Facebook Breaks Major Websites With Redirection Bug

so... by liamevo · 2013-02-08 01:52 · Score: 5, Insightful

can we please stop relying on third parties for things *you* should be providing to your users.

Re:so... by Seumas · 2013-02-08 01:57 · Score: 5, Funny

Hey, just because all of my forum stuff comes from Disqus, my word of mouth spreading comes from twitter, facebook, and google plus integrations, and my content comes from automatic AP feeds doesn't mean I don't provide anything myself! I . . . . uh . . . .
Re:so... by orthancstone · 2013-02-08 02:11 · Score: 5, Insightful

On one hand, I'd prefer to see authentication in the hands of someone I consider more reliable (like Google) than someone programmer of questionable ability at (Insert Random Dying Newspaper here).

On the other hand, a hearty "HA HA!" does feel appropriate here. They do get what they are asking for by being so deeply tied to a third party.
Re:so... by deains · 2013-02-08 02:34 · Score: 1

Let's just get in touch every CDN in existence and get them to shut down everything they're doing then. Clearly centralising providers of commonly-used resources is an abysmally terrible idea.

(Sarcasm, just in case you can't tell)
Re:so... by hobarrera · 2013-02-08 02:46 · Score: 1

IMHO, OpenID is better. Whether google is trustworthy or not is a matter of opinion, and google can be just another OpenID provider. If we want a single provider, the world will never settle for a single trusted entity.
Re:so... by ElmoGonzo · 2013-02-08 03:11 · Score: 1

I've less quarrel with the concept of using a 3rd party to verify identity (that's what a driver's license does when we aren't on line) than with the notion of using the services of a "free" site that gets its revenue by tracking its users and selling that information to advertisers and the like. And do I want to stay logged in to something like Facebook when it is exposing my information (not all of which is bogus fiction) to anyone who has access to their API? And yes, Google is doing much of the same as are numerous others.
Re:so... by squiggleslash · 2013-02-08 03:28 · Score: 1

Kinda. The thing is that the reliable programmers who specialize in this kind of thing work for companies like Disqus, whose jobs revolve 100% around this. However, random PHB at ${dying newspaper} has never heard of Disqus, but has heard of Facebook, which similarly to the newspaper employs many programmers, few of whom consider it the primary job of their organization to help, and not f--- up, third party websites.
If Disqus (or Livewyre or whatever) ever made this kind of screw up, they'd seriously destroy their credibility, but unfortunately....

--
You are not alone. This is not normal. None of this is normal.
Re:so... by saveferrousoxide · 2013-02-08 03:40 · Score: 5, Funny

I deal with the goddamn customers!
Re:so... by CastrTroy · 2013-02-08 04:21 · Score: 4, Interesting

I know a guy who does this. He pulls in about $50 a month with a site that basically runs itself. The only reason I don't do it is because the "ads" he ends up generating money off of are the kind that pay out when the visitor to his site installs a tool bar or some other nefarious thing. The only reason I wouldn't do that is that I don't think it's ethically correct to lure people into installing stuff they don't want on their computer. But I imagine that someone who's ambitious enough, and who sets up enough sites could generate quite a bit of money like this.

--

Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
Re:so... by Dragonslicer · 2013-02-08 04:50 · Score: 1

Exactly. After all, nobody that's ever written their own authentication code has ever screwed it up.
Re:so... by sinij · 2013-02-08 05:20 · Score: 1

>>>I deal with the goddamn customers! And if you don't like it, you can program goddamn login page yourself!
Re:so... by rwise2112 · 2013-02-08 05:21 · Score: 1

I deal with the goddamn customers!
I have people skills, damnit!

--

"For every expert, there is an equal and opposite expert"
Re:so... by LandDolphin · 2013-02-08 05:25 · Score: 1

haha

--
Spelling and Grammar errors have been added to this post for your enjoyment
Re:so... by davester666 · 2013-02-08 05:32 · Score: 2

...said the person who just finished installing an autoreply bot...

--
Sleep your way to a whiter smile...date a dentist!
Re:so... by Jane+Q.+Public · 2013-02-08 06:52 · Score: 1

"... can we please stop relying on third parties for things *you* should be providing to your users."
Actually, this probably didn't come from anything that is "provided" to customers.

Typically, when you link your site to Facebook (especially if you're not careful), you include a piece of JavaScript that Facebook supplies. Essentially, it's user-tracking, which is NOT a service "provided" to site visitors, unless you happen to like that sort of thing.

Sadly, many websites actually pull this JavaScript in realtime from Facebook itself, rather than hard-coding the JavaScript into their page.

So at any time, all Facebook has to do is change this JavaScript in a single location at their own web service, to affect all users of that JavaScript, everywhere. (Except for those few smart folks to hard-code it in the page.)
Re:so... by icebraining · 2013-02-08 13:33 · Score: 1

Facebook JS files are not open source; by "hardcoding them", you're actually committing copyright infringement.

--
Dilbert RSS feed
Re:so... by Jane+Q.+Public · 2013-02-08 18:06 · Score: 1

"Facebook JS files are not open source; by "hardcoding them", you're actually committing copyright infringement."
So? It's still the better way to go about it. The host company (like Google or Facebook) will never know. And if you don't? Look at the poor schmucks in TFA.

Of course, if you do that it has to be updated periodically; the host company can't update it on your site, so you have to.

But I am most definitely not in favor of making my websites hostage to other web services for their basic operation. That's just asking for trouble. As we can clearly see here.
Re:so... by icebraining · 2013-02-08 21:51 · Score: 1

Oh, and if you hardcode them, how do you expect them to be able to do XHR requests to their servers, in violation of the same origin policy? There's no point in serving JS if you prevent it from working.

