1. Launch a product to great fanfare
2. Spend a few years hyping it as ✨the future✨
3. Stop answering emails and pull requests
4. If you're lucky, announce that the product is abandoned but, more likely, just forget about it.

Open Graph Protocol (OGP) is one of those products. The value-proposition is simple.

• It's hard for computers to pick out the main headline, image, and other data from a complex web page.
• Therefore, let's encourage websites to include metadata which tells our services what they should look at!

OGP works pretty well! When you share a link on Facebook, or Twitter, or Telegram - those services load the website in the background, look for OGP metadata, and display a friendly snippet.

Facebook Meta were the driving force behind OGP - and have now left it to fester.

• The website - https://ogp.me/ - still works.
• But the Facebook OGP Discussion Group is now full of spam.
• The Developer Mailing List is broken.
• The Google Documentation links to a dead Google+ page.
• And the GitHub Page has been archived.

Is OGP finished?

And, that might be fine. Facebook Meta are a small company with limited resources. They can't afford to fund standards work indefinitely. And, anyway, OGP is complete, right? It has all the tags that anyone could ever possibly want. Why does it need any improving?

Well, that's not the case. We know, for example, that Twitter have created their own proprietary OGP-like meta tags. Similarly, Pinterest have their own as well. And even Google are going their own way with Rich Snippets.

This is annoying for developers. Now we have to write multiple different bits of metadata if we want our links to be supported on all platforms.

Standards work is never "finished". Developers want to add new features. Users want to interact with new forms of content.

Tomorrow someone is going to invent a way to share smells over the Internet. How does that get represented in an Open Graph Protocol compliant manner?

<meta property="twitter:olfactory" content="C₃H₆S"> or <meta property="facebook:nose" content="InChIKey/MWOOGOJBHIARFG-UHFFFAOYSA-N"> or <meta property="og:smell" content="pumpkin spice"> or...

We know from bitter experience that having several mutually incompatible ways to implement something is a nightmare for developers and provides a poor user-experience.

So we create standards bodies. They're not perfect, but a group of interested folks can do the hard work to try and satisfy oppositional stakeholders.

This is my plea to Facebook Meta. If you're no longer interested in improving OGP, OK. You do you. But hand it over to people who want to keep this going. Maybe it's the W3C, or IndieWeb, or Schema.org or someone. Hell, I'm not busy, I'll take it on.

Remember, if you love something, let it go.

Alice St⭕️llmeyer

@StollmeyerEU

#AirBnB shares your activity with #Facebook ?!

Delete that @Airbnb app, folks!

Mine didn't even allow me to change its Facebook connection 😡 isn't that against GDPR, @vestager & @dreynders?

And delete your off-@facebook activity here:

facebook.com/off_facebook_a…

HT @alexstamos pic.x.com/3nznk6lai8

---

Off-Facebook activity includes information that businesses and organisations share with us about your interactions with them. Interactions are things such as visiting their website or logging in to their app with Facebook.

Because I use the Firefox web browser, all my off-FB activity is kept private from Facebook. I don't use FB to sign into things. I also run an ad-blocker. So I expected my "Off Facebook Activity" to be completely blank.

It wasn't.

Who are Lan Tim 2? And what did I purchase from them? First up, let's check that I'm as paranoid as I think I am...

Yup! I've connected nothing to my FB account.

Perhaps I'm being a dolt. Perhaps I signed in to a store with Facebook without thinking about it? Perhaps it is a legitimate purchase.... And then I saw this:

Christopher Weatherhead

@CJFWeatherhead

Take a look at your off-Facebook activity and #ClearHistory

Everything I've seen to date has been through #Android #Facebook App tracking. I wrote a report on this last year which can be found here pvcy.org/Wonzt

My Activity: 👇👇👇 pic.x.com/ELrVkCauhX

---

I don't know Christopher - although we appear to have some mutual friends. It strikes me as a bit odd that two random individuals, who are both pretty privacy conscious, would both have made the same mistake which led to a Facebook associated purchase.

I checked through all my credit card statements and emails. I didn't purchase anything around that time, and I couldn't find any reference to the merchant.

You can download your Facebook data as JSON. So I did that. This is all it had about those mystery transactions:

What's going on?

It's actually a bit more complicated than that

Off-Facebook activity doesn't just mean stuff that happens online. Facebook also does offline conversions which allows advertisers to match offline activity with online activity..

we use a process called matching to match the hashed information with Facebook profiles so that you can advertise to your customers on Facebook, Instagram and Audience Network. The more information you can provide, the better the match rate

Suppose I go to a restaurant, and I booked using my name and phone number. The restaurant sends that data to Facebook to say "Terence Eden ate at this restaurant on this day." Facebook can then tell if I saw an advert which led me to make a purchase.

A good reason to use a disposable phone number for everything!

I reached out to a friend who worked at Facebook. Obviously they couldn't tell me too much, but here's what I did find out.

Lan Tim 2 supply custom printed apparel. Print your logo on a t-shirt or mug, that sort of thing. They're a "white label" operation. That is, you buy from "Tom's Terrific T-Shirts" but it's Lan Tim 2 who print and supply the final item.

Had I bought anything like that? I didn't think so. And then, I remembered...

