Ask HN: So what happened to Facebook "localhost" tracking?

107 pointsjuliusceasar19d ago103 comments

It was discussed a year ago. https://news.ycombinator.com/item?id=44235467

103 comments

55 comments · 9 top-level

woodrowbarlow19d ago· 20 in thread

i would love to have a software engineer's union, not so much to get better working conditions but to be able to say stuff like "i can't implement that unethical feature, it's against union rules and i'd lose my membership".

grayhatter19d ago

To be fair; you don't need a union... you can just say no. Context; I told them they couldn't ship this exact feature as designed. (It worked until I left.)

woodrowbarlow19d ago

yes, true sometimes (not always). but if more people have access to a way to confidently say "no" (with protection behind them), then i think saying "no" would happen more often, by people who might've otherwise complied.

Trasmatta19d ago

Without the protection of a union, "just saying no" is a good way to get fired

aforwardslash19d ago

Why not just ask for context and approval of the legal team? That would generate enough trail so some shady requirements get dropped almost immediately; having your superior explicitly sign off in writing a feature you deemed unethical and/or potentially illegal is a great way of actually removing them from the pipeline. You can even frame it as "a good guy" just alerting him/her that there may be a fallback, so make sure it has all necessary elements. Compliance decisions are often above a developers paygrade, and one should squarely document the culprit on any shady decision - and boy, this is very easy in big organizations where no single decision-maker wants to be accountable.

toast019d ago

You could join the Order of the Engineer and refuse to do things that would not be compatible with your understanding of the Obligation of an Engineer [1]. Of course, that doesn't stop your employer from asking someone else to do it and asking you to find other employment.

There's a few other orders or societies or what have you that you could join. Personally, I don't drive a train or even wear a stripey hat, so I haven't considered joining an organization for Engineers.

[1] https://order-of-the-engineer.org/about-the-order/obligation...

volkercraig19d ago

Start one. Unions are worker owned. You could also join the IWW.

woodrowbarlow19d ago

are there examples of unions that have started around a focus on the ethics of the services they provide? unions traditionally start locally, around issues for which the locality is a hotspot, which is why they usually focus on pay and working conditions. it's also easier to get a large group to agree on a set of improvements to working conditions vs a set of ethical boundaries.

1 more reply

actionfromafar19d ago

Unions in the US are nerfed, by law.

3 more replies

kube-system19d ago

I'd wonder how you'd get into that arrangement to begin with when the entire job is based on unethical tracking

theodorejb19d ago

You don't need to join a union to push back against unethical feature requests.

jakubadamw19d ago

The collective leverage of a union gives you significantly more power to do something like this.

1 more reply

chrncirurp19d ago

> You don't need to join a union to push back against unethical feature requests.

If you push back against unethical feature requests:

No union: you get fired

Union: you still get fired

4 more replies

absqueued19d ago

Take a lead, let me sign up :)

SoftTalker19d ago

And this is why we don't have one. Someone else is expected to do the hard part.

hasahmed19d ago

same

LadyCailin19d ago

That’s what licensing is for, not unions.

woodrowbarlow19d ago

i don't believe that software development should require a license. imagine having to get board-licensed to download gcc; therein lies the death of free software and owning your devices.

1 more reply

hluska19d ago

A union could absolutely get involved in something like this.

dzikimarian19d ago

Honestly - shouldn't one assume that train already departed when they decided to work for company that is basically data mining operation with no ethics?

ethagnawl19d ago

> not so much to get better working conditions but

... why not both?

applfanboysbgon19d ago· 12 in thread

> Meta must face a lawsuit alleging that it secretly tracked Android users' browsing activity on mobile websites that embedded Meta's analytics pixel, and linked that activity to users' identities, a federal judge ruled Monday.

> The decision, issued by U.S. District Court Judge Rita Lin in San Francisco, grew out of a class-action complaint initially brought last June by California resident Devin Rose (and later joined by other Android users).

> Rose alleged that between September 2024 and June 2025, Meta exploited Android's localhost -- a feature that allows software developers to test applications -- to connect users’ mobile web browsing to their Facebook and Instagram profiles.

May 12, 2026

Retr0id19d ago

Not at all to defend Meta but "a feature that allows software developers to test applications" is a dubious definition of localhost. I also can't come up with a better one.

furyofantares19d ago

It's not a definition, but it is an accurate statement.