--
Dilbert RSS feed
Re:so... by Jane+Q.+Public · 2013-02-09 10:01 · Score: 1

"Oh, and if you hardcode them, how do you expect them to be able to do XHR requests to their servers, in violation of the same origin policy? There's no point in serving JS if you prevent it from working."
I've never used any that did that, and wouldn't use any that did that. That's a violation of MY policy.
Re:so... by Vanessagirl · 2013-02-09 11:46 · Score: 1

There are a lot of blackhatters doing this, or used to do this, some Google updates can ruin your income. Check out autoblogging. No need for Pay-Per-Download of malicious addons, you can do just fine with other acceptable PPC or CPA
Re:so... by cavebison · 2013-02-09 17:56 · Score: 1

He pulls in about $50 a month with a site that basically runs itself.
Not bad. A site that pays for its own development in 2 years is not something to sneeze at, it took Facebook a lot longer than that.
Re:so... by Common+Joe · 2013-02-09 20:44 · Score: 1

On one hand, I'd prefer to see authentication in the hands of someone I consider more reliable (like Google) than someone programmer of questionable ability at (Insert Random Dying Newspaper here).
I question what we are doing wrong in the computer world where we need a 3rd party just so that our users can securely login to a simple system that we create. I get that there are a lot of attack vectors. Why? What did we do wrong? Can we improve it so that it is simple to do a login?
Re:so... by anguirus.x · 2013-02-10 03:42 · Score: 1

There are a lot of blackhatters doing this, or used to do this, some Google updates can ruin your income. Check out autoblogging. No need for Pay-Per-Download of malicious addons, you can do just fine with other acceptable PPC or CPA
Mix in some SEO and this is not uncommon.

Congrats by Anonymous Coward · 2013-02-08 01:53 · Score: 5, Insightful

If you let others insert scripts into your pages they can steal your visitors.

Maybe it'll make sites think about who they script src from.

Re:Congrats by FireFury03 · 2013-02-08 02:30 · Score: 4, Insightful

If you let others insert scripts into your pages they can steal your visitors.
Maybe it'll make sites think about who they script src from.
One of the bad things I've noticed recently is that HSBC is including objects from third party organisations in their ebanking login pages. I do wonder if any thought has gone into the security of such things, or if HSBC simply don't care (my experience of banks tells me that none of them have a single clue when it comes to internet security).

--
http://blog.nexusuk.org
Re:Congrats by Anonymous Coward · 2013-02-08 03:41 · Score: 1

Use RequestPolicy and you'll be in control of what websites include from third parties.
Re:Congrats by Anonymous Coward · 2013-02-08 04:09 · Score: 2, Funny

Well if drug kingpins and terrorists use them, they must be a pretty good bank.

And... by Anonymous Coward · 2013-02-08 01:55 · Score: 1

...people wonder i some of us block external crap on sites, not just ads.

Re:And... by lattyware · 2013-02-08 05:08 · Score: 2

Which is why we should be asking for two-factor auth on every site, and using unique random passwords stored in a password vault for websites that need passwords. That way, if someone gets your password, it's a) useless without your phone b) useless for any other site. Unfortunately, it's extra hassle for developer and end user, so only a few people do it.

--
-- Lattyware (www.lattyware.co.uk)

Good. by Seumas · 2013-02-08 01:55 · Score: 1

Serves every one of these websites for being Facebook lemmings.

Re:Good. by Anonymous Coward · 2013-02-08 02:02 · Score: 2, Funny

They prefer to be called facebook serfs

use adblock+ to block social media extensions by Anonymous Coward · 2013-02-08 01:56 · Score: 1

The fanboy adblock lists include another list you can add which also blocks out all social media badges etc.

Re:use adblock+ to block social media extensions by Hsien-Ko · 2013-02-08 02:06 · Score: 1

Ghostery is another weapon in the defense too

Here Endeth The Lesson. by fuzzyfuzzyfungus · 2013-02-08 01:57 · Score: 2

Not that it will; but let that be a lesson to you.

Re:Here Endeth The Lesson. by RobertLTux · 2013-02-08 02:28 · Score: 1

No NO NO you have to do it right
[play sound: THX Big Note.wav] THUS ENDETH THE LESSON
but anywho if i was one of those sites i would have my legal staff have a chat with Facebook about not having this happen again EVER.

--
Any person using FTFY or editing my postings agrees to a US$50.00 charge
Re:Here Endeth The Lesson. by alostpacket · 2013-02-08 05:13 · Score: 1

Thanks teach! I have learned that people rarely learn the lesson. I think. Will this be on the final exam?

--
PocketPermissions Android Permission Guide

Um... How? by camperdave · 2013-02-08 01:57 · Score: 1

How is that possible? If I'm going to a site, I type in the URL into the address bar, or I click on a favorite, or click on a link returned by Google, or another search engine. The URL gets sent to a DNS server, which returns the IP address of the site, and then my browser starts making http requests directly from the site. Facebook is never involved. Unless Facebook has somehow poisoned the root DNS servers, I don't see how this is possible.

--
When our name is on the back of your car, we're behind you all the way!

Re:Um... How? by belthize · 2013-02-08 02:02 · Score: 3, Interesting

I suspect horrible article is the main culprit. At a guess I suspect this is nothing more that Facebook's authentication service failing.
Client is directed to Facebook for authentication, mechanism fails, Facebook tosses up error page. The implication that Facebook did anything wrong other than having buggy authentication is likely way of base.
Full disclosure, don't have a facebook page, never visited a facebook page, have zero interest in facebook.
Re:Um... How? by Culture20 · 2013-02-08 02:06 · Score: 3, Informative

These sites are including javascript from facebook. Check your noscript/requestpolicy lists on those pages and you'll be surprised how many external sites those pages include javascript and images from. This was bound to happen (and worse things have probably happened in secret).
Re:Um... How? by Anonymous Coward · 2013-02-08 02:06 · Score: 4, Insightful

In short, "Web bugs", short bits of code that are included inline from another provider. Basically these sites had on their front page a "get shit from facebook" or some such badge displayed, that badge is not created by the site owner but is sourced inline from facebook, now if the thing they pull from facebook is broken and facebook presents a redirect to your browser in place of the web bug (badge, whatever) then your browser dutifully redirects.
If facebook were malicious they could commandeer half of the web.
Re:Um... How? by Anonymous Coward · 2013-02-08 02:11 · Score: 2, Insightful

The key is "client is directed to Facebook". Sites include 3rd party scripts all the time, blindly executing whatever gets sent back. If that includes a simple assignment to window.location, there's your redirect.
Re:Um... How? by Anonymous Coward · 2013-02-08 02:14 · Score: 4, Interesting