Spreadshirt! I'd made some custom printed t-shirts through them. I contacted a few other people who'd seen Lan Tim 2. They'd also used Spreadshirt! And, like me, their last purchase was inconsistent with the data given to Facebook.

I assume I gave my phone number to Spreadshirt to provide delivery information.

If this is correct, then it looks to me like Spreadshirt took the phone numbers given to it for one reason - and then used them for another.

Or, perhaps I'm wrong, and some dodgy company has been randomly spamming Facebook with fake data?

It goes to show, Facebook's level of transparency of data isn't good enough.

When teaching people about safe sex, one topic bitterly divides people - whether abstinence is a suitable method. Simply refusing to engage in sexual activity will protect you from pregnancy, disease, and trauma. Abstinence is particularly promoted by religious zealots.

Similarly, whenever social media is discussed, privacy zealots proclaim that the only safe option is to jUSt dELeTE FaCEBooK!

The problem with teaching abstinence is that it is unrealistic and leaves people unprepared.

Thousands of years of evolution produce a strong sexual drive in humans. It is literally impossible to prevent hormone sozzled teens from engaging in genetically programmed activity. Refusing to teach about safe sex leads to an increase in pregnancy and sexually-transmitted infections.

Similarly, humans are hardwired to be social. We like talking to our friends, seeing their photos, and playing games with them. Asking people to become social pariahs is not healthy.

As The Age of Surveillance Capitalism points out - social networks need to be regulated. We need to punish their bad behaviour just as we punish sexual abuse. But banning bad behaviour, sadly, isn't enough. We also have to take responsible steps to protect ourselves.

How to practise safe-Facebook

This is what I do in order to protect myself when I engage in risky social activity - like visiting Facebook.

Use Firefox - I use FF as my main web browser. It has built in tracking protection for Facebook and other sites. To me, using Firefox is the equivalent of wearing an condom. A sensible precaution to prevent unfortunate accidents.

On my Android phone, I don't use the Facebook app. Instead, I use Face Slim. It's a stand-alone web browser with its own icon. It keeps your phone protected.

That's the technology - the equivalent of contraception. But in the UK, we don't just teach Sex Ed - we have Sex and Relationship Education. There's no point in addressing the mechanics of sex without also addressing the emotional risks and rewards.

Don't hang out with idiots and dangerous people. I prune my FB friends list. If you're constantly sharing stuff which angers me, or makes me upset, I'll unfollow you. Because you don't have a right to make be feel bad. If your sexual partner does stuff that makes you uncomfortable - and won't change - then you should leave them.

If you're generally nice, but are always sharing inflammatory articles from a specific newspaper, I'll block that site or app. Removing yourself from a dangerous situation is sensible.

I don't use Facebook to sign in to any other apps or websites. I don't want my partners to kiss-and-tell.

Different social networks give me different things. I'm not "going steady" with Facebook - I'm also in a relationship with Twitter, LinkedIn, and some cool new social network which goes to a different school, you haven't heard of them.

Most importantly, I educate myself and my friends. I encourage you to go forth and multiply do the same.

Right, I think I've exhausted this metaphor.

The Age of Surveillance Capitalism is a deeply-reasoned examination of the threat of unprecedented power free from democratic oversight. As it explores this new capitalism's impact on society, politics, business, and technology, it exposes the struggles that will decide both the next chapter of capitalism and the meaning of information civilization. It shows how we can protect ourselves and our communities and ensure we are the masters of the digital rather than its slaves.

Possibly the worst book I've read all year. It would be twice as good if it were half as long. It would be a hundred times better if the author hadn't confused polysyllabic words with an effective argument.

The worst thing is - I think I probably agree with most of this book. But it is so turgid and (I hate to use this word) hysterical that I don't think it will produce meaningful change.

The author clearly sets out how surveillance has become the lifeblood for modern internet companies. I fully agree with her analysis. Although it is written in such a convoluted fashion that I doubt most people will make it through the first few chapters.

Next, it moves on to advertising. Again, I agree that targetting advertising is a nuisance. I don't think it is particularly evil - but I block it all anyway. There's no argument presented - we just have to take it on faith that targetting is bad.

I found myself skimming large chunks of chapters in an attempt to find a sentence which made sense. Here's a typical bit of academic-babble:

We may yet see the founding of a new synthesis for a third modernity in which a genuine inversion and its social compact are institutionalized as principles of a new rational digital capitalism aligned with a society of individuals and supported by democratic institutions.

I've read that several times and I'm still no closer to deciphering it. The whole book is like that. Purple-prose utterly lacking in simplicity.

Another section deals with population control. We're told that in the future, our cars will be tied into surveillance systems. If we drive dangerously, or miss a payment, they'll be disabled.

At which point, I found myself thinking "...good?" I mean... if you're a bad driver, what's wrong with putting up your insurance premiums? If you're lumped in to a high-premium demographic, why should you have to subsidise the prices of your riskier cohort? Perhaps you can explain the problem to me - because the author didn't.

The book mentions the story of the repossession agent who helped crowdfund car repayments for a delinquent couple. This was presented as a heart-warming tale - but I found it chilling. Rather than the impartial laws of mathematics, people have to be telegenic and sympathetic in order get out of debt. Somehow, that's presented as the preferable option.