1 more reply

austin-cheney19d ago

Here is the explicit definition of localhost.

The term "localhost" refers to the default entry in all modern operating system host files. By default modern operating systems provide a hosts file that provides domain name resolution without reliance upon the Domain Name System (DNS) protocol. By default these host files typically ship with one entry, a domain named "localhost" that points to IPv4 loopback interface 127.0.0.1.

2 more replies

iririririr18d ago

specially for this case, the localhost part is misleading.

what should have been the focus was "starting a shadow server on the use device, wide open for any application or webpage"

ChrisRR18d ago

Yes I was totally confused as that's not what I understood by localhost

istumbler19d ago

“A network interface which allows processes on the same internet host to communicate without the need for a network connection”

2 more replies

Velocifyer19d ago

“A loopback network interface” or “A interface that refers to the same host”.

SturgeonsLaw18d ago

"on the device itself"

1 more reply

gruez19d ago

docket: https://www.courtlistener.com/docket/70448987/in-re-meta-and...

Obscurity434019d ago

> Judge RitaLin

htx80nerd19d ago

im failing to see the connection

>standard pixel tracking, linked to meta (js , web)

>Meta exploited Android's localhost (os level)

netsharc19d ago

- Instagram/Facebook app listening on localhost port X.

- A website running JS on the browser tries to connect to localhost port X. If it succeeds it's now talking to Zuck's app.

- The JS can report whatever it wants to the app, and the app knows the identity of the browsing user, because ~100% of the time it's the user also logged into the app(s).

1 more reply

mozvalentin19d ago· 11 in thread

Chrome and Firefox have deployed / are deploying local-network-access which prompts the user when apps try this.

pezgrande19d ago

I guess that's why I am getting so many "Allow to find devices on your network" alerts. Good feature overall.

SoftTalker19d ago

Only a good feature if users have a clue what that question means. Most will click "Yes" because they want to get on with whatever they want to do.

Change it to something like "This website is trying to spy on your local devices, do you want to allow this?"

4 more replies

outside123419d ago

Ah, THAT's what that is. They really need to shift the message from the BROWSER is trying to find devices to the WEBSITE is trying to find devices.

RandomDistort19d ago

I get loads of them when I'm on a Netsweeper filtered network... pretty much any time any asset a page loads is from a blocked site (social media pixels normally).

lelandfe19d ago

I hate that there's no "stop asking me" button.

I get those regularly in Chrome

crtasm19d ago

I just discovered that MacOS was blocking Firefox from connecting to devices on my LAN - there's per-app toggle in system settings.

Access to my router's web interface was not blocked (understandably) but this left me rather confused for a while.

gh02t17d ago

This also got me on my partner's Macbook. For the longest time I couldn't figure out why I could access my local services on (Safari? I forget which one actually worked) but not on Firefox/Chrome.

shit_game19d ago

I was just about to say that my question in regards to this was "what are web browsers doing about it?"

Tade019d ago

I've seen it and at least in Chrome it seems to be treating all URLs which are based on an IP address as "local", regardless of the class of the address.

kibwen19d ago

I'd be inherently suspicious of any website in the wild attempting to contact a bare IP address. Aside from localhost, my default assumption would be that such a website is either trying to circumvent my hosts file (or circumvent my other DNS configuration, e.g. pi-hole or DNS-over-HTTPS), malware trying to reach a command-and-control server, or malware trying to circumvent my adblocker.

apitman19d ago

Any idea if Safari is on board?

throwa35626219d ago· 2 in thread

Off topic: I wonder how hard it is to poison this type of data gathering?

vorticalbox19d ago

Not hard, one could build an application that listens on common software ports and simply returns 200 for every request it gets.

Not sure how it would benefit you telling some website you run all the software.

Aachen19d ago

Is that a question?

KomoD19d ago· 1 in thread

Looks like they stopped doing it

https://localmess.github.io

> UPDATE: As of June 3rd 7:45 CEST, Meta/Facebook Pixel script is no longer sending any packets or requests to localhost. The code responsible for sending the _fbp cookie has been almost completely removed. Yandex has also stopped the practice we describe below.

hulitu18d ago

> almost

apitman19d ago

I've recently been exploring options for allowing web apps to access LAN services. For example, a WebDAV server so you can watch local videos in the app without streaming them through a server.