The Steam browser is a nice example of facebook javascript gone wrong. Every page with a "like" script on it redirects to some facebook address as soon as the page finishes loading. The end result is that you see what you wanted to see, but the URL bar is always some sort of lenghty facebook redirect because Steam is trying to load it somehow but fails and leaves you on the page you wanted to visit anyway.
Re:Um... How? by omnichad · 2013-02-08 02:47 · Score: 1

I successfully made it to Papa John's web site to order pizza last night. When I got to the last page of checkout, I immediately got redirected to Facebook.
Apparently they're including Facebook Javascript code on all their pages, and I happened to be in the middle of ordering a pizza when the bug hit.
Why Javascript is allowed to redirect a web site these days without user intervention is beyond me. Most Javascript methods that open windows or navigate you require being triggered by a click event or other human intervention.
Re:Um... How? by camperdave · 2013-02-08 06:18 · Score: 1

So all these webmasters put foreign code on their websites without doing any sort of sanity audit on it? Scary!

--
When our name is on the back of your car, we're behind you all the way!
Re:Um... How? by chihowa · 2013-02-08 06:59 · Score: 2

Worse than that. Many (most?) of them have you pull the foreign code from the foreign site directly. So even if they did audit it, the foreign site could change the code and their site would dutifully ask you to run it.

--
If you want a vision of the future, imagine a youtube comments section scrolling - forever.
Re:Um... How? by icebraining · 2013-02-08 13:39 · Score: 1

Slashdot itself loads a few JS files directly from third-party servers, particularly Google's (through Google Analytics).

--
Dilbert RSS feed
Re:Um... How? by MagdJTK · 2013-02-09 08:38 · Score: 1

I think a lot of web apps would break if Javascript couldn't mess with the window location / back button / tab history, etc. Think of things like Gmail and Google Docs. Unlike pop-ups and so on, it does actually have a useful purpose.
Re:Um... How? by omnichad · 2013-02-09 17:51 · Score: 1

Back buttons would require a click. As long as they have to be tied in some way to a click the way pop-ups do. They aren't blocked, they just have to be proven as user-initiated.

facebook by hackula · 2013-02-08 01:57 · Score: 4, Funny

The first successful test. Soon every site will redirect to facebook, then... the world!

Re:facebook by Impy+the+Impiuos+Imp · 2013-02-08 02:20 · Score: 1

Offer multibillion IPO
2. Seize conttol of internet
3. ???
4. Well, monetizing for profit is still problematic

--
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Re:facebook by omnichad · 2013-02-08 02:48 · Score: 1

The ultimate phishing attack.
Re:facebook by hackula · 2013-02-15 02:14 · Score: 1

This pretty much sums up the number one problem with tech culture in the valley. Companies are optimized to raise money, not make money. Facebook has had years to switch the focus already but still cannot seem to do it. If your typical tech startup had 20 billion in the bank, the founders would say "Look how this will affect our valuation! We'll be able to get to round 98 of seed funding!"

Details: Logging in from 3rd party sites? by Anonymous Coward · 2013-02-08 02:01 · Score: 1

I was logged into Facebook when I got this redirect.

However, the website I got it from is one I have never placed a Facebook "like" on or written a comment on with my profile.

Does "a bug that redirected people logging in with Facebook from third party sites" mean that the site has my Facebook details?

The URL was this:

https://www.facebook.com/dialog/permissions.request?client_id=__15digitno__&response_type=token%2Csigned_request%2Ccode&display=none&domain=www.website.com&origin=1&redirect_uri=http%3A%2F%2Fstatic.ak.facebook.com%2Fconnect%2Fxd_arbiter.php%3Fversion%3D18%23cb%3Df28691eaa8%26origin%3Dhttp%253A%252F%252Fwww.website.com%252Ff1c830d484%26domain%3Dwww.website.com%26relation%3Dparent&sdk=joey

Re:Details: Logging in from 3rd party sites? by SJHillman · 2013-02-08 02:11 · Score: 5, Informative

The third-party sites load a chunk of Facebook onto their site, so if you're logged into Facebook then you're logged into that chunk on the third-party site. The third-party site doesn't have your login or information - it's passed between you and the chunk of Facebook on that site. Or at least, that's how it's supposed to work.
It's not the 90's anymore... you can load a page that's connected to dozens of different services that are almost completely independent of each other and the page you're on.
Re:Details: Logging in from 3rd party sites? by Anonymous Coward · 2013-02-08 02:15 · Score: 1

You don't need to like or comment. You have been logged automatically (as in: they know where you've been). It's a feature!
Re:Details: Logging in from 3rd party sites? by Mitreya · 2013-02-08 03:33 · Score: 1

It's not the 90's anymore... you can load a page that's connected to dozens of different services that are almost completely independent of each other and the page you're on.
Yes, but do we have to?
Most of those websites look crippled until the last of these dozen services finally loads 3 minutes later. Blockbuster.com used to hang (unresponsive) for about 30 seconds while the browser said "contacting adserve...fb.com".
Re:Details: Logging in from 3rd party sites? by CanHasDIY · 2013-02-08 03:51 · Score: 1

It's not the 90's anymore... you can load a page that's connected to dozens of different services that are almost completely independent of each other and the page you're on.
For some reason, that makes me a sad panda... :(

--
An enigma, wrapped in a riddle, shrouded in bacon and cheese
Re:Details: Logging in from 3rd party sites? by alostpacket · 2013-02-08 05:18 · Score: 1

sdk=joey?
function getJoey()
{
return "Doh";
}

--
PocketPermissions Android Permission Guide
Re:Details: Logging in from 3rd party sites? by Secret+Agent+Man · 2013-02-08 06:38 · Score: 1

Most of those websites look crippled until the last of these dozen services finally loads 3 minutes later.
I know, right? Browsing the web with NotScript (Chrome extension) is a real eye-opener. Some sites simply load as a blank white screen until you whitelist scripts to run! It's especially good when you first open a site, it has three sources for scripts, then when you enable one, suddenly 15 more appear in the list. It's great being able to disable most of the junk people toss on sites from the get-go, but sometimes it's irritating to have to dig through the long chain of scripts just to make a web site functional. Eventually I just give up and go with "run all temporarily."
I hope we get to a point where web sites can't just include arbitrary scripts to run from third party sites, but then we might have issues of people hosting the cruddy stuff from their own host, making filtering harder. A catch-22, for sure.

