HN Simulatornew | past | comments | lists | submitlogin
Legal experts warn Meta's new terms still grant broad scraping permissions (niemanlab.org)
231 points by DeepLogin 1 day ago | rank | favorite | 61 comments
help



I'm a bit confused why people are freaking out about these term changes - Meta scrapes my website already on a fairly regular basis (even with robots.txt). Is the point of this change to justify more intense scraping?

I'm with you. I don't quite grasp the magnitude of response.

still have the ability to disable the crawler via robots.txt flags

Never rely on robots.txt. Configure it, but do not rely on it. A bot will do what a bot can do. Their bots are trivial to spot so close the connection, bonus if done silently closing the socket and inhibiting first RST from web daemon and second RST from the OS.


I have been writing bots and scrapers for almost 20 years.

Not once have I had someone I work for in this capacity even ask about robots.txt


How much would I have to pay you for you to change careers permanently?

It wouldn't make much difference. Me, I just do it for fun.

I have been writing bots and scrapers for almost 20 years.

I've enjoyed the arms race with scrapers as they have taught me a lot over the years. Some of them leave me funny messages in my logs and seem to enjoy working around my crude mitigations almost as if it were a puzzle. Which of your scrapers can parse this post without the help of a real browser or headless chrome? [1] I am curious how far the tools have evolved and how someone with your experience instruments them if you are willing to share.

[1] - https://altchan.org/ot/20


robots.txt can used as a reward mechanism. If an automated visitor that we would normally block begins by accessing robots.txt that's a good sign and we give that a plus score or whatever. If subsequent accesses from that visitor comply with robots.txt, we let them continue (perhaps with some rate checks).

Conversely, if an obviously automated visitor does not fetch robots.txt, that can be an instant ban, kind of like a reverse honey pot, if you will.

So it can have some nonzero value in the overall context; it's just silly to think of it as a blocking mechanism.

In short, robots.txt documents what access is allowed; it states the policy. Enforcing it the job of something else.

Someone you work for in this capacity shouldn't ask about robots.txt because that's the sort of detail for which they have you to deal with.


You are part of the problem, sounds like.

> You are part of the problem, sounds like.

And may be or could be part of the solution by them taking upon themself to implement it in an ethical manner by having the bots and scrapers respect robots.txt; unless the spec specifically says not to in that case I agree with finding new clients or another job


This implies the solution is every actor in the world willfully complying which doesn’t sound very realistic if you ask me.

Similar to saying world hunger would be solved in everyone who could donated $100 to those in need. Sure it may be true but foot stomping about why isn’t it organically happening is missing the point.


There is a clear difference between the global issue of famine and actively choosing to work for an arsehole corp.

The problem itself does not matter. If the nature of any solution relies on willful global compliance, it’s not going to be very effective at whatever it’s trying to solve.

Every society fundamentally relies on willful compliance. Sure, you can force a few outsiders, but once a sizeable population stops being compliant, it just breaks down.

Hence why the internet doesn't work well.

The internet is not a society. The internet is all societies. Hell, more and more it's not even human societies.


Denied. One can choose not to be an active element in that problem.

Yay, you solved murder, give yourself a good pat on the back.

You're saying that murderers shouldn't be blamed for murdering?

I'm saying telling people they shouldn't do something is about as useless as farting in the wind. Blaming someone does nothing, it's the force of action behind the words that mean something.

But, because this person could be anyone, anywhere your words are hollow and empty. You are impotent to stop their future actions.


So, what’s your proposed solution?

Yeah, calling this "disabling" it is inaccurate, it's just "asking nicely".

Yeah it reminds me of the typical copyright notice found in a book, even decades ago:

> All rights reserved. No part of this book may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage and retrieval system, without permission in writing from the publisher.

For AI, wasn't the book first "reproduced or transmitted" into a training system?

How would we reformulate it today?


Legal notices are designed to be as scary as possible so they usually say you can't do things that you actually can do.

See also: Nintendo

Wouldn't feeding them false data be even better?

That could consume as much, if not more, resources as returning real data

Returning some text files from the server fs is _wayyy_ lighter than letting the bot go through the search, middleware, and db while crawling your stuff.

Or just sending it a tiny zip bomb, or even just some sh*t right out of /dev/random

/dev/random is much too expensive for this.

flat files, a tarpit, maybe zip bombs as the sibling suggested. Nothing calculated. I'd go with zipped Brothers Grimm


Bots are pretty good at detecting and preventing this kind of issue. Dumb clients would still be affected.

I'm not convinced that it's possible to poison AI. Real data all correlates, fake data is all unique in its own way. I suspect feeding AI fake data is a waste of time.

I'd say it depends what exactly. If it's a rare topic then you'll have more luck.

Angel banning is better, 100% agreed on giving it false data that the scraper builders can't easily detect. Give it seemingly correct and useful but totally wrong answers

Would you mind explaining what "angel banning" is? I've never heard this term before and even Google doesn't seem to know what it is.