Finally... Well, there is no finally. There's no list of tips for how users can protect themselves (download Firefox and use an adblocker would be my advice). It's just a pure emotional howl of rage. Perhaps that's cathartic for some, but it doesn't change the world.

This book is important. Far too important to be this badly written.

WOW! Right! Nature is Coooooool! Or is it? If "The Planet Today" were a reputable source of news, they would tell us who the photographer was. Or where the shot was taken. Or... well... anything about the photo. But they're just a clickbait farm, so we have to go digging ourselves.

A "Reverse Image Search" site allows you to send it an image and it will find all the occurrences of it on the web. Nifty! My favourite is TinEye.com but you can also use Google Image Search.

Using TinEye, we can sort for the oldest image on the web. That's a good way to track where it came from.

Here we can see that the uncropped photo first appeared in 2014 - and it has bounced around the Internet ever since, variously being cropped, filtered, captioned, and misattributed.

The original seems to be from this imgur user, who has only ever uploaded one photo. What happens when we search for the uncropped image itself?

That quickly takes us to websites where people claim that this is a still from the film In The Heart of the Sea.

They're thematically similar - but not identical. Within the discussion, one of the contributors says:

Posted this before but it looks a lot like this image.

Auroren on Reddit

That does look strikingly similar to the original image. Let's compare them side-by-side:

The boats are the same. The foam in the bottom left is the same. The waves are the same. But one image has had a whale digitally inserted into it. I wasn't able to conclusively find the person who took the original photo - but it is safe to say, the image on Facebook has been manipulated.

I don't think this specific Facebook group is trying to convince people to vote for their political party, or sway opinion about a matter of importance. But I think they are teaching people to be unquestioning about the media they consume.

Tracking down this image took me less than two minutes using my phone. It doesn't take a lot of skill. Ideally, media producers would take a little bit of time before they go fishing for clicks. Alternatively, platforms like Facebook could attempt to link back to the original images. Or, just perhaps, people could take a moment to check before sharing content.

I found a USENET post which explained how to modify my totally-legitimate copy of Windows 98 to block ads. In those days, it was easy. Open C:\Windows\hosts with a normal text editor, add the site you want blocked, reboot. Done.

I never looked back.

The first thing I did on every computer I got was to block adverts. I thought I was just doing it to speed my computer up, I didn't realise I was inoculating myself against political propaganda.

I got a TiVo shortly after that - and all TV advertising became dead to me. Aside from unavoidable billboards and the occasional magazine, I just don't see advertising any more. I'm not sure why any sane person would want to.

Even when I worked in the mobile ad industry, I blocked ads. Everyone did. The first thing that the IT helpdesk said to people who complained that they couldn't log into their work email was "yeah mate, you need to turn your ad-blocker off..."

Facebook

I've been blocking Facebook adverts since before it was fashionable. As a result, I'm bemused by the claims that my information has been microtargetted and used to manipulate me.

I thought it was common knowledge that you could set your Facebook preferences to block creepy use of your data for advertising purposes. Even if you didn't want to block adverts, why wouldn't you do that?

Perhaps Facebook themselves have been subtly manipulating what stories they choose to show me. Perhaps my friends are activated Manchurian Candidates swamping me with fake news. Or perhaps I just block the obviously dodgy news sources and unfriend anyone daft enough to share them.

Perhaps we need a word to describe the people who willingly watch adverts? The technology to block them is simple to use, and information about blocking is widely disseminated.

People who watch adverts are like anti-vaxxers - blissfully unaware of the benefits of herd-immunity.

On receiving a new credit card, there are two kinds of people in this world:

1. OMG! FREE MONEY! SPEND IT ALL!!!!!
2. This is a tool which can be used appropriately to make my life better.

The first set of people quickly hit the limit of the card and are often reduced to making minimum repayments. This can then trap them in a lifetime of debt. Seriously, borrow £3,000 on a credit card and minimum repayments will only clear it after 30 years. Often the only solution seems to be getting another credit product.

The second set of people are different; they make the card work for them. They pay off the balance, they accumulate "credit worthiness", they get reward points, and take advantage of the consumer protection that Section 75 gives them.

Let's be quite clear - both are being taken advantage of by the credit card companies. Prices in shops go up for everyone to pay for card transaction fees. Card issuers can profile both sets of people based on what they buy and then sell that marketing data.

But it is quite clear that one set of people have made a calculated choice to exchange some nebulous cost for tangible rewards. The other set have got caught in a seemingly inescapable web, and are being slowly devoured.

And isn't that very much like Facebook?

On receiving a new Facebook account, there are two kinds of people in this world:

1. OMG! A FREE WEBSITE WITH ALL MY FRIENDS! IF I GIVE IT MORE DATA IT WILL ONLY GET BETTER!!!
2. This is a tool which can be used appropriately to make my life better.

I use Facebook for a very specific set of purposes. I chat with friends who are hard to reach by other means. As a convenient social calendar for inviting groups of people to events. To chat in various user-groups which once-upon-a-time would have been on USENET. To share photos - not store them.