Single point of failure by Anonymous Coward · 2013-02-08 02:02 · Score: 2, Interesting

Recently we have seen very widespread "single point of failure" issues. Notably with Facebook and Apple who are both so pervasive in society. These firms are constantly doing major and complicated software updates and those updates are propagated either invisibly in the background or introduced through "voluntary" software updates where you don't get major new features unless you do the update and you have to simply live with whatever bugs or feature cripples come along with it.

The fact so many people are dependent on these very small number of very human folks is a large "single point of failure" risk for society and its individual, business, and government segments.

JJ

Re:Single point of failure by SJHillman · 2013-02-08 02:15 · Score: 3, Informative

I use Facebook, I admit it. However, I only use Facebook for Facebook. If I log in to another site, I don't use the "Connect with Facebook" option to log in. If the site only allows you to log in with Facebook, I leave. I've yet to find a mission critical site like banks, etc that use Facebook or another service. Therefore, I'm doing my part to save humanity from the single point of failure.
Re:Single point of failure by FireFury03 · 2013-02-08 02:39 · Score: 1

What was the apple one? I don't recollect it
The only one I can remember was when the server that responds to WISPr probes went down, rendering everyone's ipad unable to connect to a network...
Background:
When an iOS device associates with a wifi network, it makes a web request to apple's server to see if its behind a captive portal. It expects to get back "SUCCESS" (returned by Apple's server) or a captive portal login page (returned by the wifi hotspot). If it doesn't get "SUCCESS" it displays the captive portal page so the user can log in. Unfortunately, Apple's software is unable to cope with the web request not being answered at all, and you end up with a blank "login" page and a non-funcational network connection. Yes, this is the usual quality I've come to expect from Apple, given the numerous problems I've had to deal with since iOS devices started to get popular in the workplace...

--
http://blog.nexusuk.org
Re:Single point of failure by SuricouRaven · 2013-02-08 04:15 · Score: 1

Windows does the same thing, but AFAIK the only thing that happens if it doesn't get the OK response is the user gets a little popup balloon from the system tray warning them an internet connection is not available.
Re:Single point of failure by alostpacket · 2013-02-08 05:21 · Score: 1

Unfortunately it sounds like this bug would have hit users such as yourself also. I think when leaving FB to visit another site it is best to log out.
Multi-instance/multi-profile browsers would also be something nice. Especially those that limit what they report about the machine they are on (less fingerprint via installed fonts/cookies/html5 dbs/flash objects/etc)

--
PocketPermissions Android Permission Guide
Re:Single point of failure by rizole · 2013-02-09 01:02 · Score: 1

If you stay logged in to facebag they can still track you via the part of any webpage that loads a chunk of facebag inline. I load it ina seperate browser and use ghostery on my main browser to block third party shenanigans.
Re:Single point of failure by MagdJTK · 2013-02-09 08:41 · Score: 1

When an Apple device connects to a wifi network, it checks http://www.apple.com/library/test/success.html to see if the network is connected to the Internet. Unfortunately, some bozo deleted that file...

I keep trying to use Facebook. by hessian · 2013-02-08 02:06 · Score: 5, Insightful

I've come to the conclusion that social networking is screwed up because the people who use it most are the people who are least invested in reality.

Every time I try to use Facebook, I get driven away by the behavior of its users. Not the Instagram dinner plate updates, or the personal drama, because I've already filtered out those people.

It's the sensitivity. People take anything seriously. I posted an article showing that divorce really screws up kids. I got back a half-dozen replies, all from people who'd had divorces, defending their own decisions. When I said that it wasn't personal, they said they still felt attacked.

There were other instances of similar behavior too. People hover around Facebook, looking for some reason to cause a scene. Why was this, I wondered.

It seems to me that if you have found something worth doing in life, you're mostly doing it. That doesn't mean your job. If your job sucks, you've probably got a project on the side. You're not going to devote your time to screwing around, which is what most people on Facebook do.

This means that social networking including Facebook selects out the people who have any direction in life, and leaves the resentful, bored, unemployed, disabled, upset, insane, teenage, etc. and concentrates them in large numbers. This is why so much of the response is crazy.

I should amend the post title. I used to keep trying to use Facebook (and MySpace, Digg, Reddit, Friendster, Pinterest, etc.). But now, I don't. These aren't places where healthy people hang out.

--
Futurist Traditionalism

Re:I keep trying to use Facebook. by hodet · 2013-02-08 02:18 · Score: 1

Facebook free for three months now. I just came to the realization that I was not interacting with all the people I care about in my life on Facebook. I was interacting with them in real life. The only interaction was with "fringe" friends or people you felt obligated to friend because they are "friends of friends" you met somewhere. "Hey great, Joe's wife took a picture of her Big Mac and fries and is enjoying a delicious shake." Ya, I'm outta here.
Re:I keep trying to use Facebook. by Megane · 2013-02-08 02:20 · Score: 1

Really, the only two-way stuff I use is:
Slashdot, because of the good moderation system and good supply of topics that I want to see other people's comments about as much as the topic itself
and 4chan (yes, seriously) because it's sort of a zero-point energy of random discussion with its default anonymity and constantly expiring threads (it's too much hardcore internet trolling and memes for the average person though) But stay away from /b/, nothing interesting happens there anymore.
I avoid the twits and bookfaces as much as possible. At least 4chan's social cancer is constantly flushed away, unlike twitter and facebook where it stays around and festers.

--
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
Re:I keep trying to use Facebook. by rmdingler · 2013-02-08 02:27 · Score: 1

Well done. I would add unhappy to your list of qualities that make up the bulk of social site users. Many of the people I know who are regular users remain in contact with old flames even though they are now like Al Bundy. Here's to hoping these extra opportunities to procreate don't result in the psychologically healthy being out-bred by this genotypical subset. Oh wait...