You can actually achieve a form of discovery if your service registers itself using mDNS for something like `service.local`. Browsers will allow direct navigation/redirection to `http://service.local`, but they'll block any fetch/XHR requests due to mixed content rules, even if you have CORS configured. And of course you can't get a cert for `.local` domains.

Newer things like Chrome's LNA[0] are actually really helpful, because (for now at least) if the user grants the permission, fetch/XHR will go through, but you'll get a bunch of mixed content warnings in the console.

It seems like the only way to fully support this use case currently is with WebRTC, which is pretty sad.

[0]: https://developer.chrome.com/blog/local-network-access

1vuio0pswjnm710d ago

The May 11, 2026 Order on defendants' Motion to Dismiss has now been uploaded to the Internet Archive

https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...

No claims were dismissed without leave to amend

Defendants have failed to stop this litigation from going forward

Expect a settlement before this moves into discovery

The Court's understanding of "localhost" in this Order may be less than complete but if this litigation progresses further and experts are retained then that could change

0john18d ago

This actually inspired me recently to create Pal Pipe for Android- https://gitlab.com/not_john/palpipe

1vuio0pswjnm719d ago

A timely question. Hopefully someone will share the recent Order and Third Amended Complaint

Since that discussion in 2025

Rose v Meta was consolidated with some other privacy cases against Meta

A first amended complaint was filed,^1 Google was added as a defendant

Defendants motion to dismiss was denied

A third amended complaint was filed on Monday

Here are the PDFs

1st amended complaint

https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...

Meta motion to dismiss

https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...

Google motion to dismiss

https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...

Plaintiffs response

https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...

Meta reply

https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...

Google reply

https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...

Order

(Payment required)

https://pacer.login.uscourts.gov/csologin/login.jsf?pscCourt...

2nd amended complaint

(Payment required)

https://pacer.login.uscourts.gov/csologin/login.jsf?pscCourt...

j / k navigate · click thread line to collapse

103 comments

55 comments · 9 top-level

woodrowbarlow19d ago· 20 in thread

grayhatter19d ago

To be fair; you don't need a union... you can just say no. Context; I told them they couldn't ship this exact feature as designed. (It worked until I left.)

woodrowbarlow19d ago

Trasmatta19d ago

Without the protection of a union, "just saying no" is a good way to get fired

aforwardslash19d ago

toast019d ago

[1] https://order-of-the-engineer.org/about-the-order/obligation...

volkercraig19d ago

Start one. Unions are worker owned. You could also join the IWW.

woodrowbarlow19d ago

1 more reply

actionfromafar19d ago

Unions in the US are nerfed, by law.

3 more replies

kube-system19d ago

I'd wonder how you'd get into that arrangement to begin with when the entire job is based on unethical tracking

theodorejb19d ago

You don't need to join a union to push back against unethical feature requests.

jakubadamw19d ago

The collective leverage of a union gives you significantly more power to do something like this.

1 more reply

chrncirurp19d ago

> You don't need to join a union to push back against unethical feature requests.

If you push back against unethical feature requests:

No union: you get fired

Union: you still get fired

4 more replies

absqueued19d ago

Take a lead, let me sign up :)

SoftTalker19d ago

And this is why we don't have one. Someone else is expected to do the hard part.

hasahmed19d ago

same

LadyCailin19d ago

That’s what licensing is for, not unions.

woodrowbarlow19d ago

i don't believe that software development should require a license. imagine having to get board-licensed to download gcc; therein lies the death of free software and owning your devices.

1 more reply

hluska19d ago

A union could absolutely get involved in something like this.

dzikimarian19d ago

Honestly - shouldn't one assume that train already departed when they decided to work for company that is basically data mining operation with no ethics?

ethagnawl19d ago

> not so much to get better working conditions but

... why not both?

applfanboysbgon19d ago· 12 in thread

May 12, 2026

Retr0id19d ago

Not at all to defend Meta but "a feature that allows software developers to test applications" is a dubious definition of localhost. I also can't come up with a better one.

furyofantares19d ago

It's not a definition, but it is an accurate statement.

1 more reply

austin-cheney19d ago

Here is the explicit definition of localhost.

