> Meta must face a lawsuit alleging that it secretly tracked Android users' browsing activity on mobile websites that embedded Meta's analytics pixel, and linked that activity to users' identities, a federal judge ruled Monday.
> The decision, issued by U.S. District Court Judge Rita Lin in San Francisco, grew out of a class-action complaint initially brought last June by California resident Devin Rose (and later joined by other Android users).
> Rose alleged that between September 2024 and June 2025, Meta exploited Android's localhost -- a feature that allows software developers to test applications -- to connect users’ mobile web browsing to their Facebook and Instagram profiles.
Not at all to defend Meta but "a feature that allows software developers to test applications" is a dubious definition of localhost. I also can't come up with a better one.
Some concepts just can't (or shouldn't) be broken down to the level of lay person friendly though. There are just some technical concepts that have a complexity floor that if you drop below you are no longer explaining the actual concept but a fantasy.
For a judge trying to rule on a technical case, a poor layperson analogy and lead to a confidently wrong legal conclusion that has serious negative consequences. Thats why court appointed neutral experts are important.
I've recently been exploring options for allowing web apps to access LAN services. For example, a WebDAV server so you can watch local videos in the app without streaming them through a server.
You can actually achieve a form of discovery if your service registers itself using mDNS for something like `service.local`. Browsers will allow direct navigation/redirection to `http://service.local`, but they'll block any fetch/XHR requests due to mixed content rules, even if you have CORS configured. And of course you can't get a cert for `.local` domains.
Newer things like Chrome's LNA[0] are actually really helpful, because (for now at least) if the user grants the permission, fetch/XHR will go through, but you'll get a bunch of mixed content warnings in the console.
It seems like the only way to fully support this use case currently is with WebRTC, which is pretty sad.
> UPDATE: As of June 3rd 7:45 CEST, Meta/Facebook Pixel script is no longer sending any packets or requests to localhost. The code responsible for sending the _fbp cookie has been almost completely removed. Yandex has also stopped the practice we describe below.
I need to turn on location access for all software on my system globally to read the battery status of a device over Bluetooth. These "could be used for" warnings are nice and all, but usually goes beyond what makes sense. Proposing that we need to press "be spied upon" just to view photos stored on your NAS is way out there
I'm sorry if people don't know what "access local devices" means but actively lying to them about the mechanisms is not going to inform anyone
I honestly don't think the average Google Chrome user knows what a 'local' device is, and we should go something more ELI5 "This website wants to spy on every other device connected to your network" or something
I've seen it and at least in Chrome it seems to be treating all URLs which are based on an IP address as "local", regardless of the class of the address.
I'd be inherently suspicious of any website in the wild attempting to contact a bare IP address. Aside from localhost, my default assumption would be that such a website is either trying to circumvent my hosts file (or circumvent my other DNS configuration, e.g. pi-hole or DNS-over-HTTPS), malware trying to reach a command-and-control server, or malware trying to circumvent my adblocker.
i would love to have a software engineer's union, not so much to get better working conditions but to be able to say stuff like "i can't implement that unethical feature, it's against union rules and i'd lose my membership".
To be fair; you don't need a union... you can just say no. Context; I told them they couldn't ship this exact feature as designed. (It worked until I left.)
yes, true sometimes (not always). but if more people have access to a way to confidently say "no" (with protection behind them), then i think saying "no" would happen more often, by people who might've otherwise complied.
are there examples of unions that have started around a focus on the ethics of the services they provide? unions traditionally start locally, around issues for which the locality is a hotspot, which is why they usually focus on pay and working conditions. it's also easier to get a large group to agree on a set of improvements to working conditions vs a set of ethical boundaries.
Fellow software engineers aren't incentivized to destroy their company's reputation in the same way that boards of directors have proven to be time and time again.
maybe, but the union could provide a lot of services to someone who loses their job this way (like income insurance and legal services) and could leverage collective power over companies that demonstrate a pattern of behavior.