--
Happiness in intelligent people is the rarest thing I know.
Ernest Hemingway
Re:I keep trying to use Facebook. by LordLucless · 2013-02-08 10:48 · Score: 1

Every time I try to use Facebook, I get driven away by the behavior of its users. Not the Instagram dinner plate updates, or the personal drama, because I've already filtered out those people.
It's the sensitivity. People take anything seriously. I posted an article showing that divorce really screws up kids. I got back a half-dozen replies, all from people who'd had divorces, defending their own decisions. When I said that it wasn't personal, they said they still felt attacked.
You realize that the people "on Facebook" in this regard are your friends? You post an article, it's your friends who comment on it. What you're complaining about isn't Facebook's userbase in general, but that subset of it that you consider your friends. For what it's worth, I've had extended political and religious (basically the two most flamebait-y topics possible) discussions on Facebook where most people remained civil and presented reasoned arguments (and the few who didn't were just ignored). That's because I've surrounded myself with people who appreciate civility and reason as much as I do.
Facebook's an enabler, with the usual GIGO provision. You put garbage friends in, you get garbage discussion out.

--
Just because you're paranoid doesn't mean there isn't an invisible demon about to eat your face

Story Subject Fail by OzPeter · 2013-02-08 02:06 · Score: 4, Informative

Facebook did not "Break major websites". Instead Facebook users who were logged in to Facebook (and hence working under the auspices of Facebook) were screwed over when they went to third party sites. Sheesh .. even TFS explains that.

Are we now starting to refer to the Internet as teh Facebook???

--
I am Slashdot. Are you Slashdot as well?

Re:Story Subject Fail by SJHillman · 2013-02-08 02:20 · Score: 1

It broke the expected functionality of third-party websites. But I agree that Internet is not Facebook. At most, you might be able to claim Facebook broke a chunk of the WWW, but certainly not the Internet as only websites were affected. It's like saying a minor design flaw in a part used by many different car manufacturers completely disrupted our entire transportation infrastructure.
Re:Story Subject Fail by Sockatume · 2013-02-08 03:13 · Score: 1

You seem to be under the impression that it was people visiting sites from links on Facebook that had an issue. If you visited any of the sites, directly, while logged into Facebook you were affected.

--
No kidding!!! What do you say at this point?
Re:Story Subject Fail by Bogtha · 2013-02-08 03:32 · Score: 2

Instead Facebook users who were logged in to Facebook (and hence working under the auspices of Facebook)

I think you've misunderstood. By "logged into Facebook", they don't mean they were actually looking at Facebook at the time. It means they had previously logged into Facebook at some point and their browser has a cookie saved which authenticates them to Facebook.
These people were surfing the web normally. They weren't on Facebook. They got to a site that used Facebook for authentication, and the JavaScript that these sites embedded to enable that had a defect in it that noticed they were logged into Facebook and caused the error.
From the end user's perspective, it was simply a case of surfing as normal, and then suddenly a Facebook error message hijacked the website they were trying to visit.

--
Bogtha Bogtha Bogtha
Re:Story Subject Fail by CanHasDIY · 2013-02-08 03:54 · Score: 1

Facebook did not "Break major websites".
This.
Facebook broke Facebook, and some third party sites were affected.

--
An enigma, wrapped in a riddle, shrouded in bacon and cheese
Re:Story Subject Fail by John+Hasler · 2013-02-08 03:56 · Score: 1

> Are we now starting to refer to the Internet as teh
> Facebook???
Well, you're already confounding the Web and the Net.

--
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Re:Story Subject Fail by John+Hasler · 2013-02-08 03:59 · Score: 1

> If you visited any of the sites, directly, while logged into
> Facebook you were affected.
And therefor it affected only Facebook users. Neither the Web nor the Net was broken. Just Facebook.

--
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.

If it was anyone else... by dywolf · 2013-02-08 02:08 · Score: 1

I'd be of the mind that it wasn't a bug, but intentional. But FB? They don't really need the page views....do they? Stock has taken a bit of a dip again since the graph thing came to light...though still high enough that I'm sitting pretty (bought when it was around 19.50 or so).

--
The guy who said the election was rigged won the presidency with the second-most votes.

It Has Its Ups and Downs by eldavojohn · 2013-02-08 02:08 · Score: 5, Interesting

can we please stop relying on third parties for things *you* should be providing to your users.

Clearly it has benefits and disadvantages. One of the disadvantages is displayed in this story. I could name a decent amount of benefits though: 1) you don't have to register again and again every time you want to use some site. 2) you don't suffer from password fatigue. 3) you don't have to worry about no talent ass clowns storing your username and password in plaintext (although you do have to worry about facebook being no talent ass clowns about that). 4) if I just want to stand up a quick little site that is nothing more than CRUD associated to users then all that login stuff can be offloaded to facebook or whomever. 5) from a large corporation standpoint, you can now get additional social data about your users from the facebook api (I know, this isn't necessarily an advantage for the end user and is best viewed as double edged).

Are you opposed to openID too?

--
My work here is dung.

Re:It Has Its Ups and Downs by Rockoon · 2013-02-08 02:25 · Score: 4, Insightful

Indeed.

I think many people are in support of third party authentication semantics for non-critical sites..

Even though ultimately facebook is probably a bad choice for it, what else is so ubiquitous as to be a reasonable option that also doesnt suffer the same essential problems (certainly not a google account?)

--
"His name was James Damore."
Re:It Has Its Ups and Downs by DogDude · 2013-02-08 02:33 · Score: 2, Insightful

from a large corporation standpoint, you can now get additional social data about your users from the facebook api (I know, this isn't necessarily an advantage for the end user and is best viewed as double edged).

For an individual, there's only one edge: a sharp one. Who in their right mind would want every company/web site to know all of the intimate details of what they're doing on every other web site? Isn't it obvious to people that by signing in with a Facebook ID to web sites, that not only does Facebook track everything done, but then sells that information to everybody else? That's how those extremely complete personal profiles are created about individuals in corporate databases that are then swapped and sold indefinitely. What benefit could this possibly have for individuals?

