They will. However, if you take a look at the final code snippet, you'll see we're not relying on any minified name. The public interface of modules remains intact through minification.
So, as a code example, fine---but I'd caution against actually using this with your friends unless you know they're okay with it. They will be acting under certain social expectations with regard to when and how people can see their typing notifications based on when and how they were able to see them before, and if you tweak your way into getting more access without your conversation partners knowing it beforehand, you're at least being sneaky, and possibly creepy or rude depending on the attitudes of your circle. The flow of the machine transmissions doesn't currently constitute something visible enough to hang social norms off of, so be careful not to treat it as the anchor for them by mistake. (This applies to other implementations of similar things, as well, such as "Psychic Mode" for Pidgin.)
Facebook users are apparently broadcasting the fact that they are typing to their conversation partners, why should you ignore that information? If you don't like that, disable that feature, or complain to Facebook if it is not something you can disable yourself (or don't use Facebook).
It can't hurt to raise some awareness of what you are invisibly broadcasting in terms of data on-line.
(I always liked how this feature could be disabled in Gaim and Pidgin.)
Well, firstly, because they are not in a similar position to yours with regard to this fact unless they are of a similar attitude and skill for promoting these transmissions to human-side visibility. (If you know that they do have the same attitude as the one you expressed, then the "you know they're okay with it" exception applies.) There are a lot of things people "broadcast" in the physical world which are socially expected to be politely ignored as well.
Put another way, your statement makes perfect sense if you assume all software is actually a User-Agent in the traditional, ideal sense. But this isn't so, because even programmers don't generally have the spare cycles to rewrite everything they come in contact with, and non-programmers have an even more vanishingly small chance to do anything about it. Agency in the digital world is inevitably shaped by other people's decisions as represented in software, and social agency is shaped by how that software presents itself not just to you but to the people you're communicating with through it. When the state of the software doesn't exactly match the state as visible to the participants, the latter state prevails in a social context, and it's the responsibility of a polite conversation partner to not mess around behind the curtain unless you already know you're welcome.
Not a fb user, but I partially agree with you here, in that you should already send this information to all your fb friends, so they can learn that their "social expectations" are not backed by what facebook gives away about them to tech-savvy users.
I mostly agree with that, yes, though I worry about message saturation too early on. Currently there's very little many users can do about it. If they have the idea shoved into their faces too many times while that's true, will they keep the information around and be more willing to change habits later if that will help, or will the shock just get muted to a dull roar so that they get used to it? Or will they decide to believe that this is okay in order to avoid the current-day social consequences of trying to act according to the opposite?
Psychic mode is/was amazing. I used to love freaking people out when I saw the 'You feel a disturbance in the force...' message and quickly type 'Hi!'.
I love Pidgin so much. It's such a shame to see things move from "one client to rule them all" to hundreds of isolated, willfully incompatible clients.
I think there's a big difference between being arrested and being considered to be acting rude. There's also a big difference between pointing out a security flaw and continuing to actively exploit it. That's why I said I think it's fine as a code example, and I think it's fine to raise awareness. Just be careful about keeping this around in your main browser while you're chatting with many people; you might be risking trust if they find out.
Good for us that there is no such thing as closed source client side logic in web applications (without installing extensions/plugins). You can only obfuscate.
That's true to an extent, except a compiled binary is much harder to decompile compared to what the author has done in the article with obfuscated JS. In future, I imagine more websites will use WebAssembly for this reason.
Well, if they introduced some "special feature" that's available only when you install a certain plugin, I am sure millions of people will do it just because they can get the "special feature."
I used to have a rule in my ad blocker that blocked the typing notification and read notification from being sent. Both of which are features that I despise
I know of various third-party IM clients which allow you to do this. Been a long-time user of Trillian myself, for which this was one of the cooler features back in the day. Allowed you to be notified of people typing, regardless of having an open conversation, and set up whether you wanted to send typing notifications always, only after having sent a initial message, or never. Was pretty cool to be able to say "Hi!" to someone just when they were about to message you. Most of my friends never figured how I did that, since their official clients never supported it so they didn't even know it could be a thing.
