frontpage.
newsnewestaskshowjobs

Made with ♥ by @iamnishanth

Open Source @Github

fp.

Open in hackernews

Meta bypassed Apple privacy protections, claims former employee

https://9to5mac.com/2025/08/21/meta-allegedly-bypassed-apple-privacy-measure-and-fired-employee-who-flagged-it/
90•latexr•2h ago

Comments

daft_pink•1h ago
I feel like everyone paying attention deep down knew that they were doing this. This is just the article that confirms it.
nujabe•1h ago
What were the signs ?
dylan604•1h ago
Like the hack they were doing to de-anonymize users?

https://arstechnica.com/security/2025/06/meta-and-yandex-are...

righthand•1h ago
15 years ago it was celebrated in the media as a “cool inventive cutting edge idea” that Facebook was running psychological experiments on it’s users without consent.
antiframe•1h ago
Most of the media I remember from that time was less celebratory and more skeptical. [1] [2] [3]

Do you have some examples of the media celebrating Facebook's psychological experiments? Perhaps you live in a different influence sphere or filter bubble than I do.

To check my centiment, I asked ChatGPT "What was the media sentiment ten years ago about Facebook running psychological experiments on people?" and here was its top-line response:

> Short answer: largely negative — shocked and critical. Journalists, ethicists and privacy advocates framed Facebook’s secret “emotional contagion” experiments as an ethical breach (lack of informed consent, manipulation of users’ moods, corporate research without proper oversight), while a smaller group of commentators pushed back saying large-scale A/B testing is routine for tech firms.

[1]: https://www.wired.com/2014/06/everything-you-need-to-know-ab... [2]: https://www.cnet.com/tech/services-and-software/the-ethical-... [3] https://www.yahoo.com/news/facebook-changed-way-experiments-...

thewebguyd•1h ago
Surely Apple also knows this, so when are they going to follow their own App Store policy and pull Meta's apps off the platform?

They won't because rules for thee, not for me. It's OK if someone big enough violates Apple's rules, but if a smaller dev does it? You get booted off the store.

andy_ppp•1h ago
They probably have an agreement that involves money and anticompetitive behaviour.
ceejayoz•1h ago
Same for Uber, which sends both important order updates and marketing as push notifications.

https://developer.apple.com/design/human-interface-guideline... says "before you send [marketing push] notifications to people, you must receive their explicit permission to do so".

latexr•1h ago
> Uber, which sends (…) marketing as push notifications.

Apple themselves have started doing that, so zero chance of the rule being enforced.

> https://developer.apple.com/design/human-interface-guideline... says

Those are the Human Interface Guidelines, which are basically suggestions on how to make a proper app. They don’t impact policy and Apple has been shitting on them for years now. Liquid Glass breaks so many rules it’s not even funny. What you want to link to is the App Review Guidelines, specifically 4.5.4.

https://developer.apple.com/app-store/review/guidelines/#4.5...

ceejayoz•1h ago
4.5.4 is more important, and agrees with the "you must" bit in the HIG.

"Push Notifications should not be used for promotions or direct marketing purposes unless customers have explicitly opted in to receive them via consent language displayed in your app’s UI, and you provide a method in your app for a user to opt out from receiving such messages. Abuse of these services may result in revocation of your privileges."

> Apple themselves have started doing that

Well, it's their platform. They've their own internal rules and app review processes, one would presume. Like how the cops can shoot people, but I can't.

latexr•1h ago
> 4.5.4 is more important

That’s the one I wanted to link to. Fixed. Thank you.

> and agrees with the "you must" bit in the HIG.

I know. The point is that the HIG is not used to enforce app policy, the App Review Guidelines are.

> They've their own internal rules and app review processes, one would presume.

Which is exactly why they are in trouble with governments around the world.

> Like how the cops can shoot people, but I can't.

Cops can’t just shoot people (well, maybe in the US?), they have to have a reason. In any civilised nation, a cop who shoots a random person doesn’t just get a pat on the back and a thumbs up. They are meant to be public servants who help enforce the law, not vigilantes who stand above it.

kmlx•3m ago
> Same for Uber, which sends both important order updates and marketing as push notifications.

can be disabled via:

settings > communication > push notifications

but the worst part is when they add a new category (eg uber teen accounts) and surprise it’s enabled by default.

Isamu•47m ago
>Surely Apple also knows this

No, this is not as simple as Meta calling internal APIs that can be detected. This is Meta developing tricky ways of identifying users from patterns of usage without regard to opt-in. If users consent, the app can use the Apple API to track. Easy. If users don’t consent, Meta tracks through tricks matching behavior stored on their servers.

This is Meta abiding by the letter of the Apple developer agreement but not the spirit of the agreement.

ceejayoz•27m ago
> No, this is not as simple as Meta calling internal APIs that can be detected.

