Ask HN: So what happened to Facebook "localhost" tracking? It was discussed a year ago.
https://news.ycombinator.com/item?id=44235467 |
Ask HN: So what happened to Facebook "localhost" tracking? It was discussed a year ago.
https://news.ycombinator.com/item?id=44235467 |
> The decision, issued by U.S. District Court Judge Rita Lin in San Francisco, grew out of a class-action complaint initially brought last June by California resident Devin Rose (and later joined by other Android users).
> Rose alleged that between September 2024 and June 2025, Meta exploited Android's localhost -- a feature that allows software developers to test applications -- to connect users’ mobile web browsing to their Facebook and Instagram profiles.
May 12, 2026
The term "localhost" refers to the default entry in all modern operating system host files. By default modern operating systems provide a hosts file that provides domain name resolution without reliance upon the Domain Name System (DNS) protocol. By default these host files typically ship with one entry, a domain named "localhost" that points to IPv4 loopback interface 127.0.0.1.
what should have been the focus was "starting a shadow server on the use device, wide open for any application or webpage"
>standard pixel tracking, linked to meta (js , web)
>Meta exploited Android's localhost (os level)
- A website running JS on the browser tries to connect to localhost port X. If it succeeds it's now talking to Zuck's app.
- The JS can report whatever it wants to the app, and the app knows the identity of the browsing user, because ~100% of the time it's the user also logged into the app(s).
> UPDATE: As of June 3rd 7:45 CEST, Meta/Facebook Pixel script is no longer sending any packets or requests to localhost. The code responsible for sending the _fbp cookie has been almost completely removed. Yandex has also stopped the practice we describe below.
Change it to something like "This website is trying to spy on your local devices, do you want to allow this?"
I get those regularly in Chrome
Access to my router's web interface was not blocked (understandably) but this left me rather confused for a while.
You can actually achieve a form of discovery if your service registers itself using mDNS for something like `service.local`. Browsers will allow direct navigation/redirection to `http://service.local`, but they'll block any fetch/XHR requests due to mixed content rules, even if you have CORS configured. And of course you can't get a cert for `.local` domains.
Newer things like Chrome's LNA[0] are actually really helpful, because (for now at least) if the user grants the permission, fetch/XHR will go through, but you'll get a bunch of mixed content warnings in the console.
It seems like the only way to fully support this use case currently is with WebRTC, which is pretty sad.
https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...
No claims were dismissed without leave to amend
Defendants have failed to stop this litigation from going forward
Expect a settlement before this moves into discovery
The Court's understanding of "localhost" in this Order may be less than complete but if this litigation progresses further and experts are retained then that could change
Since that discussion in 2025
Rose v Meta was consolidated with some other privacy cases against Meta
A first amended complaint was filed,^1 Google was added as a defendant
Defendants motion to dismiss was denied
A third amended complaint was filed on Monday
Here are the PDFs
1.
1st amended complaint
https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...
Meta motion to dismiss
https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...
Google motion to dismiss
https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...
Plaintiffs response
https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...
Meta reply
https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...
Google reply
https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...
Order
(Payment required)
https://pacer.login.uscourts.gov/csologin/login.jsf?pscCourt...
2nd amended complaint
(Payment required)
https://pacer.login.uscourts.gov/csologin/login.jsf?pscCourt...
Not sure how it would benefit you telling some website you run all the software.
There's a few other orders or societies or what have you that you could join. Personally, I don't drive a train or even wear a stripey hat, so I haven't considered joining an organization for Engineers.
[1] https://order-of-the-engineer.org/about-the-order/obligation...
If you push back against unethical feature requests:
No union: you get fired
Union: you still get fired
... why not both?
This is also missing a lot of what localhost means in this context (networking, violation of the usually way similar apps and websites work on an Android device, etc).
(That’s what these people want)
The problem is this prompt is new so the software doesn't show the user why it's just triggered the prompt and the user has no info to work with.
But still make it clear what can happen.
"Attention! This website wants to get access to other web apps running on this device, do you want to allow this?"
And then a link explaining some more. But better words are surely possible.
I'm sorry if people don't know what "access local devices" means but actively lying to them about the mechanisms is not going to inform anyone
"A feature that allows multiple programs on the same device to communicate without the need for an internet connection"
For a judge trying to rule on a technical case, a poor layperson analogy and lead to a confidently wrong legal conclusion that has serious negative consequences. Thats why court appointed neutral experts are important.
I agree with you by the way, I just don’t think this is one of those cases.
ex. Secondary (Sympathy) Strikes are illegal [1].
[1]: https://en.wikipedia.org/wiki/Solidarity_action#United_State...
Unions are always touted as a panacea, but logically, it doesn't compute for me. They feel more like ponzi schemes than anything else.
https://en.wikipedia.org/wiki/Ontario_Teachers%27_Pension_Pl...
Yes, obviously. That's how every insurance works.
That is how all unions were born.
Just leave or be fired without the song and dance.
The modern "welfare state" also emerged out of those earlier grassroots movements. Now we take it for granted. One downside is that the state has largely displaced the incentive for those private societies.
And for the conspiratorial minded: that displacement was in part a deliberate attempt to limit the power of collective action and employees generally. In the early 20th century, jury awards for horrendous workplace accidents were often large and starting to threaten the bottom line. Employer-mandated workers' compensation insurance was promoted by companies as a way to limit their liability. This is why you typically cannot sue your employer for most workplace accidents if you're covered by workers' compensation. The same legislation that mandates workers' compensation insurance shields employers from liability for workplace accidents. Especially in the case of grievous injury or permanent disability, an employee likely would have gotten much greater compensation in a civil suit than what they'll get in workers' compensation. (OTOH, considering all workplace injuries and compensation together, maybe the bargain was worth it overall. Employee societies may never have achieved the degree of coverage the legal mandate did, and maybe those societies would never have been able to provide more compensation on average than employees get now.)