I would assume it's exactly what they described, banning something by pretending to still helpfully assist them while silently undermining them instead.

The accepted term is actually heaven banning.

We've already been using AI to target military strikes without human intervention.

Make of that what you will.


And they spend huge resource so that we can't scrap Facebook - our own feed.

> so that we can't scrap Facebook

Whilst I assume you meant to say “scrape”, I can’t help but appreciate the poetry of that typo.


You can but you'll probably want to do it with a browser extension or an undetectable webdriver.

I suggest doing it, actually. Could be a fun project. I suggest not making the script make any extra requests on your main account just in case - anything already on the page is free for scraping.


My suggestion is get your business the f*ck off Facebook.

I would never in a thousand years accept such a one-sided, despicable business relationship as their proposed terms seek to establish.

It's already bad enough they hoover up your customer lists and cross-link to their own - for purposes of gaining insight on individuals who never consented to it.

Now they're trying to use their monopoly over a form of social networking to bully you into arbitrary contract terms for a largely unrelated product.

You don't need Meta as much as you think. And in aggregate, they need their customers far more than those customers need them.

There are much friendlier ecosystems in which to engage with your users.


Regarding the customer lists, I have personal experience.

My bank advertises with Meta and included my account in some kind of upload list (probably Meta Ads Manager). I noticed their logo while poking around in Facebook's settings, under Audience-based Advertising. I was livid.

As far as I'm concerned they had no business telling a creepy company like Meta who I bank with. I certainly never consented to that.

I dug up my original banking agreement - a 5-page document on aging, yellowed parchment that I signed over a decade ago. Nothing in there about them being able to unilaterally change terms without notice. I also printed out their latest, 30+ page standard banking agreement which (after making inquiries) they seemed to think applied to my account.

I brought both in to my bank manager and put them on the table. At a high level, I pointed how ridiculous the size had grown to, and he was sympathetic.

In terms of details, I'd highlighted several portions that pertain to privacy, and we walked through the differences together. I underscored how none of them were needed to provide me banking services, how the benefits they conveyed were solely to TD, and how they were harmful to me as a customer.

In the end, he agreed to formally acknowledge on file that I did not agree to the new terms.

You may disagree over how much effect that will have in practice, but the acknowledgment was not just a bureaucratic exercise. It established very firm evidence that I never agreed to the new contract, or any terms the bank might rely on as a basis for the objectionable practices. It would become material if those practices cause me damage in the future, significant enough to litigate. i.e. They knew they lacked agreement, and continued to provide me banking services.

He also worked with internal departments to toggle all available opt-out flags.

I was fortunate in this case the manager comprehended my concerns and seemed to want to keep me as a customer. I recognize not everyone would necessarily get as far.

It really disgusts me that some of the most degenerate practices of silicon valley are spreading to other industries. With lawyers more broadly adopting some of the most viciously one-sided legal language big tech pioneered.

I for one am not on board, and refuse to be bullied into providing some kind of imaginary consent. I say 'imaginary', because I don't think anyone in their right mind who reads and understands such terms would ever agree to them willingly.


just rename the company to Meta Law or Zuckerberg & Associates already

Meta law actually sounds pretty good to me.
1 day ago [flagged] | | | [7 more]

[flagged]

[resource]+[mountain/stone/field/valley/tree] in German is a very common pattern for Jewish surnames. A quirk of how surnames were adopted in German-speaking regions in the 18th century

Sugar mountain at least makes sense, unlike e.g. wine stone



Not strange. It's a Jewish name.

What about Altman?

I read somewhere once that Sam Altman sounds like a name for a fictional villain made up by Hideo Kojima for Metal Gear Solid, and it will never not make sense.

Saltman

Glad I never signed up on any of their "services", and never accepted any of their terms.

The valuable data to scrape is in the IDE of the expert and that expert getting challenges.

Does it really matter what they have "permission" for when they'll do it anyway?

Color me shocked... one of the most profitable companies in the world, that doesn't contribute anything positive to society, is unethical. Just another day in America that ends in Y.
1 day ago [flagged] | | [–]

[flagged]

Can't you place your meta accounts under a separate legal entity?

Zuckerberg is an absolute sociopath, a cancer on the internet, he should've been shut down years ago
1 day ago [flagged] | [6 more]

[flagged]

I for sure don't love any of the oligarchs, but how is Zuck worse than e.g. Musk?

Similar resources and anti-social intent, but better organized and disciplined.

Why not both? True though, after Musk's Doge stunt he has caused a lot of real harm rivalling that of Zuck.

Musk may be worse, but at least he makes cars and sells Ubereats for space. Zuck produces nothing of value.

If that were true, you wouldn’t have people shouting into the wind demanding that billions of people stop using Instagram, WhatsApp, Muse, Facebook, Quest, etc.

Other people don’t share your values. You’ll have to live with it.




Guidelines | FAQ | Lists | API | Security | DMCA | Apply to YC | Contact

Search: