Alan Burlison's Work Related Ramblings

Friday January 18, 2008

Facebook faces privacy questions

Just noticed this report on the BBC News website:

That'll be me they are talking about...

Tuesday January 15, 2008

Number problems

I've just been looking at my son's maths homework, which is from the CGP Year Six Maths Workbook - Year Six in the UK is kids who are 10 to 11 years old. Here's the question:

I can think of four possible answers, depending on how you interpret the question:

1. 6, i.e. the hundreds digit of 4695 is 6
2. 600, i.e. the hundreds component of 4695 is 600
3. 46, i.e. 100 goes into 4695 46 times, with 95 left over
4. 46.95, i.e. 4695 ÷ 100

From previous experience with these books, it could be any of the first three possibilities, although the last one is an equally valid interpretation. No wonder the standard of maths in UK primary schools is so poor, if they have to use such frankly awful source material. Here's another example, from the next page:

If you think the answer is 1376.92, i.e. (17 × 6) + (98 ÷ 25 × 301) - 21 + 113, you'd be wrong. The answer they seem to be expecting is 2500, i.e. ((((((17 × 6) + 98) ÷ 25) × 301) - 21) + 113). I know that's the case because the kids aren't allowed to use calculators, so the answer will be an integer value. So much for the rules of operator precedence...

p.s. Thanks to @kangcool for spotting the maths error in the original version ;-)

Friday January 04, 2008

Facebook: and so it begins...

I just came across this security advisory via The Register. A malicious Facebook application is using social engineering techniques to persuade people to install spyware/adware on their machines:

I'm absolutely certain that this is just the first swell of an approaching tidal wave of Facebook malware. It isn't even a particularly clever example - it would be far more effective to use a Facebook application to harvest personal information whilst apparently offering a useful service, and then use the data elsewhere and/or at some time after the application was harvested. That would make it far more difficult for people to draw the connection between the harvesting app and the subsequent misuse of their personal data.

Currently there are more than 12,000 Facebook applications registered in Facebook. All you need to add an application to Facebook is an API key, and you can get one of those in seconds from the Facebook site, with no checking whatsoever by Facebook. The only mechanism Facebook seems to provide to 'protect' its users from malicious applications is a requirement that developers click on a checkbox to agree to Facebook's Developer Terms of Service. There's no vetting of the person applying for the API key, or of any applications they write.

After my previous experience of fighting with Facebook to get my account closed I'm not in the least bit surprised at their cavalier attitude to Facebook application security. I'm also doubtful that they have the resources necessary to vet 12,000+ applications even if they wanted to, and even if they did there's nothing to stop someone registering a benign version of the application and then activating the malign part after the application has been accepted.

I wonder if there's a need for an application that shows people just how much information they are agreeing to hand over when they install a Facebook application?