Facebook gonna Facebook. It's long past time to consider regulation of an ethically bankrupt corporation.

"four months ago" they stopped requiring it for 2FA, that's the time GDPR came in.

I wonder if Facebook acts differently for European users?

No regulation needed, just avoid using their 'services' and block anything facebook at the point of access. They might keep 'shadow profiles' and use facial recognition to find you on images posted by others but if you keep them out of your network they can have a ball trying to target their advertising at that closed door.

Not that I allow any advertising here, mind you - everything is blocked at the router (ipset [1] comes in handy here), at the client and in the browser. This works at home as well as abroad since I route all my data through a VPN (OpenVPN) terminating at my router.

[1] http://ipset.netfilter.org

Then it definitely sounds like regulation is required, the vast majority of Facebook's users don't know how to do all that. The public should not have to protect themselves from unethical companies, the companies should have to stop with their unethical behavior lest the government shuts them down.

Drawn to its logical extreme, you don't need regulation to be protected from racketeering if you run a restaurant either, you can just hire private security and arm yourself.

It would be really surprising if that was a facebook only thing. For starters Google pesters me at least as much to add my phone number to secure my account.

I think it will stop pestering you for a phone number if you give it some neutral second factor like a Security Key ?

(Security Keys are actually way more anonymous than I'd even thought possible until I understood how they work, if you know Susie uses the same key for DropBox and GitHub, and you suspect Susie also uses this key for the account NumberOneSecretTrumpFan on GitHub, and then you steal all the account credentials from GitHub somehow, this doesn't end up being enough to verify that Susie has the same key as NumberOneSecretTrumpFan, nor is it enough to sign into Susie's DropBox account, and unless GitHub's data includes the backup passphrases or whatever it's not even enough to sign into GitHub as Susie, NumberOneSecretTrumpFan, or any other Security Key user...)

I'm not sure how it is now, but for a long time Google required you to enable SMS auth (by giving your phone number) before you could enable TOTP or other 2FA methods.

you generally don't regulate companies, but whole industries. Then you punish companies for breaking the industry regulations.

Users cannot "just quit". Facebook probably has a profile for my grandma who never touched a PC in her whole life.

Many people can't quit because they are addicted, but there is an option to permanently delete your account and it takes about 5min. I'm not aware of Facebook creating profiles for people that haven't signed up for their service. If so, that should definitely be illegal.

The government should have bigger fish to fry than trying to regulate the distribution of information that you have and continue to willingly provide to a company. If you don't like it, sure government could jump in and make Facebook just how you like it, or you could delete the info you don't want them to have. The later sounds easier on everyone.

Why have costly government regulation when people can just not breathe polluted air?

There are some things users/people did not sign up for and cannot (reasonably) opt out of that still harm them. This is what regulations are for.

Air is a necessity, Facebook is not. I don't use Facebook and personally don't want my tax dollars spent overseeing a non-essential service. I'd rather send our tax dollars towards environmental pollution and areas that actually affect us all much more seriously.

The point wasn't that Facebook is a necessity. It's that Facebook is unavoidable.

Unfortunately, whether you created a profile or not, you can't just "not use Facebook" with their whole shadow profiles.

Sure, they aren't (currently) pumping waste into the environment. I'm not saying those things aren't important, but I do think we're going to look back 10 years from now and wonder how we let Facebook even get this bad.

This is ridiculous. It's 2018 and you're complaining about a few MB of bandwidth and a few seconds of CPU time? The whole point of JWT is that they are basically cookies for places where using cookies uniformly is not feasible. The author's solution is to go back to using cookies, which just doesn't work well enough. I'll stick with tokens for now thanks.

> ...a few MB of bandwidth and a few seconds of CPU time

Many people are on cell phones with low data limits. A "few MB", let's say 3MB == a few, represents 0.1% of someone's data limit. Sure, it's not that much on its own, but it adds up.

Likewise, a few seconds of CPU time is fine if you're on the latest iPhone, but if you're in a developing country on an inexpensive Android phone that few seconds of CPU time is going to turn into a world of hurt.

This cavalier attitude towards bandwidth and CPU time is outright hostile to certain classes of users.

The article mentions 100k page views being ~24MB extra a month, which means we are talking about a token of ~240 bytes. So for a single user you are talking about several kilobytes if they are multiple views to the server, which is now several orders of magnitude less than your original estimate.

For this single thing, this is not a big deal at all.

I was objecting to the "It's 2018 and you're complaining about a few MB of bandwidth and a few seconds of CPU time?" statement, not the technical detail of JWT adding an extra ~240 bytes.

I've seen statements similar to this applied to everything from big JavaScript libraries to large "Hero Images" to 2MB GIFs embedded in pages. It's a poor argument and it's representative of an attitude that's hostile to users.

The problem is you are talking about a different problem than the OP. The OP was talking about a few MB and CPU _from the server's perspective_, while you are talking about a few MB and CPU _from the client's perspective_. Yes it would be bad to willy-nilly force clients to take on a few MB per request, but that's not the issue being talked about.