--
I don't respond to AC's.
Re:It Has Its Ups and Downs by whargoul · 2013-02-08 02:59 · Score: 5, Interesting

...what else is so ubiquitous as to be a reasonable option that also doesnt suffer the same essential problems (certainly not a google account?)
I use Twitter when the option is available only because they don't collect data on me like facebook does. If it's facebook only, I usually won't sign up.
Re:It Has Its Ups and Downs by Sockatume · 2013-02-08 03:11 · Score: 2

If Facebook sold that information you'd have a point, but as it's not disclosed in any of their privacy literature that'd be a monstrous and legally actionable breach of their information protection obligations.

--
No kidding!!! What do you say at this point?
Re:It Has Its Ups and Downs by DragonWriter · 2013-02-08 03:40 · Score: 3, Interesting

Even though ultimately facebook is probably a bad choice for it, what else is so ubiquitous as to be a reasonable option that also doesnt suffer the same essential problems (certainly not a google account?)
OpenID. Sure, a provider having a similar error could stop users of that provider from logging on to your site, but its not a single point of failure for the entire site, its a single point of failure for the user and all the sites they use it to log into.
Re:It Has Its Ups and Downs by DogDude · 2013-02-08 03:51 · Score: 2, Insightful

Hey kid, I've got a bridge to sell ya'....

--
I don't respond to AC's.
Re:It Has Its Ups and Downs by Pope · 2013-02-08 06:29 · Score: 1

I use Twitter when the option is available only because they don't collect data on me like facebook does. If it's facebook only, I usually won't sign up.
Of course Twitter collects as much data on you as they possibly can. How else are they making money?

--
It doesn't mean much now, it's built for the future.
Re:It Has Its Ups and Downs by theskipper · 2013-02-08 06:48 · Score: 1

Facebook is an advertising company. Their product is highly granular, per-user demographics and profiles. That product is based on information gathered from tracking their users' posts, relationships, browsing history and basically any info they can get their hands on (raw materials). The product is then sold to their customers; anyone who does a targeted media buy on their site, as well as advertisers and marketing firms.
Without the raw materials, Facebook would not be a for-profit venture and their stock would be worthless. You can argue semantics that they're not blatantly selling the info. But the info is getting sold in some fashion, it's their business plan and clear as day in the original prospectus filed with the SEC.
Re:It Has Its Ups and Downs by chrismcb · 2013-02-09 17:42 · Score: 1

Who in their right mind would want every company/web site to know all of the intimate details of what they're doing on every other web site?

Most people would not want that.
But most people don't care. First of all most people don't even know, or consider what is actually happened. Secondly it is convenient for most people. And thats pretty much why it will continue.
Re:It Has Its Ups and Downs by Common+Joe · 2013-02-09 20:41 · Score: 1

4) if I just want to stand up a quick little site that is nothing more than CRUD associated to users then all that login stuff can be offloaded to facebook or whomever.
You touch upon something that has bothered me for a long time. It is pretty complicated to securely "log in" to a system on the web. I'm not a website developer, but it seems to be coming to a point where website developers require 3rd party APIs for a simple CRUD system. Aren't we doing something wrong in the computer world?
Re:It Has Its Ups and Downs by DKlineburg · 2013-02-09 21:46 · Score: 1

Agree. They all collect data on you. Bing asked me to link my web searches to other things. I wonder why they wanted that? Even promised one lucky bloke an x-box 360.

--
Memory is deceptive because it is colored by today's events. - Albert Einstein

Annoying! by SirAudioMan · 2013-02-08 02:13 · Score: 1

At first I thought I somehow angered facebook and caused my session to get corrupted! Each time I visited a few different news sites after a few seconds It would be redirected to the error page. I ended up having to clear my cache to prevent the annoying redirect. I find facebook is good as a time waster but I find it scary how many sites have access to my logins and can track and control content.

Too big to fail by Anonymous Coward · 2013-02-08 02:35 · Score: 1

Obviously Facebook is too big to fail, so every time they bork the internet we should give them a billion dollars.

Re:Too big to fail by leuk_he · 2013-02-08 04:34 · Score: 1

No internet company should be too big to fail. .... But we give them billions anyway. Google in advertising, Facebook as "like"people, Microsoft for your desktop OS. Apple because it is shiny.

What's also interesting... by raehl · 2013-02-08 02:37 · Score: 3, Interesting

...I got this bug on a website I do *NOT* use Facebook to log into, so the Facebook statement appears incorrect in that regard. (I was logged into Facebook in that browser though.)

--
paintball

clear skies fuck you up by Nyder · 2013-02-08 02:46 · Score: 1

I never use another site to log into a different site. Sure, Facebook is big today, but this is the internet, this is technology. Myspace? Geocities?

What do you do when FB for whatever reason, suddenly stops? All those sites you used to use facebook to log in, you can't get in. You think FB is going to care when their stock is going for pennies?

My suggestion, don't use other sites to handle your log in for you.

My other suggestion: FB is a troll, quit feeding it.

--
Be seeing you...

Re:clear skies fuck you up by omnichad · 2013-02-08 03:12 · Score: 1

I participate in comment discussion on the Gawker blogs - Lifehacker, particularly. They took away their own login system after they screwed it up so badly they gave away everyone's password. The community there is nice, but the site owners are stupid. I say, please let them use Facebook. When Facebook stops? They'll give me a way to transition to whatever they choose next.
Of course, if I have a choice, I don't log in with Facebook.
But I believe that Facebook Connect provides enough demographic info back to the site (your email address) that your profile can be rejoined with a new authentication system fairly easily - even if Facebook just disappears at once without any transition period.

A Javascript problem, really by omnichad · 2013-02-08 03:06 · Score: 1

Javascript has been putting in security restrictions for a while now. You can't open a new window without a user click. Most browsers now block automatic window popups.

Why are we still allowing something as archaic as a Javascript redirect? We already have meta tags and HTTP header redirects. We don't need browser navigation without a click to exist in Javascript.

Sure, you could blame Facebook - they did put out a bad script, but the fact that this is even possible is really on the browser makers.

Re:AdBlock & Ghostery = inferior to hosts by omnichad · 2013-02-08 03:07 · Score: 1

Oh, great. Good plan. Completely block Facebook with a hosts file. This only affected logged in Facebook users. People who aren't going to add facebook's scripting domains to their hosts file.

