Perfect Timing: Twitch Gets Compromised With Voluminous Leak Of Data Via Torrent

from the here-we-go-again dept

It's no secret that Amazon-owned Twitch has had a rough go of it for the past year or so. We've talked about most, if not all, of the issues the platform has created for itself: a DMCA apocalypse, a creative community angry about not being informed over copyright issues, unclear creator guidelines for content that result in punishment from Twitch while some creators happily test the fences on those guidelines, and further and ongoing communication breakdowns with creators. All of that, mind you, has taken place over the last 12 months. It's been bad. Really bad!

But great news: now it's even worse! Someone managed to get into the Twitch platform and leak it. As in pretty much all of it. And even some information on a Steam-rival Amazon is planning to release. Seriously.

An anonymous hacker claims to have leaked the entirety of Twitch, including its source code and user payout information.

The user posted a 125GB torrent link to 4chan on Wednesday, stating that the leak was intended to “foster more disruption and competition in the online video streaming space” because “their community is a disgusting toxic cesspool”.

The leaked Twitch data reportedly includes:

-The entirety of Twitch’s source code with comment history “going back to its early beginnings”

-Creator payout reports from 2019

-Mobile, desktop and console Twitch clients

-Proprietary SDKs and internal AWS services used by Twitch

-“Every other property that Twitch owns” including IGDB and CurseForge

-An unreleased Steam competitor, codenamed Vapor, from Amazon Game Studios

-Twitch internal ‘red teaming’ tools (designed to improve security by having staff pretend to be hackers)

As you can see, yeah, pretty much everything. And keep in mind that whoever leaked this via torrent has noted that this is "part 1". Now, while a great deal of attention is being paid to Vapor, an unreleased platform created by Amazon to compete with Steam, let's focus instead on the release of the financial compensation for Twitch creators. Because this represents yet another failure by Twitch to protect its own creative community.

How detailed are these financial records. Extremely, as it turns out, with names and dollar amounts attached so that enterprising individuals are able to rank them. For instance, my own beloved Critical Role appears to be the top Twitch earner since 2019.

Now, I love Critical Role and am quite pleased that they're doing so well for themselves. But I'm pretty sure they also aren't loving their exact compensation through Twitch being out there for the entire world to see. I need to avoid getting into a victim-blaming issue here, since Twitch is very much a victim of this hack/compromise/leak... but we also don't have details from Amazon as to how this leak occurred, only that it is authentic. The next question is obvious: did Twitch do something stupid that left itself vulnerable to this sort of thing?

We don't know. But this is the problem when a platform torches its reputation among its own creative like Twitch has over the last year or so. There's no goodwill in the bank for Twitch to rely on as it navigates through the fallout of all this. And, while it's worth noting that the person posting this leak claims they did so out of anger with how Twitch operates and its "toxic cesspool" of a community, the public and media framing of this leak has shown little sympathy for the platform overall.

This all comes at a time of much tribulation for Twitch, with the #DoBetterTwitch/#TwitchDoBetter hashtags at the forefront of efforts by users to demand a better service from the platform, including boycotts to demand action over hate raids. Twitch seems to be making some positive moves, but then always finds a way to do something terrible too.

If Twitch wants to start repairing this reputation, it should be in full "good PR" mode: admit what happened, be transparent, do not talk about other great things you've done, build a plan to repair this. Sadly, given Twitch's history, it's an open question whether it will do the right thing or not.

Filed Under: data leak, live streamers
Companies: amazon, twitch

AT&T Set Up And Paid For OAN Propaganda Network; Yet Everyone Wants To Scream About Facebook

from the ill-communication dept

We've noted for a while there's a weird myopia occurring in internet policy. As in, "big tech" (namely Facebook, Google, and Amazon) get a relentless amount of Congressional and policy wonk attention for their various, and sometimes painfully idiotic behaviors. At the same time, just an adorable smattering of serious policy attention is being given to a wide array of equally problematic but clearly monopolized industries (banking, airlines, insurance, energy), or internet-connected sectors that engage in many of the same (or sometimes worse) behaviors, be they adtech or U.S. telecom.

