going to use it for things that they believe hurt the website. If there's a law that says "don't do it" they can sue the people they don't like and ignore the ones they don't care about.

[quantified]

Browsers only automate user interactions with the underlying HTTP APIs. What defines “scripting” here?

[salawat]

They can't ban the account. The account would be the downloader's and presumably, would auto-generate unfollow actions just as a user in a browser would manually. If they break the script, they'll probably break the unfollow UI for legitimate human user's and create evidence that they employ dark UI practices as a core part of their business strategy, which would be a P.R. nightmare.

Messing with this is a lose-lose for Facebook.

[lacker]

If they break the script, they'll probably break the unfollow UI for legitimate human users

Messing with this is a lose-lose for Facebook.

Nah, this sort of thing really happens all the time. Think hundreds of scripts like this automatically disabled each day. This one just flukily got some press attention. Large tech companies will have teams entirely dedicated to preventing scripts from doing things while keeping the site running as normal for regular users.

[Talanes]

https://slate.com/technology/2021/10/facebook-unfollow-every...

The actual timeline of events doesn't match what you think would happen. They banned him and then used the threat of a lawsuit to get him to take down the extension/code.

[newhotelowner]

If they could ban the account, they would have done it.

Extension is more like a automated tool. Don't need any permission from Facebook. User can install the tool, and click on a button to unfollow your friends.

Facebook could write TOS for his users not to run a script on their website.

I write scripts (userscripts) all the time. I have a script for Gmail that I use it all the time. Gmail doesn't know that.