2 more replies

iririririr18d ago

specially for this case, the localhost part is misleading.

what should have been the focus was "starting a shadow server on the use device, wide open for any application or webpage"

ChrisRR18d ago

Yes I was totally confused as that's not what I understood by localhost

istumbler19d ago

“A network interface which allows processes on the same internet host to communicate without the need for a network connection”

2 more replies

Velocifyer19d ago

“A loopback network interface” or “A interface that refers to the same host”.

SturgeonsLaw18d ago

"on the device itself"

1 more reply

gruez19d ago

docket: https://www.courtlistener.com/docket/70448987/in-re-meta-and...

Obscurity434019d ago

> Judge RitaLin

htx80nerd19d ago

im failing to see the connection

>standard pixel tracking, linked to meta (js , web)

>Meta exploited Android's localhost (os level)

netsharc19d ago

- Instagram/Facebook app listening on localhost port X.

- A website running JS on the browser tries to connect to localhost port X. If it succeeds it's now talking to Zuck's app.

- The JS can report whatever it wants to the app, and the app knows the identity of the browsing user, because ~100% of the time it's the user also logged into the app(s).

1 more reply

mozvalentin19d ago· 11 in thread

Chrome and Firefox have deployed / are deploying local-network-access which prompts the user when apps try this.

pezgrande19d ago

I guess that's why I am getting so many "Allow to find devices on your network" alerts. Good feature overall.

SoftTalker19d ago

Only a good feature if users have a clue what that question means. Most will click "Yes" because they want to get on with whatever they want to do.

Change it to something like "This website is trying to spy on your local devices, do you want to allow this?"

4 more replies

outside123419d ago

Ah, THAT's what that is. They really need to shift the message from the BROWSER is trying to find devices to the WEBSITE is trying to find devices.

RandomDistort19d ago

I get loads of them when I'm on a Netsweeper filtered network... pretty much any time any asset a page loads is from a blocked site (social media pixels normally).

lelandfe19d ago

I hate that there's no "stop asking me" button.

I get those regularly in Chrome

crtasm19d ago

I just discovered that MacOS was blocking Firefox from connecting to devices on my LAN - there's per-app toggle in system settings.

Access to my router's web interface was not blocked (understandably) but this left me rather confused for a while.

gh02t17d ago

This also got me on my partner's Macbook. For the longest time I couldn't figure out why I could access my local services on (Safari? I forget which one actually worked) but not on Firefox/Chrome.

shit_game19d ago

I was just about to say that my question in regards to this was "what are web browsers doing about it?"

Tade019d ago

I've seen it and at least in Chrome it seems to be treating all URLs which are based on an IP address as "local", regardless of the class of the address.

kibwen19d ago

apitman19d ago

Any idea if Safari is on board?

throwa35626219d ago· 2 in thread

Off topic: I wonder how hard it is to poison this type of data gathering?

vorticalbox19d ago

Not hard, one could build an application that listens on common software ports and simply returns 200 for every request it gets.

Not sure how it would benefit you telling some website you run all the software.

Aachen19d ago

Is that a question?

KomoD19d ago· 1 in thread

Looks like they stopped doing it

https://localmess.github.io

hulitu18d ago

> almost

apitman19d ago

I've recently been exploring options for allowing web apps to access LAN services. For example, a WebDAV server so you can watch local videos in the app without streaming them through a server.

It seems like the only way to fully support this use case currently is with WebRTC, which is pretty sad.

[0]: https://developer.chrome.com/blog/local-network-access

1vuio0pswjnm710d ago

The May 11, 2026 Order on defendants' Motion to Dismiss has now been uploaded to the Internet Archive

https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...

No claims were dismissed without leave to amend

Defendants have failed to stop this litigation from going forward

Expect a settlement before this moves into discovery

The Court's understanding of "localhost" in this Order may be less than complete but if this litigation progresses further and experts are retained then that could change

0john18d ago

This actually inspired me recently to create Pal Pipe for Android- https://gitlab.com/not_john/palpipe

1vuio0pswjnm719d ago

A timely question. Hopefully someone will share the recent Order and Third Amended Complaint

Since that discussion in 2025

Rose v Meta was consolidated with some other privacy cases against Meta

A first amended complaint was filed,^1 Google was added as a defendant

Defendants motion to dismiss was denied

A third amended complaint was filed on Monday

Here are the PDFs

1st amended complaint

https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...