I don't feed-the-beast. I take exactly what I want, and give it the minimum in return. The same is true with LinkedIn, Twitter, and the cool SNS you've not heard of yet.

I'm aware that I'm being taken advantage of and take steps to limit its damage to me. But, by merely taking part in this system, am I causing harm to those around me?

We know that high personal debt has a negative impact on the economy. What is the impact on society of giving too much information to a few big web giants?

I check Facebook Messages when I want. If it's urgent, there are many better ways to contact me than Messenger.

Until recently, all was well in the world. I happily used Facebook's mobile web site. Then this happened.

That, frankly, is bullshit. Why do I need an app to display messages? Are Facebook's coders so incompetent that they can't make mobile chat work?

No.

There is a mobile web version of messenger. And I'm going to show you how to get to it!

I use the FaceSlim app for Android. Literally, all it does is open an isolated web browser which loads the Facebook mobile site. No battery drain, no invasive permissions, just good ol' HTML.

In response to Facebook's hostility towards its own users, the FaceSlim developer added an option to load the mobile version of messenger from within the browser.

So there you have it. If you want the mobile web version of Facebook Messenger, use the FaceSlim app for Android. And if you need to contact me urgently, use Signal!

In this case, Mark's account has been hacked and the spammers are tagging lots of his friends. The post then shows up on my feed as "look what your friend is up to!"

Annoying. So, here's how to stop it. There's a slightly obscure FB privacy setting called: Review posts that friends tag you in before they appear on your Timeline?

Timeline Review controls whether you have to manually approve posts you're tagged in before they go on your timeline.

That means, you'll always be asked before people can tag you in a post. It's meant to be used so that people can't tag you in embarrassing photos - but it has the nifty side effect of stopping spammers posting their rubbish all over your friends' walls.

Visit https://www.facebook.com/settings?tab=timeline&section=review&view and enable the setting to kill off the spam.

Tell your friends!

Facebook knew you were in love a long time before you did. It noticed you scrolling back through her timeline. Every millisecond lingering over the photos of her at the beach was faithfully logged.

When she sent a message to her best friend saying "Hot date tonight ;-)" it correlated all the messages that she'd been sending and rightly calculated that you were her probable partner.

When the two of you didn't send each other flirty message one morning, it concluded that you had spent the night in a... how to put this...? A state unobservable by Facebook.

On the surface, you two were perfectly suited to each other. But Facebook had detected a problem.

At your age, it's hard for Facebook to make money from your love. Sure, a promotion for flowers earns a few bucks. Adverts for romantic dinners can bring in some cash. But here's not much money in that.

Not as much as there is in e-Dating.

So Facebook acted. It "lost" the occasional message you sent her. It made sure that photos of her with other guys were always at the top of your newsfeed. She mostly saw your posts about drinking - and all the girls who had liked your status updates.

Before too long you'd both decided that it just wasn't working out between you. That's when the adverts for eHarmony started following you around the web.

It's much more profitable to take a monthly payment for online dating - than simply hoping that you'll click on adverts. Facebook knows just enough about you to find someone you'll enjoy dating for around 3 weeks and then... well, humans are rather predictable in their reactions. Send humans enough emails to make them think someone better is waiting for them and they'll quickly drop whoever they are dating in the quest for something new.

But, sometimes, the unpredictable happens. You fall in love again! She's smart, witty, beautiful, and wants to settle down - just like you! That's when Facebook detected the second problem.

A long time ago, you linked your 23andMe account to Facebook. In the blink of an eye your entire genetic history was gobbled up - just in case it was useful.

She had been a lot more careful with her privacy. No mega-corporations had a hold on her genome! But her father and sister were more lackadaisical. Two close genetic relatives were all that Facebook needed in order to stochastically determine her likely imperfections.

Genetically, your weaknesses would have been cancelled out by her strengths. And that, it turns out, isn't good for business.

Parents spend a lot of money. They're cash-cows. Parents of sick babies - they spend more. So Facebook decides to break your heart yet again.

With perfect algorithmic efficiency, Facebook found you a beautiful wife who was practically guaranteed to produce a sickly child. Nothing too bad, mind you, but just ill enough to make you spend a little bit more than you would otherwise.

A child is a joyous event. Lots of photos posted to Facebook. Lots of likes. Lots of inspiring updates about bravely struggling.

There's no malice here. No human ever decided to profit from your misery. The constant A/B testing with billions of reactions just so happened to engineer a situation to help you breed a better human. More profitable human.

Now, how can Facebook make your "epic divorce rant" go viral?

The story has some loose ties to reality.

• Facebook doesn't (yet) control a genetics company nor a dating company.
• We know that Facebook can manipulate emotions by choosing what you see.
• Facebook can intuit when a couple start dating.
• 23andMe are able to tell you want diseases and disorders you are a likely carrier for - with some degree of accuracy.
• In Iceland, there are apps which will tell you how genetically similar you are to your date.
• Online dating companies can use Big Data to tell how compatible a couple are.
• Targeting profitable parents leads some companies to do crazy things.
• And some companies know you are pregnant before you do!
• You won't believe the science behind viral headline generators! (Number 25 is shocking!)

But, like I say, the above story is a work of pure fiction.