Yes, it is. It's just more manual.

Meta has repeatedly done this sort of thing. It's clear that Apple knows they're up to this stuff, and it's clear that Meta will continue to do it, and it's clear that Apple doesn't have the will to kill their apps over it.

Which they would absolutely do for an app you or I made.

SoftTalker•8m ago
And it doesn't even really matter if it's perfect. While they are subverting the intent of their users, they are also certainly subverting the intent of their advertisers and portraying a targeting ability that is an exaggeration of what they actually can do. The advertisers may even realize it; in advertising no targeting is perfect, and if your ads are within the blast radius of most of your intended eyeballs, that's good enough.
electric_muse•1h ago
When the incentives are this large, it’s just too profitable to not “be evil.” We can decry this, but it’s just human nature.

I also think this is a sign of late stage capitalism where the opportunities to profit “ethically” are becoming much harder to find and exploit. That leads to more pressure to find gray areas that others’ ethical or moral convictions prevented them from exploiting.

I just installed graphene os on a brand new cash-bought pixel for the express purpose of not being left out of some important WhatsApp groups or missing out on some other experiences that require installing apps that I know won’t respect my privacy. I assume anything from Meta is hazardous at this point.

KerrAvon•1h ago
> it’s just human nature

It's not, though. The universal avarice of the current era may not be unprecedented in history, but it wasn't the norm through most of the 20th century. There was a time when layoffs were considered painful failures at some corporations, instead of routine business strategy -- probably because the Great Depression was still in living memory.

thepryz•1h ago
I assume this is a secondary phone? Curious as I’ve been contemplating the same thing
gruez•5m ago
>I just installed graphene os on a brand new cash-bought pixel for the express purpose of not being left out of some important WhatsApp groups or missing out on some other experiences that require installing apps that I know won’t respect my privacy. I assume anything from Meta is hazardous at this point.

There isn't much point in the "cash-bought" part when android has blocked non-system apps from reading hardware identifiers years ago. Not to mention that facebook can easily deanonmyize you through your social graph.

ChrisArchitect•1h ago
Source story from August: https://www.ft.com/content/be6a99d2-22de-48ec-9afa-1d2e2f709...
gruez•12m ago
>Meta also secretly linked user data with other information to track users’ activity on other websites without their permission — despite Apple in 2021 introducing measures explicitly requiring consent, according to Purkayastha’s filings.

That's frustratingly vague, not to mention it hinges on the complaint of a disgruntled employee. Facebook finding some way to bypass cross app tracking restrictions would be much more controversial than if they bought purchasing data (grouped by email) from data brokers, and then joined that with their own datasets, for instance.

caycep•48m ago
is this the incident where Apple pulled Meta's developer licenses or is this a new breach?
toast0•19m ago
IIRC, Apple pulled Facebook's enterprise developer cert over Onavo stuff; again IIRC, Apple had pulled Onavo from the app store, and Facebook continued to offer it to users by enrolling them in the enterprise developer system; on January 30, 2019 Apple revoked that cert: Onavo distribution was stopped in addition to Facebook's internal apps.

This article says it's about Apple’s App Tracking Transparency (ATT), introduced in 2021. Facebook changed their name to Meta in 2021 as well.

netdur•29m ago
Meta is run by people with no regard for ethics, and if that surprises you, that’s on you. Their whole model is just packaging and selling you with whatever tech they can grab. If you’re worried, don’t install Meta apps. I’ve got WhatsApp on Android and Instagram on iPad, They’re already getting eaten alive by TikTok and AI girlfriends
ujkhsjkdhf234•19m ago
Most people are not the Hacker News types who know this. The Facebook movie is the closest the average person has come to knowing how evil this company is.
SoftTalker•3m ago
Most people if they know, don't care. They don't see an issue with their data being harvested and sold. They think "who cares, why would anyone be interested in me, besides, everyone does it."

They use supermarket loyalty cards to save $0.25 on a gallon of milk. They install tracker apps to save money on gas. People don't care.

rchaud•25m ago
> Meta relied heavily on selling personalized advertising, which required it to be able to target particular demographics and interest groups. This was achieved by tracking individual users across different apps.

Yet another reason to dump native apps (many of which are built using the Facebook SDK despite having nothing to do with FB) in favour of web apps.

ujkhsjkdhf234•18m ago
I like my native apps and I'm not a fan of PWAs because they cannot be made to easily run offline.
nickthegreek•7m ago
running meta's social media apps offline doesn't seem particular compelling.