Case in point: while the entirety of U.S. policy experts, lawmakers, journalists, and academics (justifiably) fixated on the Facebook whistleblower train wreck, a story popped up about AT&T. Basically, it showcased how AT&T not only provided the lion's share of funding for the propaganda-laden OAN cable TV "news" network, the entire thing was AT&T's idea in the first place, and simply wouldn't exist without AT&T's consistent support:

"They told us they wanted a conservative network,” Herring said during a 2019 deposition seen by Reuters. "They only had one, which was Fox News, and they had seven others on the other [leftwing] side. When they said that, I jumped to it and built one."

It was previously known that AT&T was one of the few major cable TV distributors to carry OAN, therefore providing 90% of the channel's revenue (even Comcast long refused to carry the network). That's not surprising, given how well inflammatory bullshit sells. But it wasn't previously known how closely linked the two companies were, with OAN claiming AT&T even utilized the network to help put a positive shine on the company's disastrous, $200 billion, job-killing megamerger spree:

"[AT&T told OAN's owner AT&T] needed help to allay FCC and other officials’ concern that the DirecTV deal – a consolidation of providers – might make it harder for independent networks to get on the air, Charles Herring said.

So, he said in the affidavit, Slator proposed a new deal: If the Herrings lobbied on AT&T’s behalf, AT&T would air OAN and WealthTV on both U-verse and DirecTV. The Herrings would be paid one-third less per subscriber, but because DirecTV had so many more subscribers, the deal could be worth $100 million over five years...The court filings also cite a promise by OAN to “cast a positive light” on AT&T during newscasts."

Given the sheer scope of the propaganda being funneled through online platforms, cable TV news channels like OAN are often dismissed as less relevant. But in a nation where elections are often decided by a few hundred votes, a dedicated propaganda network (one at the direct beck and call of Donald Trump) really can make all the difference, media experts say:

"If you have 12 Americans being fed a diet of untruth, that’s 12 too many – and here, it’s literally millions,” Watson said of the OAN audience. “When you have that sort of poisonous influence on mass media, it’s a problem; because elections in the United States tend to be so close, a few percentage points here or there can really make a difference."

The story saw a tiny fraction of the mind-space usually reserved for modern day issues surrounding "big tech." While Facebook certainly deserves intense scrutiny for very serious screw ups, there's an obvious asymmetry in policy and media attention when it comes to "big telecom." That apathy extends to the Biden government, which rushed to appoint a big tech critic at the FTC in Lina Khan, but still hasn't been bothered to staff the nation's two top telecom and media regulators, the NTIA and FCC. This despite the fact COVID has highlighted broadband's importance, and issues like media consolidation are more important than ever in the face of a struggling news industry and soaring propaganda.

However bad Facebook is (and I 100% agree with complaints that its executives are monumentally terrible), think about this: in just the last few years AT&T has been: fined $18.6 million for helping rip off programs for the hearing impaired; fined $10.4 million for ripping off a program for low-income families; fined $105 million for helping "crammers" by intentionally making such bogus charges more difficult to see on customer bills; fined $60 million for lying to customers about the definition of "unlimited" data; caught in a scandal in which the company paid Trump's fixer $600,000 for closer access to the President; fined $7.7 million for turning a blind eye to drug dealers running directory assistance scams; caught lying about its claims it stopped funding politicians supporting January 6 insurrectionists; and was accused of ripping off the nations school systems for years by one of its own, former lawyers. I'm sure I missed some.

Now AT&T has been found to be not only the primary backer, but the brain child of an outright propaganda network that's so extreme, it's to the far right of Fox News. A network that routinely promotes anti-democratic election conspiracy theories, as well as anti-science COVID hysteria.

The occasional, piddly fine is laughable to a company that enjoys not only a regional broadband monopoly in many parts of the country, but received a $42 billion tax break from the Trump administration for doing absolutely nothing (technically less than nothing, given it has laid off roughly 50,000 employees since the 2017 cut). Tethered to both our domestic surveillance and first responder systems, AT&T is largely immune to serious government accountability because it's effectively now a patriotic part of government. It shouldn't be.