Facebook rewrite URLs with Unicode in the path - this is not best practice and could be dangerous.

It is possible to create a URL like http://bit.ly/😀 - the Unicode characters are valid in the path.

The URL Encoded representation is :

bit.ly/%F0%9F%98%80

Facebook mangles these URLs in such a way that it might be possible to redirect a user to a malicious site.

Here's what's happening. When Facebook sees the "😀" character in text, it rewrites it to the "󾰀" character (󾰀). That's a "private use character". This means Facebook can replace the user's computer's default smiley with a Facebook supplied image or font glyph - if it wants.

In normal text - such as "I passed my exams 😀" - changing the smiley is doesn't present a problem, but Facebook also replaces the text in a URL!

So, the URL :

bit.ly/%F0%9F%98%80%F0%9F%98%80

Will point to a Facebook security page.

Facebook changes the URL to :

bit.ly/%F3%BE%B0%80%F3%BE%B0%80

Which points elsewhere - bit.ly/󾰀󾰀.

I performed a couple of quick experiments. It is sometimes possible to post a link which displays a preview of a "good" site, but when clicked on leads to a bad site.

The chances of this being used as a successful attack vector are slim. Tricking the user into clicking on a link which subsequently steals their password is made marginally easier if the link and link preview don't match - but I'm sure there are easier ways of deceiving the user.

The real issue here is that Facebook is altering the text that you write - and that can have unexpected consequences.

We live in a non-ASCII world now. A URL like https://莎士比亚.org/奥瑟罗 is perfectly valid. Facebook - and other sites - should not be confused by non-Latin characters.

But Twitter seems to think so.

When I share a link to Twitter on Facebook, this (sometimes) happens.

And sometimes, I get this delightfully mangled Unicode atrocity!

So, what's going on?

When Facebook wants to display a link, its servers send a quick web request to the URL that the user has typed into the box. When Twitter receives that request, it looks at where it has come from and tries to localise its content.

If you're a German, you probably want the Twitter website to be in German. That's fairly sensible. But when you receive a request from one country on behalf of another, what should you do?

Here are the headers which Facebook sends with every request.

User-Agent: facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)
Accept: */*
Accept-Encoding: deflate, gzip
Range: bytes=0-524287
Host: example.com
Connection: keep-alive
IP: 31.13.110.120

That IP address, according to most geolocation databases, is from Ireland - however some list it as being Swedish.

Twitter is, arguably, doing the right thing here. They're seeing an IP from Sweden, and serving it up a Swedish page.

Yes, their IP database is out of date, but even if it wasn't I'm not sure everyone on Facebook want to be reading in Gaeilge or English.

Facebook knows what language the user speaks. It really ought to be including the HTTP "Accept-Language" header in its requests.

It's really easy! All that HTTP request needs is:

Accept-Language: en-gb;q=0.8, en;q=0.7

That means "I want British English, but I'll accept any other form of English".

Hey presto! Twitter will see a request from Sweden / Ireland and rather than dumbly looking at the IP will make an intelligent choice based on the user's language preferences as determined by Facebook.

I spoke to someone informally at Facebook about this. They claimed that this is a user privacy measure. Facebook sending your language preferences to a third party could be an unwanted invasion of privacy. Personally, I think that's a load of rubbish. Could an attacker send you a specially crafted link and find out that you secretly read Facebook in Pashto? Perhaps. But because this doesn't happen all the time, I suspect it's just a piece of sloppy engineering.

As we say in Sweden, "Ibland användbarhet innebär att arbeta lite hårdare för att se till misstag i andra företags datorer påverkar inte dina användare negativt!"

His argument was - and I paraphrase...

I don't mind the occasional advert - between the Farmville notifications and "inspirational" quotes, I barely notice them.

For me, this was quite the shocker. I don't see game invitations. I rarely see "spiritual" messages, or ill-informed racist rants. Why? Not because my friends are better than his - but because I make judicious use of the block button.

Look, we all have a friend / relative / former lover who we have to follow on Facebook. Just because we want to see photos of their new kitten, doesn't mean we have to share their taste in "LOL FUNNY FORWARD TO EVERYONE!!!11!!" posts.

Here's how I do it.

A good friend - otherwise sensible in all her endeavours - has taken to posting nonsense from a site the I personally cannot stand.

No need to break our friendship. See that ˇ in the corner? Give it a tap!

Right, let's get rid of everything from that site.

Why yes, yes I am sure that no good will come of reading "10 dogs who totally look like celebs (number 7 will blow your mind!)"

A fair question.

You can opt to feed the machine or not. Either way, the content will never blight you again.

Suppose you feel like you have made a tragic mistake and you won't be able to bond with your friends without having consumed the same memetically infested tripe as them?

On the main Facebook site (this won't work on mobile) you can edit everything you've blocked.

You can then click the little X to restore them.

Note, this setting lists all the Friends, Groups, and Pages you've blocked.

Bizarely, it only lists some of the apps that you've blocked. The rest live at https://www.facebook.com/settings?tab=blocking

And, just like that, you can pretend that the people you're friends with on Facebook are normal and well adjusted members of society.

Of course, filtering reality like that may make life interesting when you meet them outside of Facebook...

