Attention Facebook readers: You might want to click the “View Original Post” link at the bottom of this note. Facebook sometimes messes up the formatting. Irony: Writing about Facebook in an article available on Facebook and telling people to go somewhere else to read it.

Facebook is one of the world’s most popular websites, with over 350 million users. An awful lot of those people share all kinds of information on Facebook that they wouldn’t normally share with people, and a lot of them seem to have forgotten who they’ve added as friends when they update their status. I’ve seen people who post status messages like “Woohoo! Got laid tonight!”, forgetting that mom, Aunt Mary, and the boss are all reading this. Privacy, or the lack thereof, has always been a big issue with Facebook. Thanks to some recent changes to their privacy policy and settings, an awful lot of people are sharing an awful lot of information with the world that they probably don’t really want to share, and may not even realize that they are sharing.

Gail and I attended a “Facebook 101” seminar at a local school a couple of months ago. A local (Oakville) parent started looking into Facebook privacy, and was appalled at (a) the amount of information available by default to the world, (b) the number of people who don’t know this, and (c) the number of kids joining Facebook and not considering the ramifications of what they post. He started doing this seminar so that parents unfamiliar with Facebook (and even those who are) were informed about the privacy aspects. There were a number of parents there who had older kids than ours, and whose kids were on Facebook. Some of them didn’t really have a good idea what Facebook was or what their kids used it for. After the meeting, I checked on my privacy settings. I was aware of most of the information given in the seminar, and I had already changed my privacy settings, so I didn’t have to make many changes. I then started poking around my friends’ settings and their friends and so on just to see how much information I could glean about these unknown people, to see if what this guy had told us was really true, or if he was more of an alarmist, pointing out the extreme cases. Fairly quickly, I came across a fair amount of information about people I don’t know, the best example of which was the page of my manager’s teenage daughter, who I have never met. Her privacy settings were set wide open. Despite the fact that I was not her friend, I could see who her friends are, pictures of her, where she went to school, and even her her email address, home address, and home and cell phone numbers. I immediately emailed my boss to tell him, and a day or two later her page had been locked down. Even my very limited research told me that this was not an isolated case, and that the guy running the seminar was not an alarmist at all.

Facebook has recently changed its privacy policy as well as the privacy settings. The settings are much more straightforward than before, and it seems easier to lock down your personal information, but there are three huge issues with Facebook’s privacy policy:

1. As I said, it’s easier to lock down your personal information – or at least it’s easier to lock down the information that Facebook allows you to lock down. There are now some pieces of information (for example, your networks, sex, what city you live in, and your list of friends) that Facebook now considers public information, which means that you cannot prevent people from seeing that information. It is more than a little disturbing to me that Facebook has decided that they have the right to decide that for you and won’t allow you to change it.
2. The old default security settings weren’t bad, for the most part – your friends and people in your network could generally see most of your information. There were some pieces of information that were available to everyone, but not everything was. But the second big change was to the default security settings – the new settings mean that by default, everything is globally visible. If you had modified your security settings before the change those settings were kept, so security-conscious people didn’t notice any difference. But the vast majority of Facebook users had never touched their security settings, and are now sharing all of their information with the world.
3. When you install a Facebook application, the application developers get access to all of your information, even if you’ve marked it as private. Even worse, the application developers get access to all of your friends’ information as well. (This has always been true, but you used to be able to turn it off. Now you can’t.) This means that every time you install an application on Facebook, my information (assuming I’m on your friends list) is sent to the developer, and not only do I not have any control over that, I am not even informed of it. The application developers are then free to do whatever they like with the information. Technically they are subject to Facebook’s terms of service, which says that they are not allowed to use the data in any manner inconsistent with the user’s privacy information, but there’s no way for Facebook to police that.

If you don’t like these rules, you can just delete your account, right? Well, sort of, but that still doesn’t solve the problem. First off, Facebook doesn’t give you any easy way to delete your account. There is a way to “deactivate” your account, but there’s no “delete” button there. Apparently if you search hard enough you can find a way to delete it, but does Facebook actually delete your information from their servers, or just make it harder to find? Secondly, even if they do delete it, they still have backups of everything, so the information is all still available to them. Thirdly, (and this isn’t specific to Facebook) if someone on the internet can see your data, then they can save it to their hard disk, and nothing Facebook does can delete that. At the seminar I mentioned, the guy showed pictures that were taken at a frat party back in the 90’s, where two obviously drunk guys were standing at a party next to a stand-up cardboard cut-out of Hilary Clinton, and one of them had his hand on her breast. That guy, years later, became a speechwriter for Barack Obama, and when that photo re-appeared, he got into some serious trouble, jeopardizing not only his job but his entire career. Think about that when you post those pictures from last weekend’s kegger.