Haven't got Facebook myself, but I know Trillian fully supports Facebook chat and I suppose many other (free/open source) IM clients do as well. Such multi-network clients are in my experience great for slowly moving people away from pretty much any network, since they pretty much remove the distinction between them. I just add my friends and let the software figure out how exactly it gets the message to them. :)
Just do it. Seriously, moving away from fb is important, but it won't be seen as such as long as people like you don't flat out refuse to use the crap. It's worked out extremely well personally, drastically cutting down on social noise, thus getting distracted less. Somehow, people who actually wanted to stay in touch, managed to over different channels (of which there's a fuckton; signal being my goto solution).
Why signal? What alternatives do you use / have you considered?
I'm still on facebook messenger but I mostly off facebook otherwise (and have settings to make it difficult to track pictures of me), and I'm curious to hear a good comparison of messaging software.
It was definitely an option for AIM, and I believe it was an optional plugin rather than a default feature. I remember freaking out friends in high school :-)
I remember a bunch of friends being upset about this. Apparently it's an outrage that your friends can do this, and perfectly fine that facebook probably does it all the time.
The scope of behavior Facebook is capable of obtaining is probably beyond comprehension for most users. Having a slice of that scope opened up and dissected publicly is quite creepy; despite intellectually understanding how much data Facebook has about them, actually seeing that data in use creates a much more visceral reaction that simply intellect can not create.
Having somebody intentionally look into your life, individually, because of some possibly perverse or unwanted interest in you is extremely creepy.
Having a large company store some data you generated in a server farm somewhere while a mindless algorithm does some math with that data to shuffle a few ads around for you to see is utterly banal and not creepy.
> Having a large company store some data you generated in a server farm somewhere
... and make it a available for somebody to intentionally look into your life, individually, because of some possibly perverse or unwanted interest in you
Huh this was a really interesting write up on semi-obscured code. I had never seriously thought about crawling through popular sites code like that, I'm definitely going to have to give it a go!
Contrary to popular belief, Ajax is actually one of the best things to have happened for hooking up to Web Apps and scraping. You used to have to walk through the obscure rendered html, now you mostly get to access the raw data in json format.
is this really a contrarian opinion? i feel like this is a pretty obvious fact that it's easier to read network requests to scrape a website than parsing html
Chrome Dev Tools is pretty awesome. You can right-click a request and get an 'curl' request with cookies and everything that can be replayed on a terminal.
The article was very clever and interesting (also the trip down memory lane, I remember this being possible in MSN Messenger!) but the console warning was a first for me, it's even nicely localized. Do more websites do this?
You can install owntracks (http://owntracks.org/) on your phone, and configure it to publish the battery level (as well as your location) to an mqtt broker.
As far as I can tell from a quick glance (WhatsApp Web is blocked at work unfortunately), the battery level is transmitted once at page load. So, a constant indicator might not work well.
Might take a further look later.
We've banned this account. Personal attacks aren't allowed here, novelty accounts aren't allowed here, and snark is deprecated here, so please don't do these things on HN.
I also immediately thought about the MSN customization days! Is fb the customizable platform of this time?
For MSN it was also non-officially supported and it grew quite a community of devs who tinkered around things like this, would be interesting to see a renaissance of such projects.
Fun article! I appreciate the author taking the time to go through the details, like formatting the source of the javascript, and figuring out the module system. Hacking on other peoples' websites is great fun. Everyone should try it, and I hope this article encourages a few people to!
I hack on Slack, which is complex enough that even small UI changes require hideous hacks. And since the javascript and CSS changes out from under you constantly, nothing ever works for long. I'm reverse engineering something to create an opportunity to produce code that runs against an API that will change without notice. But I get big, visible improvements I see every day, and the feeling of changing something that wasn't meant to be changed is just so unreasonably satisfying!