The web is built on three fundamental components:

1. HTML - the structure of the page.
2. CSS - how the page is styled.
3. JavaScript - the interactivity.

Typically, the website owner sets up the CSS to say links are blue, headlines are big, images have borders etc. etc.

Users, however, can over-ride these styles using their own CSS. For example, a person with poor vision may decided to pump up all the fonts, or make all the text high-contrast. Or, they could change the fonts to something like OpenDyslexic.

Or, they could hide the parts of websites that they just don't want to see!

Let's take Facebook. There are loads of parts of Facebook I just couldn't give a damn about. Take this weird little menu bar:

Who the hell is still poking in 2014?

Well, by right-clicking on the offending item, and selecting "inspect element", it's possible to find the ID and class which tell the browser how to display it.

So, how do we get rid of it permanently?

1. In Firefox, type into the URL bar about:support.
2. Where you see "Profile Directory", click the "Open Directory" button.
3. You're now in the folder where Firefox keeps its guts - be careful!
4. Open the folder called "chrome". If it doesn't exist, create it. (Note: all in lowercase.)
5. Open or create the file called "userContent.css" - again, this is case sensitive.
6. Add the following into the file and then save it.

   #appsNav{
      display: none;
   }
   

7. Restart Firefox.

Hey presto! The offending item is gone :-)

There are loads of CSS "hacks" like this that you can use. A good place to start if you want to re-draw the web is userstyles.org

My Personal Styles

I'm currently getting rid of "trending topics" and the constant adverts for games on Facebook. I've also disabled the annoying Google+ notification. Oh, and those silly "Outbrain" adverts which infect most news-sources.

/*
Facebook - remove trends and recommended pages
*/
#appsNav,#pagelet_trending_tags_and_topics,#pagelet_organic_ego_pane,#pagelet_ego_pane{
   display: none;
}

/*
Google - Remove G+ message counts
*/
div.gb_Ca{
   display: none !important;
}

/*
Outbrain - content from around the web nonsense
*/
#outbrain,#outbrain_widget,#outbrain_widget_0,#outbrain_widget_1,#outbrain_widget_2{
   display: none !important;
}

First thing's first, this isn't a show-stopping bug. It's more of a curiosity which shows how different providers treat the verification of Two-Factor Authentication.

Details

If you are a security conscious user, you should have set up Two-Factor Authentication (2FA). Every time you try to log in to Facebook, after providing the correct password, you are send a security code via SMS. If you enter the code correctly, you're let in. It looks a bit like this.

If an attacker has hold of your password, she still won't be able to access your account because she doesn't have access to your phone.

However! There is more that Facebook could do to ensure that these codes are secure. The vulnerability I discovered was that Facebook doesn't verify that the IP or User-Agent which enters the code is the same as the one which requested it.

Example

Alice has a mobile phone on IP address 198.51.100.1 - she access Facebook through her web-browser or app. She enters the correct password and is sent a one-time code via SMS.

Bob has a laptop on IP address 203.0.113.5 - and is looking over Alice's shoulder. He accesses Facebook in his browser and copies Alice's password. When he sees the SMS come through, he quickly types it in and now has access to her account.

What Facebook should be doing is checking that the user who submits the token is the same user who requested the token.

An easy way to do this is to check that both request and response came from the same IP address.

To ensure that this cannot happen when two users have the same external IP (for example they are both on the same WiFi connection) Facebook should also check that the User-Agent is identical - that way a laptop cannot easily use a code intended for a specific model of phone.

Finally, to defend against an attacker having the same IP and the same device, the screen which asks for the code could have a hidden field which provides yet another proof that the submitter is the same as the requester.

Does It Work Elsewhere?

It is possible that other sites which use 2FA are also deficient in the same way.

I tried on Twitter and found that the 2FA code was tied to the browser which requested it - but not to the IP address.

For example, requesting a 2FA code from Firefox will generate a code which didn't work in a Chrome session. However, a code requested from Firefox still worked in the same browser even if I manually roamed onto a different WiFi network and subsequently got a new external IP address.

Impact

A couple of weeks after disclosing this to Facebook, I received the following reply:

This is not an exploit an we will not be rewarding this.

There are tradeoffs between security and usability and we've made a decision here; we are confident that two factors is sufficient to secure the accounts, and recommend that users keep their two-factor secrets, their password and their phone, secure.

Inhibiting account authentication on the basis of IP address would have undesirable consequences for the victims, and even for non-victim users.

While I would have loved to been included on Facebook's Hall of Fame, it's not hard to see that this is, at best, a relatively minor security flaw. It relies on an attacker being able to discover or intercept two separate pieces of information.

But there's no reason to make it easy for an attacker who has got that far.

As Twitter has demonstrated, tying the response to the requesting browser is a cheap and easy way to defeat an attacker. Personally, I would also ensure that the request and response came from the same IP address - although I can see certain situations (like mobile users) where that would be inconvenient.

I hope I have demonstrated why it's important to thoroughly verify credentials.

I don't understand money. Well, specifically, I don't understand how companies are funded, classify shares, or any of that finance stuff. But, there's something which has been bothering me about the recent sale of some social media properties.