I read a comment online somewhere that said something like “Facebook shouldn’t be sharing information about their customers”. Another commenter responded succinctly and summed up everything: “You are not Facebook’s customer. Advertisers are Facebook’s customers. You are the product.” The more public information Facebook has on you, the more they can offer advertisers.

The easiest rule of thumb for internet security is: if you ever put anything on the internet, whether through Facebook, YouTube, a blog, a message board, or even email, whether it’s information, pictures, or videos, whether it’s intended to be publicly visible or not, you must always assume that it will be accessible by everyone – forever. Facebook is proving this – if you post information or pictures on Facebook and expect that only the people you allow to see it will be able to see it, you’re wrong, and it’s not because of some glitch that may or may not come up in the future, and it’s not because someone might squirrel the information away and publish it themselves later. It’s because Facebook is less concerned with your privacy than with how much they can make by selling it.

Here are a couple of related articles: one from the Electronic Frontier Foundation (EFF) and one from Jason Calacanis.

I read an article recently about a significant virus or some other kind of security problem that people were being warned about. One of the comments on the article said something like “Yeah, well they warned us about Y2K as well, and that was a bust.” I have read similar comments before and even heard similar sentiments from people I know. The truth is that Y2K was a real problem that would have caused real chaos if it hadn’t been fixed in time. However it was fixed in time, and the fact that no significant problems occurred on January 1, 2000 is a testament to the amount of planning and work that went into fixing it. The fact that the general public thinks it was a bust proves that it was successful.

I know that there were Y2K problems in the database server that I worked on at the time (and continue to work on), and I know that they were fixed beforehand. Our problems were fairly minor, but I know of other problems that were not. Gail worked for a large steel company at the time (still does, kinda), and some time in the late 90’s, they did some Y2K testing. They simultaneously reset all the clocks on all the computers in the plant to 11:30pm December 31, 1999 and fired ’em all up again. A few seconds after the clocks hit midnight, everything shut down. The problem was eventually traced to an exhaust fan deep in the bowels of the plant, which decided that it hadn’t had any scheduled maintenance in a hundred years, so it shut down. All the systems that depended on that fan to be running also shut down, and the failure cascaded upwards until nothing was running.

If they hadn’t done the testing, the plant would have shut down a few seconds after midnight on New Year’s Day, and it might have taken them a couple of days to find the problem and a couple more to get a new fan installed. This is assuming that the fan was the only problem. When every hour not producing steel costs your company hundreds of thousands (if not millions) of dollars, a five-day outage would be devastating. Now think: what if that same brand of exhaust fan was used in your local power or water treatment plant? Could half your city live without power or running water for a week in January? What if a similar failure occurred in an air traffic control system? Or some safety-related subsystem in a nuclear power plant? Or the computer controlling the respirators in your local ICU?

The fan was fixed or replaced and the test was repeated. I don’t know how many times they ran the test, but when the real December 31, 1999 arrived, the plant kept producing steel like it does through every other midnight. Many hours and dollars were spent in advance to make sure that the problem was solved before it happened. This was done in countless other factories, businesses, hospitals, airlines, and such (not to mention every software development company) so that when January 1, 2000 arrived, all the hardware and software would handle it.

The people who were expecting nationwide blackouts or planes to start dropping out of the sky at midnight were surprised to find that the number of actual problems was very small. Many people assumed that this meant the whole “Y2K problem” was overblown or some kind of industry hype. It wasn’t. It was a real problem with an absolute deadline that could not slip. It was solved in time thanks to the combined effort of thousands of software developers (who, admittedly, created the problem in the first place) and IT professionals who put in a lot of effort so that people would never know there was a problem.

This, of course, is part of the thankless world that IT professionals live in – if they do their job properly, you don’t notice them. You might even mistakenly think that they do nothing. Every morning, you arrive at work and check your email or internet connection and find that everything is working properly. How many of those mornings have come after nights where the IT staff were up until 4am fixing some network or hardware problem? I’m sure you don’t know, but I’ll bet that it’s more than zero. Tell ya what – next time you see your sys admin walking through the halls at work, say thanks.

Attention Facebook readers: You might want to click the “View Original Post” link at the bottom of this note. Facebook sometimes messes up the formatting.