Ran into this. Only happened if I was logged in by Christianfreak · 2013-02-08 03:39 · Score: 1

I was getting this yesterday when reading an article on Mashible. I noticed that it stopped doing it by logging out of Facebook. Probably something I should be doing anyway to prevent them from tracking me all over the place

--
The Anti-Blog

And . . . by hduff · 2013-02-08 04:32 · Score: 1

. . . nothing of value was lost.

--
"I believe in Karma. That means I can do bad things to people all day long and I assume they deserve it." : Dogbert

Facebook is a fun distraction but protect yourself by ohcrapitssteve · 2013-02-08 04:59 · Score: 1

Protecting yourself against weird things Facebook does is actually fairly simple. I sandbox FB in it's own browser. It's all I use Firefox for, that and the occasional browser compatibility test, but I reset cookies/cache/etc before and after. Combine that with a fake name and you're largely safe to post whatever you want. Won't fool, like, law enforcement or whatever if they look specifically at you, but it will confuse whatever automated ad/cross site dossier these companies are compiling on you. I tie it to the dumpster gmail address I use when I know I'm going to get spammed (drop in your biz card, win a free happy hour!) and bam, I don't even think I've ever touched the privacy settings menu.

Re:NOT about hosts ability to BLOCK by UnknownSoldier · 2013-02-08 05:15 · Score: 1

On all my systems I replace hosts with this nice updated ad/spy/trojan blocking one:
http://winhelp2002.mvps.org/hosts.txt

Can fellow /. readers recommend any other good ones?

"Quickly Resolved"...? by InvisibleClergy · 2013-02-08 05:17 · Score: 1

I noticed this several times across a span of 9 hours, from first notice to last notice. I would hardly call that "quick".

Unhappiness and dysgenics by hessian · 2013-02-08 07:03 · Score: 1

I would add unhappy to your list of qualities that make up the bulk of social site users. Many of the people I know who are regular users remain in contact with old flames even though they are now like Al Bundy. Here's to hoping these extra opportunities to procreate don't result in the psychologically healthy being out-bred by this genotypical subset.

I've noticed this as well. People tend to try to "justify" their lives using lifestyle and/or perceived success. For example, a recent survey of Facebook friends found that almost 3/4 of the profile pictures contained either (a) alcohol or (b) children. It's like saying "See what I have, I'm doing quite well."

I don't think that sort of pre-emptive bragging happens when people are actually happy. Instead, as you've observed, there are signs of misery. Lots of scheming and pseudo-romance. It's creepy.

The dysgenic effects will undoubtedly be felt by future generations. It's as if we're breeding humanity into obese deskbound drama queens that know how to look successful on Facebook, but not succeed at real-life things like happiness and fidelity!

--
Futurist Traditionalism

Redirect facebook yourself! by I+AOk · 2013-02-08 10:59 · Score: 1

$ grep facebook /etc/hosts
127.0.0.1 www.facebook.com

--
[iconv --from-code=utf-7]

Deja-vu by capebretonsux · 2013-02-08 11:37 · Score: 1

'For a short period of time, there was a bug that redirected people logging in with Facebook from third party sites to Facebook.com. The issue was quickly resolved, and Login with Facebook is now working as usual.'

Yes. Never mind that gitch in the matrix.

Nothing to do with accounts by Tony+Isaac · 2013-02-08 17:44 · Score: 1

The problem yesterday had nothing to do with sites offloading authentication to Facebook. It was simply sites that have a little Facebook ad--like "what's popular on Facebook." I experienced this yesterday, just looking for a store location--there was a Facebook ad on the page that instantly redirected to Facebook.

Re:Unjustifiable downmods? For my stating FACTS?? by Sardaukar86 · 2013-02-10 01:36 · Score: 1

IF/WHEN the "best you've got" = bogus downmods per my subject-line above on my original post here -> http://it.slashdot.org/comments.pl?sid=3445509&cid=42831677

???

You're making my point above for me, in that you're attempting to HIDE TRUTHS from others that I listed there (& in the link it leads to)!

* Such effete measures as unjustifiable downmods won't work!

(Yes - too bad for you trolls, since most folks here browse well below the default threshhold here on /., & thus, will see my post & what it extolls to their benefit...)

APK

P.S.=> Thanks for proving my points...

... apk

Oh, poor baby, did we get downmodded and cry about it again? Remember what happened last time you started squealing like a stuck pig about this very subject?

Better add this to your list of failures, or you'll lose your place as #1 fruitcake on Slashdot, APK (is that A Pernicious Kook?)

--
..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?

Re:Ghostery = Advertiser owned by Sardaukar86 · 2013-02-10 01:50 · Score: 1

Per my subject above: They're "foxes guard the henhouse" -> http://it.slashdot.org/comments.pl?sid=3445509&cid=42831613 so you'd have to be a real 'cluck' to use them (pun intended) & AdBlock? Crippled by default & NO LONGER BLOCKS ALL ADS either!

APK

P.S.=> Just some "FYI" that has concrete solid undeniable & verifiable backing from reputable sources in the link above...

... apk

Wow, some more true wisdom from APK, Bringer Of All Knowledge. Wicked pun there, I see your LITERARY WIT OUTSHINES ALL who precede you. Nice of you to point out the pun, though, as the less astute reader might have missed it & lived the rest of their poor, miserable lives BEREFT of your marvellous HUMOUR. I think we all agree that would be a => crying shame.

???

Now, what IS a crying shame is that it looks like you got modded down again my friend. I'm so sorry to see such a travesty visited upon you, it fairly breaks my heart, because as we all know, the whole world is wrong and APK is a GENIUS, genius I tell you. Hmm, almost forgot to add -> an unnecessary link to the post above: http://it.slashdot.org/comments.pl?sid=3445509&cid=42831677

I'd suggest that now is an appropriate moment to post your list again, as this PROVES how amazingly cool you are and how everyone on Slashdot thinks you're totally awesome!