Where's the week long hearing about AT&T getting billions in subsidies and tax breaks in exchange for nothing? Where's the several-year exclusive media focus on the shoddy state of U.S. telecom and media? Where's the Congressional hearing about how cable and telecom giants are funding and promoting outright, blatant propaganda? Where's the endless parade of think pieces and deep dives into these problems? Why has Facebook, and big tech, completely dominated the policy discourse? Why are we seemingly incapable of chewing gum and walking at the same time?

We haven't seemed to figure out yet that it's all one, over-arching problem tethered to consolidation, monopolization, antitrust apathy, regulatory dysfunction, and corruption. "Big telecom" is seeing a tiny fraction of the scrutiny of "big tech," something the telecom sector is actively encouraging. Similarly, countless U.S. industries are filled with sectors dominated by heavily consolidated giants, created by the mindless rubber stamping of terrible mergers. Not a one is seeing equal levels of scrutiny. I'm not saying we shouldn't be heavily scrutinizing Facebook and technology giants, whose failures are clearly established. I'm just saying that the bizarre asymmetrical policy myopia -- where "big tech" is seemingly all that matters -- is starting to drive me a little batshit.

Filed Under: big tech, cable news, charles herring, disinformation, propaganda, tv news
Companies: at&t, directv, facebook, oan

Court Documents Show The FBI Used A Whole Lot Of Geofence Warrants To Track Down January 6th Insurrectionists

from the easier-to-do-when-most-people-are-in-an-area-illegally dept

The new hotness for law enforcement isn't all that new. But it is still very hot, a better way to amass a list of suspects when you don't have any particular suspect in mind. Aiding and abetting in the new bulk collection is Google, which has a collection of location info plenty of law enforcement agencies find useful.

There's very little governing this collection or its access by government agencies. Most seem to be relying on the Third Party Doctrine to save their searches, which may use warrants but do not use probable cause beyond the probability that Google houses the location data they're seeking.

Law enforcement agencies at both the local and federal levels have availed themselves of this data, using "geofences" to contain the location data sought by so-called "reverse warrants." Once they have the data points, investigators try to determine who the most likely suspect(s) is. That becomes a bigger problem when the area contained in the geofence contains hundreds or thousands of people who did not commit the crime being investigated.

These warrants have been used to seek suspects in incidents ranging from arson to... um... protesting police violence. They've also been used to track down suspects alleged to have raided the US Capitol building on January 6, 2021 -- the day some Trump supporters decided (with the support of several prominent Republicans, including the recently de-elected president) that they could change the outcome of a national election if they committed a bunch of federal crimes.

Plenty of those suspects outed themselves on social media. For everyone else, there's reverse warrants, as reported by Wired. (h/t Michael Vario)

Court documents suggest the FBI has been using controversial geofence search warrants at a scale not publicly seen before, collecting account information and location data on hundreds of devices inside the US Capitol during a deadly invasion by a right-wing mob on January 6.

While Google receives over 10,000 geofence warrants for location data in the US a year, those covering the Capitol breach appear to have been particularly productive, apparently enabling the FBI to build a large, searchable database in its hunt for the rioters.

Well, the documents do more than "suggest." The underlying warrants are likely still sealed, so some conjecture is involved. But other stuff has leaked out around the redactions and the sealing, showing the FBI was issuing warrants even while the attempted insurrection was still underway. The feds can move fast when needed, apparently. This is from a criminal complaint related to Mitchell Vukich -- one Capitol raider who not only tweeted he was inside the Capitol while still apparently in the Capitol ("I was one of the first 15 people in the #Capitol. Wild stuff. Be safe out there."), but was caught on several security cameras as he made his way through the building and seemingly ran off with some government documents.

According to records obtained through a search warrant which was served on Google, on January 6, 2021, in and around the time of the incident, a mobile device associated with mitchellvukich66@gmail.com was present at and in the interior of the U.S. Capitol on January 6, 2021.