Hosting a website on a disposable vape

https://bogdanthegeek.github.io/blog/projects/vapeserver/
577•dmazin•4h ago•228 comments

Launch HN: Trigger.dev (YC W23) – Open-source platform to build reliable AI apps

58•eallam•1h ago•28 comments

PayPal to support Ethereum and Bitcoin

https://newsroom.paypal-corp.com/2025-09-15-PayPal-Ushers-in-a-New-Era-of-Peer-to-Peer-Payments,-...
137•DocFeind•3h ago•96 comments

Wanted to spy on my dog, ended up spying on TP-Link

https://kennedn.com/blog/posts/tapo/
26•kennedn•51m ago•3 comments

CubeSats are fascinating learning tools for space

https://www.jeffgeerling.com/blog/2025/cubesats-are-fascinating-learning-tools-space
92•warrenm•3h ago•27 comments

How big a solar battery do I need to store all my home's electricity?

https://shkspr.mobi/blog/2025/09/how-big-a-solar-battery-do-i-need-to-store-all-my-homes-electric...
102•FromTheArchives•4h ago•152 comments

Programming Deflation

https://tidyfirst.substack.com/p/programming-deflation
64•dvcoolarun•3h ago•31 comments

Boring Work Needs Tension

https://iaziz786.com/blog/boring-work-needs-tension/
19•iaziz786•1h ago•3 comments

How to self-host a web font from Google Fonts

https://blog.velocifyer.com/Posts/3,0,0,2025-8-13,+how+to+self+host+a+font+from+google+fonts.html
49•Velocifyer•2h ago•55 comments

RustGPT: A pure-Rust transformer LLM built from scratch

https://github.com/tekaratzas/RustGPT
283•amazonhut•7h ago•133 comments

Asciinema CLI 3.0 rewritten in Rust, adds live streaming, upgrades file format

https://blog.asciinema.org/post/three-point-o/
17•ku1ik•1h ago•0 comments

Removing newlines in FASTA file increases ZSTD compression ratio by 10x

https://log.bede.im/2025/09/12/zstandard-long-range-genomes.html
184•bede•3d ago•73 comments

Show HN: Daffodil – Open-Source Ecommerce Framework to connect to any platform

https://github.com/graycoreio/daffodil
30•damienwebdev•2h ago•2 comments

Self-Assembly Gets Automated in Reverse of 'Game of Life'

https://www.quantamagazine.org/self-assembly-gets-automated-in-reverse-of-game-of-life-20250910/
7•kjhughes•3d ago•0 comments

Apple has a private CSS property to add Liquid Glass effects to web content

https://alastair.is/apple-has-a-private-css-property-to-add-liquid-glass-effects-to-web-content/
173•_alastair•2h ago•92 comments

Microsoft to force install the Microsoft 365 Copilot app in October

https://www.bleepingcomputer.com/news/microsoft/microsoft-to-force-install-the-microsoft-365-copi...
48•mikece•57m ago•14 comments

Folks, we have the best π

https://lcamtuf.substack.com/p/folks-we-have-the-best
258•fratellobigio•10h ago•71 comments

A string formatting library in 65 lines of C++

https://riki.house/fmt
10•PaulHoule•1h ago•7 comments

The Mac App Flea Market

https://blog.jim-nielsen.com/2025/mac-app-flea-market/
184•ingve•10h ago•96 comments

Language Models Pack Billions of Concepts into 12k Dimensions

https://nickyoder.com/johnson-lindenstrauss/
313•lawrenceyan•13h ago•107 comments

Show HN: I reverse engineered macOS to allow custom Lock Screen wallpapers

https://cindori.com/backdrop
52•cindori•8h ago•35 comments

Creating a VGA Signal in Hubris

https://lasernoises.com/blog/hubris-vga/
15•lasernoises•2h ago•2 comments

Meta bypassed Apple privacy protections, claims former employee

https://9to5mac.com/2025/08/21/meta-allegedly-bypassed-apple-privacy-measure-and-fired-employee-w...
91•latexr•2h ago•35 comments

Death to type classes

https://jappie.me/death-to-type-classes.html
81•zeepthee•3d ago•50 comments

A qualitative analysis of pig-butchering scams

https://arxiv.org/abs/2503.20821
154•stmw•13h ago•86 comments

Which NPM package has the largest version number?

https://adamhl.dev/blog/largest-number-in-npm-package/
140•genshii•14h ago•59 comments

Pgstream: Postgres streaming logical replication with DDL changes

https://github.com/xataio/pgstream
45•fenn•4h ago•3 comments

Show HN: Semlib – Semantic Data Processing

https://github.com/anishathalye/semlib
29•anishathalye•3h ago•9 comments

The Culture novels as a dystopia

https://www.boristhebrave.com/2025/09/14/the-culture-novels-as-a-dystopia/
45•ibobev•8h ago•85 comments

Not all browsers perform revocation checking

https://revoked-isrgrootx1.letsencrypt.org/
81•sugarpimpdorsey•14h ago•69 comments