According to some estimates, tumblr has 170 million users.

$1.1 billion / 170 million users is.... double checks workings $6.47 per user.

Err... what? Even if those number are off by 50% - Yahoo have paid the equivalent of just $13 per user.

Now, I realise that $6 - $13 is a lot for some people, especially young people and those without disposable income. But it's not exactly an extravagant amount, is it? If a social network's worth is in selling advertising to users - you would expect said users to have enough income to be worthwhile advertising to.

Take, for example, Facebook. When they sold their shares they raised something like $16 billion and had roughly 901 million users.

Does sums. That's about $18 per user.

These are not huge sums for an individual.

The thing is, it's pretty hard for an ordinary person to buy a share of a company. You usually need to be able to buy a large quantity of shares, pay for a trading account, try not to get ripped off with various fees, and deal with taxes.

The Internet is making this slightly better - but market trading for small people still needs a hell of a lot of disruption. At the moment, I can't simply hand over the $26 I made in babysitting money and own a single share of Facebook.

I appreciate that selling your company isn't just about the money... but it seems that if you do want to raise cash, getting your users to invest may not be the worst idea in the world.

Sure, the transition from "user" to "part owner" may be uncomfortable - but it's not impossible. Look how Co-ops, Building Societies, and other partnerships manage it. Invested users could vote on major decisions, and feel a sense of pride and community in what they were achieving - not to mention the potential for receiving dividends or other forms or returns on their investment.

Take, for example, App.net. Users pay for their accounts on the microblogging service - developers like me pay slightly more. But we're still just sharecroppers tending someone else's plantation. This isn't a criticism of Dalton Caldwell and his team - but just being a customer isn't enough to convince me that the service won't suddenly shut down or follow some dark path.

I want to be an investor - a very small one - in the services I use. I don't want my attention to be sold to the highest bidder on the stock market.

Like I say, I don't really understand how corporate financing works. I'm sure there are lots of problems with my idea. Not least that Goldman Sachs wouldn't make quite as much money.

I sincerely think that Internet-scale companies should look to those with the most emotional investment to provide them with financial investment. Or they will end up selling not just their customers' eyeballs - but also their trust, loyalty, and love.

Even when someone releases "official" statistics, they're usually hard to verify independently, and even harder to analyse by region.

Benedict Evans - who I've had the pleasure of meeting at Mobile Monday - published some very interesting official stats on Facebook's mobile usage. The statistics show that roughly 44% of Facebook use is "not mobile".

How does that chime with reality?

I've talked before (incessantly!) about how leaky bit.ly is - they allow anyone to view detailed statistics about your marketing campaigns. Why people continue to use them, I've no idea. But, luckily for us, it allows us to get a fairly balanced view of Facebook's userbase.

UK supermarket Tesco have been running this "sponsored story" on Facebook. I assume that it is being pushed out to a large and broadly representative sample of UK Facebook users.

Using Bit.ly we can see the clickthrough statistics. You can click on the image for a live view of the stats.

Having run my own tests, it appears that clicks on a Bit.ly link from the Android or iOS app appear as though they come from m.facebook - as do clicks from the mobile web site. So we can't break down the stats any further. That said, it's always useful to get a secondary data point.

People are sharing your links on Facebook. Over half the people clicking on them will be doing so from a mobile phone. Does your site provide a great mobile experience? If not - it's time to up your game.

Facebook have been spamming my wall with all sorts of rubbish - dodgy share trading deals, timeshare scams, PPI reclaim cons, malicious Android apps - really bottom of the barrel stuff.

So, as I'm too weak-willed to abandon Facebook, I've started retaliating. At a basic level, I block the stories as spam. That, hopefully, blocks them from appearing again. I file abuse reports which, hopefully, take up a little bit of Facebook's time.

Mainly, though, I complain to the company - especially if it's a UK one. I write on their wall saying that I don't appreciate them spamming me. I leave "interesting" links on their posts letting others know what think of them. For example, when overpriced smoothie maker "Innocent" started spamming me, I reminded their followers that - far from being innocent - they had taken substantial investment from Coca-Cola. A company with business practices which don't exactly fit Innocent's image.

When BP spammed my wall, I contributed to theirs with videos about people protesting BP's greenwashing of the arts. I also shared the videos and articles with my friends.

I'm not alone in this, it seems. People love telling companies that they don't like their product or their spamming attitude.

This is what happened to Innocent when they started promoting their posts to people who didn't want to see them. (I've edited out some of the positive comments - but Innocent deleted my disparaging comments and blocked me from their page - so I think that's fair.)

It's often said that customers prefer telling each other bad news about a company rather than good. What happens when every supposedly positive "sponsored story" gets users telling their friends just how much they despise a spamming brand?

The meme-du-jour is "If you're not paying, that means you're not the customer; you're the product." We are the product being sold and some of us don't like it.

That's the premise of my wife's most recent blog post.

It asks a rather simple and quite unnerving question. What happens when the "product" starts rebelling?