However you may feel about the Asshat Revolution of January 6th, this isn't an ideal -- or even an acceptable -- way to conduct an investigation. Reverse warrants make everyone in the area a criminal suspect. Probable cause doesn't exist. It does in terms of Google: there's a highly probable chance the company has location data captured in areas under investigation. But law enforcement asks for all of it and works backwards to find suspects. Once it does that, it has probable cause to seek identifying information. But this method inverts the accepted (under the Fourth Amendment) formula for performing searches.

And, since the search warrant (as well as the results of the search) are still secret, we can only assume the FBI acted in good faith. It may not have.

“What might have happened is that the FBI got the anonymized data and just got straight back in touch with Google and said we suspect 90 percent of these people, so give us their IDs,” says Matthew Tokson, a law professor and Fourth Amendment expert at the University of Utah. “Or it may have been an atypical warrant where they said to Google: Give us not only the numbers but the account names, because we think we have probable cause on the bulk of them.”

And that's the concern law enforcement can keep from being addressed by asking for (and receiving) permission to seal warrant affidavits and discussions of this investigative technique, even though the technique is known and understood and already widely discussed in the public arena.

Suspects who think they can beat these warrants actually can't. A lot of that can be traced back to Google, which has never been completely honest about its location data harvesting. Some of that can be pinned on the suspects, who fail to understand that a factory reset only affects data stored on that device.

[C]ourt documents say that Jeffrey Register deleted photographs of his time in the Capitol and even claimed to have factory-reset his phone in the days after the breach to obscure his tracks. It was already too late; the FBI appears to have identified him from the Google geofence data in January…

That's the kind of thing that happens when you're cosplaying insurrection, OPSEC is an afterthought. For the people hunting you down, however, finding and acquiring reams of culpatory data is the thing they get paid to do. Getting high on your own supply of confirmation bias can have consequences, especially when it involves the impromptu violation of federal laws.

But at the end of all this is the skyrocketing use of reverse warrants to identify criminal suspects. That it has only resulted in a few false arrests is a miracle, not an endorsement of the investigative technique. While there has been occasional pushback against inverting the constitutional status quo, the large number of geofence warrants served to Google every year suggest law enforcement isn't too worried about losing access to a powerful tool that takes full advantage of private companies' apparently unslakable thirst for personal data.

Filed Under: 4th amendment, doj, fbi, geofence warrants, january 6th

Daily Deal: The All-in-One Microsoft, Cybersecurity, And Python Exam Prep Training Bundle

from the good-deals-on-cool-stuff dept

The All-in-One Microsoft, Cybersecurity, and Python Exam Prep Training Bundle has 6 courses to help you learn the skills you need to succeed as a tech professional. The courses cover Python 3, software development, ITIL, cybersecurity, and GDPR compliance. Exams covered include: MTA 98-381, MTA 98-361, the ITIL Foundation v4 exam, PCEP Certified Entry-Level Python Programmer Certification Exam, CompTIA CySA+ Certification Exam, and GDPR CIPP/E Certification Exam. It's on sale for $29.

Note: The Techdirt Deals Store is powered and curated by StackCommerce. A portion of all sales from Techdirt Deals helps support Techdirt. The products featured do not reflect endorsements by our editorial team.

If Your Takeaway From Facebook's Whistleblower Is That Section 230 Needs Reform, You Just Got Played By Facebook

from the that's-what-it-wants dept

Here we go again. Yesterday, the Facebook whistleblower, Frances Haugen, testified before the Senate Commerce Committee. Frankly, she came across as pretty credible and thoughtful, even if I completely disagree with some of her suggestions. I think she's correct about some of the problems she witnessed, and the misalignment of incentives facing Facebook's senior management. However, her understanding of the possible approaches to deal with it is, unfortunately, a mixed bag.