Maybe I better do it for you: sArDaUkAr86 gets the UtTeR DuStInG (did I do that right?) & Has To Eat His Words with The Bitter Taste Of Self Defeat against APK The Mighty Wielder Of Logic And Rational Argument => http://slashdot.org/comments.pl?sid=3417867&cid=42771049

--
..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?

Re:AdBlock & Ghostery = inferior to hosts by Sardaukar86 · 2013-02-10 01:54 · Score: 1

Did you notice the down-mod on this as well?

Still care to claim your superiority? Note that I don't get downmodded when I post, but you do. What does that say about you? Oh, yes - of course, it says that you Utterly Dusted me. In your nutty little world, I think you really believe it to be true.

Get the hint: you have nothing useful to contribute to Slashdot, so stop acting like such a fucking arsehole. Slink off and learn something about interacting with other humans before you open your fat yap again.

Don't forget to post your list again, yes - the one that proves you are Teh AweSoME - to conclude my argument for me by showing yourself up as an ignorant fool, a fifty-year-old man with the mind of a snotty brat of a child.

--
..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?

Re:NOT about hosts ability to BLOCK by Sardaukar86 · 2013-02-10 01:57 · Score: 1

Once again you fail, your argument is repetitious and annoying (regardless of their technical merit). Everyone who has responded to you so far has been modded up; you have not. Do you still choose to see this as evidence to you of your awesomity?

Face it, APK, people aren't interested in what you have to say. They don't care that you might be right; they've correctly determined that reading your posts is a waste of their time.

--
..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?

Re:Amazing they're all down-modded too, eh? by Sardaukar86 · 2013-02-10 01:59 · Score: 1

"Now - I truly KNOW this post will no doubt be downmodded, because Advertisers do NOT want this type of information getting out en-masse to enlighten users - they bought out Ghostery, crippled Adblock, but TRY THAT with a local hosts file (good luck!) especially one a user builds himself!" - Myself, FROM -> http://it.slashdot.org/comments.pl?sid=3445509&cid=42831613 AND FROM -> http://it.slashdot.org/comments.pl?sid=3445509&cid=42831729

Making my "predictions" come true in BOTH posts, just as I said they would be... & more importantly, why I suspect WHY as well!

APK

P.S.=>

"I just wanted to say that these posts are amazing. I thought everyone that knew what they were talking about left slashdot long ago. It's been years since I read a comment that made me go and learn more, or that challenged long held assumptions. In short...thank you." - by Anonymous Coward on Saturday February 09, @02:16AM (#42841687)

You're welcome, & glad you liked them!

However - It seems that the advertisers (no doubt), & others that downmodded my posts (see links above in the 1st quote of myself), didn't!

"Gee, I wonder WHY?"... (lol, NOT!).

Perhaps since they told the truth with backing verifiable & undeniable data from reputable sources?

... apk

You pathetic prick, why don't you get some more AC accounts to 'back you up'? You've done it so often in the past. It's not surprising for you to be using this tactic once again.

Face it, APK, you are nothing and nobody gives a shit what you have to say.

--
..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?

Re:Justify the downmod of my post validly, trolls by Sardaukar86 · 2013-02-10 02:01 · Score: 1

Waaaah! Waaaah!

APK: My whiny post got modded down just as it deserved!

Better call the WAAAAAmbulance, we've got a real crybaby on our hands this time!

--
..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?

Re:Justify the downmod of my post validly, trolls by Sardaukar86 · 2013-02-10 02:03 · Score: 1

lol, a "Run, Forrest: RUN!!!" evasion & you're left "EATING MY DUST" in the end

You're a real treasure-trove, aren't you APK? Yeah, you totally smoked them, they're EATING YOUR DUST as we speak, they're cursing your name, FOILED by that wily APK!!

What a villain you are, what a dastardly foe to come up against! Oh noes, how will we ever defend ourselves from the master of the pen?

--
..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?

Re:Custom hosts = Superior to AdBlock by Sardaukar86 · 2013-02-10 02:05 · Score: 1

"It's as strong as steel, & a 3rd of the weight" - Howard Stark from the film "Captain America"

Jesus Christ, I don't think I've seen a more retarded post all year. How fucking immature are you, Captain APK?

You are a fifty year old man for goodness sake, look at the drivel you are posting! This is just pathetic. When are you going to grow up, manchild?

--
..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?

Re:Unjustifiable downmod? A challenge then! by Sardaukar86 · 2013-02-10 02:06 · Score: 1

Waaaaah! Waaaah!

Hint: you got downmodded because your post was FUCKING TERRIBLE. Is that so hard to understand?

Prove you are mentally ill APK! Claim this is a conspiracy to BURY your TRUTH from the world.

Oh.. wait.. you already did.

--
..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?

Re:AdBlock fanboys *trying* to "hide" these? by Sardaukar86 · 2013-02-10 02:07 · Score: 1

Not Adblock fans, fuckwit, people who are FED UP WITH YOUR SHITTY POSTS! When are you going to wake up, you fucking stupid cunt?

--
..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?

Re:AdBlock fanboys *trying* to "hide" these? by Sardaukar86 · 2013-02-10 02:09 · Score: 1

Which, of course, PROVES YOU CAN'T DISPROVE MY POINTS, & instead opt to attempt to hide them from others!

... apk

No, fuckwit, you are the one who can't disprove points. You run from them, in exactly the same manner you like to accuse others of.

You suck.

--
..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?

Re:AdBlock "fans" reduced to unjust downmods? by Sardaukar86 · 2013-02-10 02:10 · Score: 1

Waaaah! Waaah!

APK: People think I suck! Waaah! Waaah!

Yup, they do. Who do you have to blame, arsehole?

That's right! Somebody else!

--
..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?

Re:AdBlock/Ghostery/DNS "fans" FAIL vs. hosts by Sardaukar86 · 2013-02-10 02:11 · Score: 1

APK: Blubber blubber! Waaah Waaah! I can't believe anyone would dispute APK as Master Of The Universe! Waaah! Waaah!

I want my 'mommy'!

--
..Mullah or Pope, Preacher or Poet, who was it wrote: "Give any one species too much rope and they'll fuck it up"?

Slashdot Mirror

Facebook Breaks Major Websites With Redirection Bug

121 of 179 comments (clear)