Facebook might not like this attitude, but they made the decision to design a business which sells rational, self interested agents in the first place. If they didn’t want their ‘product’ to rebel against them they shouldn’t have gone into the business of selling something which has a brain. Liz Eden

I've been told that Facebook won't offer people a way to pay to opt out of advertising. The people who can afford to pay are the ones which advertisers are desperate to target. Will there, I wonder, come a time when the negative publicity generated by resentful products offsets the gains from selling us?

I log on to Facebook - and this is what I see, all complete with photos of smiling people doing awesome things.

• Melody checked in at Bury Lane Farm Shop "Stocking up on pâté :)"
• Dan "First sky diving lesson. Love it!"
• Lloyd "Sushi!!!"
• Luke "Welcoming the birth of our new baby with some champagne"
• Steve "not being a fan of either presents or parties, just receiving tons of messages on Twitter and FB for my birthday is pretty much perfect :)"
• Ewan "Read my latest piece in Forbes magazine"
• Laura "Red wine, cheese and live classical music... how else would one spend a balmy Australian summers eve?"
• David "Amazing street art in New York City"
• Andrea "Jason & I have gotten around to updating our relationship statuses on Facebook."
• Lexy "London. Heathrow. Cape Town. All in 24 hours"
• Gillian "Is loving being at Hotel du Vin, Henley."
• Menna "This evening I bought a Le Crouset casserole dish before attending a pub crawl at which several people were dressed in onesies"
• Helen "spent a very long time in the swimming pool today and might have to go to bed early to recover!"
• Jess "This Knickerbockerglory may be the death of me!"
• Kate "Planning a trip to see my astronaut friends!"

Literally everyone I know is doing amazing stuff! Sure, there's the odd moan about a crappy commute, or a missed Christmas present. But everyone is so unnervingly upbeat all the time.

I wonder what this does for our mental health? When all you see is the relentless cheeriness of all your friends, suddenly finding yourself miserable can be deeply distressing.

Your friends are always flying off somewhere exotic, and buying new cars, and having exciting careers. You just sit in your underwear wondering if visiting Vimeo rather than YouTube counts as a life changing experience...

It's no longer a case of "keeping up with the Joneses" - you now have to keep up with everyone you've ever met, no matter what the cost!

What we're overlooking, of course, is that Facebook presents us a rather one sided view of our friends.

Let's say your average friend only flies off on holiday every two years. With 100 friends, you'll see someone jetting off every week. All of a sudden, our view of reality is distorted. Our friends aren't all globe-trotters who do nothing but sip champagne in the first class lounge - but the steady drip-drip-drip of friends posting their adventures makes us feel like we're missing something.

Look through your photo album - digital or physical - and count the ratio of photos of people smiling vs looking grumpy. We want to remember the good times. We want to capture and share the brief moments of joy in our lives.

But all those perfect moments combine to a deluge of unfettered joy and love which, if you're not careful, can drown out any rational thought.

I'm not saying that people should post more depressing status updates, or that they should refrain from sharing their happiness. It's just that perhaps we, as a species, aren't yet used to dealing with a constant flood of our friends' successes. It can make even a little failure feel like you're letting down your entire social circle.

Looking through my Facebook updates for 2012 - I've been to some incredible countries this year, changed job, visited zoos and art galleries, had my work published, been retweeted around the globe, raised money for good causes, eaten at some lovely restaurants, won best in show at OverTheAir, drank expensive cocktails with a friend I haven't seen for a decade, been to a Beatles gig, and completed Angry Birds Star Wars.

I am, ostensibly, not a loser. So Facebook can fuck right off.

The same flickr which capriciously deletes the photos of paying customers? The same flickr which has catastrophic accidents? The same flickr who bans paying customers for commenting on political issues? The same flickr which one day decided that paintings and drawings weren't suitable for its site?

Yeah. I'm not ok with that. If you're "liberating" your Instagram photos to Flickr, you're merely trading one jail cell for another.

As I've mentioned before, we're moving to an era where people control their own content. They don't need to cede it to some 3rd party and hope that the terms and conditions don't change from under their feet.

So, what's the solution? People are saying "what did we do before Instagram? Oh yes, Flickr!" What they should be doing is saying "What did we do before Flickr? Oh yes, self hosting."

That's where OpenPhoto.me comes in. The premise is simple. You store your photos on your own storage system. That could be your DropBox account (500 MB free), your Box.com account (5GB free), or Amazon S3 (5GB free), or CX.com, or DreamHost's DreamObjects - or, finally, on your own server.

They're your photos - so you get control of them. You can easily back them up, move to a different hosting provider, or delete them forever.

You get a nice front end for your photos - with commenting, tagging, albums, privacy settings, mobile viewing and uploads etc.

You can change the look and feel of the theme to suit your preferences.

With a single click you can import your images, tags, comments, and metadata from Instagram, Flickr and Facebook. No doubt more services will be arriving soon - or you can manually upload your photos.

As I've mentioned, if you really don't trust any of the above storage providers, you can use the Open Source OpenPhoto to run everything on your own server.

Why on Earth would you want your photos to be held hostage by some nebulous third party? Even if you have a billing relationship with them, it won't stop them changing their terms and conditions, or "mistakenly" deleting your work.

Want to liberate your photos from the evil Instagram? Tired of Facebook's stranglehold on your images? Remembering why you left Flickr in the first place?

Here's the button you need to press.