This. Often I've had discussions about APIs that take 100ms or more to return a result where the person writing the API and even the product manager do not understand that this response time is likely too long. Going back to the 1960's and the PLATO system, engineers recognized that humans need a response in 500ms or less whether visual, audio, or haptic, to inform them that the system received the input. Therefore, to give a user that same 500ms response time today across the Internet, not just across the room to the mainframe, requires understand the entire latency chain. One approach is to consider that any interaction has a 500ms budget which cannot be exceeded and then start subtracting out the various latency components. Round trip time across the USA, 150ms. DNS, Connect, HTTPS negotiation, TCP setup, etc.. 25ms. Suddenly your down to to 300ms of remaining budget. Lets assume that 5 service API calls need to be made internally to provide the response, 300 / 5 = 60ms avg budget per API call. I'm going to tell you that with today's CPU/RAM/SSD speeds, 60ms is a huge amount of computing time for a reasonable request.

tl;dr, remember the 500ms overall budget for the humans at the end of the pipeline. No one anywhere said I want my response time slower.

1/3rd a kilobyte to the user per page request. The MB and CPU time are to your server. Over the entire month. I'll pay that penny.

> It's 2018 and you're complaining about a few MB of bandwidth

Ah, yes, 2018, the Year Where Everything On The Internet Is Connected To A Cable.

It's 298 bytes per page request given the example he gives (your token can be smaller or larger depending on the data in it).

It's 24 MB of bandwidth to the -server-. Your server -better- be behind a decent broadband connection, or what are you even doing?

1/3rd a kilobyte per page request to the -client-. 1/3rd a kb is a blink of an eye even on modern dialup.

Why do you think it has to go skyrocket forever?! I am already really disgusted by how big applications are nowadays, how bloated, slow, memory-hungry and inefficient they are. Every saved MB counts.

In this case the article is talking about 24 MB of additional bandwidth used by the server to serve 100k pageviews using JWTS

It's worth noting that in complex systems, forgetting can be just as important as remembering. The ability to evolve and change is in part predicated on the ability to selectively forget some elements that are no longer helpful. As another commenter pointed out, some aspects of our society's cultural memory are, probably, best left in the past, if preserved at all.

Knowing what should be forgotten requires either foreknowledge of the future or relies on inaccurate predictions based on current assumptions. Thus the less information of uncertain usefulness that is retained, the more that those assumptions dictate what will be considered useful in the future without having to rediscover things entirely. That limits adaptability. Just try to imagine how many things were invented in the past that weren't seen as useful at the time and had to be rediscovered later. How many ideas were lost in the Dark Ages, for instance, because they offended religious sensibility at the time? If there is capacity to retain information in an organized way without undue cost, it should be retained as a hedge against future uncertainty. No single generation of humans should be trusted to make such decisions without being unduly influenced by the biases of their time.

You can commit most crimes in this world with relative impunity, but the number one rule is never steal from the rich.

"Lying about deals with the same government that will eventually prosecute you" seems like another pretty obvious rule.

Claiming you have contracts signed when you don't is fraud, but claiming you have $100M in DoD revenue when you don't is elaborate corporate suicide.

I have seen this idea from time to time. I don't think it's right. The problem is they are stealing from people with abilities, smarts, and resources. Of course, there are going to be backlashes.

I'm all for this train, but if it costs this much to build and even more to maintain, and it's not even the newest train technologies, then it's probably just doomed to fail.

Oh good. I just finished upgrading my project to Webpack 3. Can't wait to do it all again...

I'm all for rapid progress, but the pace of web development is absolutely breakneck.

There are other options that requires no config.

It's so normal that I'm actively looking for a new career. I'm tired of being paid to write and maintain garbage code for garbage people.

You're not special yourself. People think same about you and your code.

It's not a zero-day exploit.

There's no way of knowing if this was exploited in the wild before it was discovered and mitigated. If it was, then it was a zero-day exploit.

By this logic, all exploits for publicly released software, patched or unpatched, could be zero-day exploits. That would make the term rather meaningless, IMHO.

Remote / California, USA | Part-time / Retainer

I am looking for a front-end developer working consistent part-time hours or on retainer for some up and coming web application projects. The primary skill set includes HTML, JavaScript, CSS, React, with responsive and mobile-friendly web design. Full stack skills and/or React Native and mobile development skills would be helpful, but are not required. You should be able to operate without full designs, and indeed we would be looking to you for best practices in the design and layout of webpages.

The initial trial period would involve some small improvements to existing websites, and eventually ramping up to 5-10 hours per week and including some brand new applications. Our basic development process would involve you interacting with us on Slack and GitHub, completing tasks and communicating progress as you go. Feel free to maintain a flexible schedule with little-to-no overlap with our California timezone. We can also pay you in Bitcoin, if you'd prefer. :)

Contact me (Benjamin) for more information: blouis AT unquietcode.com