I'm crossing my fingers that this, or a comment like it about hacking, remains the top comment in this thread, rather than some warning... please be true to your name, please be true to your name, ... ;-). Just kidding I don't care. Fun article indeed.
And there’s nothing like that excruciating feeling when you watch it disappear, never to be seen again.
True honesty here, that has never elicited that response in me unless I held a sexual and/or romantic interest in the person on the other end. Other times, it's usually annoyance and or ambivalence.
83 comments
[ 2.7 ms ] story [ 81.7 ms ] threadIt can't hurt to raise some awareness of what you are invisibly broadcasting in terms of data on-line.
(I always liked how this feature could be disabled in Gaim and Pidgin.)
https://chrome.google.com/webstore/detail/facebook-chat-priv...
>Package is invalid. Details: 'Could not load background script 'tracksy/tracksy.js'.'.
Put another way, your statement makes perfect sense if you assume all software is actually a User-Agent in the traditional, ideal sense. But this isn't so, because even programmers don't generally have the spare cycles to rewrite everything they come in contact with, and non-programmers have an even more vanishingly small chance to do anything about it. Agency in the digital world is inevitably shaped by other people's decisions as represented in software, and social agency is shaped by how that software presents itself not just to you but to the people you're communicating with through it. When the state of the software doesn't exactly match the state as visible to the participants, the latter state prevails in a social context, and it's the responsibility of a polite conversation partner to not mess around behind the curtain unless you already know you're welcome.
This kind of thing makes me think that Facebook et al will eventually push for a way of having closed source client-side scripting.
Still, even a binary can be reverse engineered; you see it all the time.
If you have the binary, you can reverse-engineer it.
When typing a `POST https://www.facebook.com/ajax/messaging/typ.php?dpr=1` is sent for example.
I'd like to switch away from the Facebook platform, but it's seriously difficult to convert people away from it.
Haven't got Facebook myself, but I know Trillian fully supports Facebook chat and I suppose many other (free/open source) IM clients do as well. Such multi-network clients are in my experience great for slowly moving people away from pretty much any network, since they pretty much remove the distinction between them. I just add my friends and let the software figure out how exactly it gets the message to them. :)
I'm still on facebook messenger but I mostly off facebook otherwise (and have settings to make it difficult to track pictures of me), and I'm curious to hear a good comparison of messaging software.
That was the primary feature :) It worked for the MSN/Microsoft Messenger protocol as well.
Having a large company store some data you generated in a server farm somewhere while a mindless algorithm does some math with that data to shuffle a few ads around for you to see is utterly banal and not creepy.
... and make it a available for somebody to intentionally look into your life, individually, because of some possibly perverse or unwanted interest in you
Admittedly, writing spaghetti code will make the programmer feel miserable, but does it really deter people from hacking on your code?
A bit like this guy's series on game engines: http://fabiensanglard.net/quake3/
In my experience internal layout changes seem to happen way more often than changes to the AJAX handlers.
http://stackoverflow.com/questions/21692646/how-does-faceboo...
When you have a WhatsApp Web tab opened, it keeps a socket connection opened that gives you information such as your phone battery level.
I really want an icon on the Chrome toolbar showing me that charge level.
We detached this comment from https://news.ycombinator.com/item?id=11805831 and marked it off-topic.
You could have it open a window when someone started typing to you, before they sent their message.
For MSN it was also non-officially supported and it grew quite a community of devs who tinkered around things like this, would be interesting to see a renaissance of such projects.
I hack on Slack, which is complex enough that even small UI changes require hideous hacks. And since the javascript and CSS changes out from under you constantly, nothing ever works for long. I'm reverse engineering something to create an opportunity to produce code that runs against an API that will change without notice. But I get big, visible improvements I see every day, and the feeling of changing something that wasn't meant to be changed is just so unreasonably satisfying!