Of course, for the Senators in the hearing, it became the expected exercise in confirmation bias, in which they each insisted that their plan to fix the internet would solve the problems Haugen detailed. And, not surprisingly, many of them insisted that Section 230 was the issue, and that if you magically changed 230 and made companies more liable, they'd somehow be better. Leaving aside that there is zero evidence to support this (and plenty of evidence to suggest the opposite is true), the most telling bit in all of this is that if you think changing Section 230 is the answer Facebook agrees with you. It's exactly what Facebook wants. See the smarmy, tone-deaf, self-serving statement the company put out in response to the hearing:

Today, a Senate commerce subcommittee held a hearing with a former product manager at Facebook who worked for the company for less than two years, had no direct reports, never attended a decision-point meeting with C-level executives -- and testified more than six times to not working on the subject matter in question. We don't agree with her characterization of the many issues she testified about. Despite all this, we agree on one thing; it's time to begin to create standard rules for the internet. It's been 25 years since rules for the internet have been updated, and instead of expecting the industry to make societal decisions that belong to legislators, it is time for Congress to act.

Facebook has been blanketing Washington DC (and elsewhere, but mostly DC) with ads saying that it's time to update internet laws that haven't changed since 1996. And that message is very clearly talking about Section 230.

Earlier this year, also in front of Congress, Mark Zuckerberg came out in favor of Section 230 reform. The company's plan really isn't all that different than what some elected officials are now proposing in a variety of short-sighted bills: increase liability on the companies for failure to have "best practices." But as we've noted, what's clear is that Facebook is one of the few companies that can afford that liability. Facebook can afford the expensive lawyers to go to court and show that their system of dealing with this stuff (which we already know doesn't work very well) is a "best practice" leading them to get these cases dismissed.

Smaller companies are going to be bankrupted by this. And those that aren't bankrupted are going to end up turning to Facebook to handle their moderation, so that they can rely on Facebook's legal might. It's going to entrench Facebook's power position, limit competition, and wipe out more innovative approaches. Of course Facebook supports this nonsense.

So for those who are still supporting changes to Section 230 and even pointing to Haugen's testimony: congrats, you got played by Facebook. You're advocating for exactly what Facebook wants.

I forget who I've heard say this (perhaps it was Cory Doctorow?), but, paraphrasing, the statement was that of course a company would prefer no regulation, but the 2nd best thing to no regulation is being heavily regulated, because as long as you're at the top of the heap and know you can deal with the regulators, you've got a massive advantage that no other company can deal with. And, for a company that is so paranoid about competition, and is unsure how to continue winning against upstarts, leaning on the US government to "regulate" the space is a godsend. It's exactly what Facebook wants, and those supporting it are playing into Facebook's hands.

Filed Under: competition, congress, frances haugen, intermediary liability, section 230, whistleblower
Companies: facebook

FCC Finally Gets Off Its Ass To Combat SIM Hijacking

from the better-late-than-never dept

So for years we've talked about the growing threat of SIM hijacking, which involves an attacker covertly porting out your phone number from right underneath your nose (sometimes with the help of bribed or conned wireless carrier employees). Once they have your phone identity, they have access to most of your personal accounts secured by two-factor SMS authentication, opening the door to the theft of social media accounts or the draining of your cryptocurrency account. If you're really unlucky, the hackers will harrass the hell out of you in a bid to extort you even further.

It's a huge mess, and the both the criminal complaints -- and lawsuits against wireless carriers for not doing more to protect their users -- have been piling up for several years. For several years, Senators like Ron Wyden have been sending letters to the FCC asking the nation's top telecom regulator to, you know, do something. After years of inaction the agency appears to have gotten the message, announcing a new plan to at least consider some new rules to make SIM hijacking more difficult.

Most of the proposal involves nudging wireless carriers to do things they should have done long ago. Such as updating FCC Customer Proprietary Network Information (CPNI) and Local Number Portability rules to require wireless carriers adopt secure methods of confirming the customer’s identity before porting out a customer’s phone number to a new device or carrier (duh). As well as requiring that wireless carriers immediately notify you when somebody tries to port out your phone number without your permission (double duh):

"The FCC’s proposal would also require that wireless providers immediately notify customers whenever a SIM change or port request is made on customers’ accounts. That this wasn’t yet industry standard practice—or covered by FCC rules—speaks to the sluggishness with which the government and industry have responded to the problem."