Back in May 2009, I wrote an article comparing the Chrome and Firefox browsers. Since then, it has been by far the most viewed page on my blog. From the day it was posted until today (almost six months), that particular article has accounted for about 80% of all pageviews on my blog. I’ve had days where 110 people visit my blog and 103 of them view that page and that page alone. I use mybloglog.com to track which pages are viewed the most and how people find my blog, and here’s a piece of the results for one day. Note that this is a fairly typical day. I don’t know why mybloglog can’t collapse all of the “chrome vs firefox” entries into one.

Anyway, after about six months of using Chrome pretty much exclusively, I decided to revisit this comparison and see how much of it is still valid. To that end, I reset my default browser back to Firefox for a week.

Note that I am comparing the “generally available” versions of Chrome (3.0.195.27) and Firefox (3.5.5), not development or beta builds.

Advantages of Chrome

1. Chrome starts up almost instantly, while Firefox takes several seconds before it’s ready to go. Both are still faster than IE for me.
2. Chrome updates itself completely silently. Firefox tells you there’s an update available and asks if you want to install it. Actually doing the install is pretty painless, but it asks you if you want to install the update when you start the browser, which is usually when you are trying to do something with it. Frequently I don’t want to wait while it installs an upgrade and then restarts itself, so I end up trying to remember to do it when I’m done. I have no idea when Chrome updates itself, because it does it silently in the background and then the changes take effect the next time you shut it down and start it again.
3. Chrome searches your bookmarks and previously visited sites extremely quickly, so when I start to type a URL, it comes up with probable matches really fast. For example, I don’t have twitter.com bookmarked, but I can get there using tw because by the time I hit enter, Chrome has searched my previously visited sites and autocompleted “tw” to “twitter.com”. Until I started using Firefox again, I did not realize how cool this feature was and how quickly I came to depend on it. I would visit a site and not bookmark it, and then the next day if I wanted to find it again, I could type whatever part of the URL I could remember into the address bar and it would just find it for me.

Advantages of Firefox

1. Chrome still doesn’t have plug-in support. If this isn’t number one on the “must get this done” list for Chrome, someone needs to be fired. Yes, I know this is at least mostly working in the dev builds.
2. When Chrome isn’t going really fast, it seems to be going really really slow. I had a situation on my computer recently where everything seemed to be taking forever – compiling was taking 20-30 seconds per file (rather than the <1 it should take), and a test that was running at the same time was taking minutes rather than seconds. I looked at the task manager, and the two processes taking up the most CPU were Chrome and our stupid virus scanner that grinds my machine to a halt and IT won’t let me configure it despite the fact that it prevents me from doing my job efficiently (but that’s a rant for another day). I shut down Chrome, and within a few seconds everything sped up noticeably (though not as much as it should have because of the stupid virus scanner). I am going to keep an eye on this, but it may be a showstopper.
3. Perhaps related to the previous problem – every now and again, usually when my machine is very busy, I enter a URL in the address bar, hit enter, and nothing happens. I have seen pauses of 30+ seconds before it even changes the status to “resolving whateverhost.com”. Firefox doesn’t have these complete blackouts, but just goes really slow in those situations. I rarely see this or the problem above (#2) at work, but it happens a lot at home – I think it may actually be related to the VPN I use.

Dead Heat

1. When I first started using Chrome, it was quite a bit faster than Firefox, especially on javascript-heavy web sites. But when I switched back to Firefox for this comparison, I didn’t notice much of a difference in speed, certainly not enough of a difference to consider it a Chrome advantage.
2. Bookmark support has been improved in Chrome to the point where this is no longer an advantage of Firefox. Firefox supports keymarks which Chrome does not, but Chrome’s searching of bookmarks is so fast this is hardly necessary, other than the magic %s searching thing that Firefox supports. XMarks support is still missing though (it’s in beta).
3. On a site with lots of Flash (i.e. games), sometimes everything seems to slow down to a crawl after 10-15 minutes or so. Sometimes it speeds up again after a while, but other times I have to just give up on the game. This happens in both Chrome and Firefox. Don’t know about IE.

The Result

For now, I’m going to stick with Chrome, but as I said above, I’m going to keep an eye out for machine slowdowns and see if closing Chrome fixes them. If that continues to happen, I will have to go back to Firefox.

I kind of miss the plug-in support from Firefox, but Chrome is still pretty peppy and quite honestly, I feel like Firefox is starting to pick up the bloat that IE has had for years. Chrome still feels small and sleek.

I’m surprised that adding plug-in support is taking as long as it is, but I also understand that this basically amounts to allowing the general public to add executable code to your application on the fly. Getting this right and making it usable and flexible while remaining robust is difficult.