Again, this lack of action until now was fairly reflective of the Ajit Pai school of thought on telecom policy, which basically involved coddling major telecom companies in the misguided belief that this regulatory apathy somehow results in free market utopia. But as we've established for years, while deregulation can help improve functional, competitive, healthy markets, that's not what U.S. telecom is. It's a bunch of government-coddled regional monopolies and duopolies, that, thanks to increased consolidation, face increasingly less meaningful competition. When you remove both competition (and pro-competitive policies) and regulatory oversight, you don't get a miraculous free market, you usually get... a bigger, fatter Comcast.

Note these aren't actual rules yet, it's just the beginning of new rules. The Rosenworcel FCC is basically doing the bare minimum here to start the ball rolling, launching a Notice of Proposed Rulemaking (NPRM) to begin discussing the path forward. That this wasn't even contemplated until now speaks volumes as to the state of U.S. telecom regulatory oversight. Folks have been having vast fortunes stolen from under their noses for several years (seriously read this story) because wireless carriers failed to secure their own services, and the response from the U.S. government until now had been a giant, collective yawn.

Filed Under: fcc, sim hijacking

Belgian Government Wants To Add Encryption Backdoors To Its Already-Terrible Data Retention Law

from the it-can-always-get-worse dept

Earlier this year, a data retention law passed by the Belgian government was overturned by the country's Constitutional Court. The law mandated retention of metadata on all calls and texts by residents for one year, just in case the government ever decided it wanted access to it. Acting on guidance from the EU Court on laws mandating indiscriminate data retention elsewhere in the Union, the Constitutional Court struck the law down, finding it was neither justified nor legal under CJEU precedent or under Belgium's own Constitution.

[T]he Constitutional Court finds that the Data Retention Act aims at broader objectives than safeguarding national security, combating serious crime and preventing serious threats to public security and that the interference is thus not limited to what is strictly necessary. In addition, the Constitutional Court points out that such requirement to retain traffic and location data should be the exception, not the rule, must set out clear and precise rules regarding the scope and application of such measure, whereby certain minimum requirements should be implemented, and should ensure that the interference is limited to what is strictly necessary.

That prompted an immediate rewrite and a hasty propulsion of the law through the legislative process. This ruling was handed down in April. By May 10th, the government had another legislative proposal ready to go. Then it expanded it, adding encrypted messaging services to the list of entities obliged to collect and retain communications metadata.

But the demands go even further than metadata. Either incapable or unwilling to understand how end-to-end encryption works, legislators want a form of encryption that can be stripped away whenever the government wants access to communications. This is from an open letter sent to the Belgian government by 81 organizations and cybersecurity experts.

The Draft law on the collection and storage of identification, traffic and location data in the electronic communications sector and their access by the authorities, or “the Data Retention Legislation,” would require operators of encrypted systems to enable law enforcement to be able to access on request content produced by specific users after a specified date in the future. That is, they would have to be able to “turn off” encryption for specific users.

If you can't see where this is going, you might be a Belgian legislator.

There is no way to simply “turn off” encryption; providers would need to create a new delivery system and send targeted users into that separate delivery system. Not only would this require significant technical changes, but it would thereby break the promises of confidentiality and privacy of end-to-end encrypted communications services.

It's a backdoor. Backdoors don't work. Or rather, they do, but then the encryption doesn't work. Legislators and those pressuring legislators to mandate encryption backdoors don't like to use that term, so they dance around it. In the US, they call it technical assistance or whatever the opposite of "warrant-proof encryption" is. In Belgium, they stuff it into a bill that originally targeted phone service providers and call it "data retention."

It's unclear how the legislature thinks this version will be found constitutional by the courts, unless it's relying on the addition of some minimal targeting requirements to change it from a bulk data collection the government can access at any time to a slightly smaller bulk data collection the government can access at any time -- one that now includes metadata collected by encrypted communications platforms which will have to backdoor their own encryption to comply with demands for data.

If this is allowed to become law, everyone's communications will be less secure, not just those belonging to people the state wants to surveil or lock up.

Undermining encryption by introducing backdoors to encrypted communications would leave Belgium exposed to attacks, including its journalists, doctors, lawyers, public sector employees, and other citizens, as well as businesses and institutions, including governments.

If that's an acceptable tradeoff for the government, the bill will become law. But it will have to survive another legal challenge once it goes live. And from what's seen here, it looks like more of the stuff that was already struck down by the court, only with bonus encryption backdoors. If Belgian legislators aren't willing to protect their constituents, hopefully the courts will pick up the slack.

Filed Under: backdoors, belgium, data retention, encryption, surveillance

Tone Deaf Facebook Did Cripple VR Headsets When Borked BGP Routing Took Down All Of Facebook

from the who-could-have-predicted? dept

For over a year now, we have discussed Facebook's decision to require users of Oculus VR headsets to have active Facebook accounts linked to the devices in order for them to work properly. This decision came to be despite all the noise made by Oculus in 2014, when Facebook acquired the VR company, insisting that this very specific thing would not occur. Karl Bode, at the time, pointed out a number of potential issues this plan could cause, noting specifically that users could find their Oculus hardware broken for reasons not of their own making.

The changes will also impact the functionality of Oculus Quest's "Link," which lets users connect the standalone VR headset to a PC to expand its functionality. It also begs the question: what happens if you get banned by Facebook due to its incoherent and inconsistent moderation strategies? You suddenly can't use your VR headset because Facebook's algorithms stupidly ban you for posting photos of yourself breastfeeding?

And then, to the surprise of nobody here at Techdirt, a version of that very thing happened. Facebook users that had their accounts locked, typically due to having those accounts compromised by outside bad actors, found themselves unable to use their gear as normal and unable to get support through Facebook, especially if the issues were on legacy Oculus hardware for which the end user had not paid Facebook a penny. But a wonderful workaround was discovered! If those users went out and bought a brand new Oculus VR headset, suddenly Facebook support returned their messages.

None of this changed the core problem: what happens to owned hardware when suddenly a user's Facebook account wasn't accessible. Well, we all learned the answer to that question this week when Facebook accidentally decided to play a game of internet hide-and-seek by borking its BGP routing.

Facebook owns VR headset maker Oculus, and controversially requires Oculus Quest users to log in with a Facebook account. In numerous Reddit threads, many Quest owners say they have been able to use their headsets during the outage—to play VR games on Steam, for instance—but some say they can't load their Oculus libraries, and those who just took a Quest 2 out of the box have reported that they're unable to complete the initial setup.

"We're aware that some people are having trouble accessing our apps and products," Oculus wrote in one thread. "The teams are hard at work getting things back to normal as quickly as possible, and we apologize for any inconvenience."

It should be noted that these are problems of Facebook's making, not end users. The decision to require linked Facebook accounts to use the features on the Oculus created this problem. And, frankly, it was a decision that rendered no true benefit to the customer. Facebook made this move specifically so that it could track user behavior for advertising purposes, all under the guise of just how great and easy it is for Oculus users to be able to login with just a Facebook account. Yawn.

But, when Facebook found all of its platforms unreachable on October 4th, Oculus owners got the tangential screw-job.

Facebook says that today's extended outage did not compromise user data—it was actually a pretty boring networking error.

"Our engineering teams have learned that configuration changes on the backbone routers that coordinate network traffic between our data centers caused issues that interrupted this communication, the company posted on its blog. "This disruption to network traffic had a cascading effect on the way our data centers communicate, bringing our services to a halt."

Services like a properly running and fully functional Oculus VR headset... for no reason other than Facebook greed. When you're very busy trying to make the claim that you aren't too big that you should be broken up, that you don't have too much control over the everyday lives of the public, or that you don't have too many tie-ins to daily life, well, this was not a good look.

Although, as I will never stop taking this victory lap on behalf of Karl Bode, it certainly was predictable.

Filed Under: bgp, downtime, oculus, vr
Companies: facebook