This is something that has just never sat well with me. How exactly will the union provide this insurance? That insurance isn't free, so paid for by member dues? How many members are required to be able to afford the payout for just one member? How about the other services unions are touted as being able to provide? They all come from the same dues? I know that unions will put money into investment funds to attempt to grow the coffers, but that just means the money isn't liquid.
Unions are always touted as a panacea, but logically, it doesn't compute for me. They feel more like ponzi schemes than anything else.
that's definitely a big question and i don't pretend to have enough expertise to answer fully; however, i will point to the Ontario Teacher's Pension Plan which is (per Wikipedia[1]) "one of the world's largest institutional investors [...] over $266 billion in net assets, with a one-year total-fund net return of 9.4%, and a 7.4% 10-year total-fund net return". the union runs their own investment fund; it's an extension of collective power into the financial realm.
> This is something that has just never sat well with me. How exactly will the union provide this insurance? That insurance isn't free, so paid for by member dues?
Yes, obviously. A question not asked as assumed a natural part of the thinking process is how many members does it take to get to the center of a tootsie pop? Just because other unions exists does not mean that the one that techBro Norma Rae starts is going to remain viable. How many claims can be paid out before the insurance no longer pays out? Lots of conversation left after your trite yes obviously unhelpful comment
You can say that about a lot of things. The car was already invented, but so many new car companies struggle. Just because a thing exists does not mean someone else can come along to immediately become successful with thing.
It's not defeatism. It's doing the research to avoid unnecessary failure from over ambitiousness getting in the way of doing something the right way. This isn't a Show HN situation where you go and get some VC funding and yolo your way through it. This is something that if it's not done right it could have a greater blast radius than some VC funded startup shutting down with a "What we've learned" blog post.
Makes sense, but I haven't seen in the comments the signs of research having been done. Or maybe you were hoping that I am doing the research for you, while you brainstorm how it can't work? I am an union member, albeit not in the US, and for me it looks fine. Sample size of 1, but a sample which says it does work. Take this information as you wish.
i don't believe that software development should require a license. imagine having to get board-licensed to download gcc; therein lies the death of free software and owning your devices.
> The decision, issued by U.S. District Court Judge Rita Lin in San Francisco, grew out of a class-action complaint initially brought last June by California resident Devin Rose (and later joined by other Android users).
> Rose alleged that between September 2024 and June 2025, Meta exploited Android's localhost -- a feature that allows software developers to test applications -- to connect users’ mobile web browsing to their Facebook and Instagram profiles.
May 12, 2026
"A feature that allows multiple programs on the same device to communicate without the need for an internet connection"
For a judge trying to rule on a technical case, a poor layperson analogy and lead to a confidently wrong legal conclusion that has serious negative consequences. Thats why court appointed neutral experts are important.
I agree with you by the way, I just don’t think this is one of those cases.
>standard pixel tracking, linked to meta (js , web)
>Meta exploited Android's localhost (os level)
You can actually achieve a form of discovery if your service registers itself using mDNS for something like `service.local`. Browsers will allow direct navigation/redirection to `http://service.local`, but they'll block any fetch/XHR requests due to mixed content rules, even if you have CORS configured. And of course you can't get a cert for `.local` domains.
Newer things like Chrome's LNA[0] are actually really helpful, because (for now at least) if the user grants the permission, fetch/XHR will go through, but you'll get a bunch of mixed content warnings in the console.
It seems like the only way to fully support this use case currently is with WebRTC, which is pretty sad.
[0]: https://developer.chrome.com/blog/local-network-access
https://localmess.github.io
> UPDATE: As of June 3rd 7:45 CEST, Meta/Facebook Pixel script is no longer sending any packets or requests to localhost. The code responsible for sending the _fbp cookie has been almost completely removed. Yandex has also stopped the practice we describe below.
Change it to something like "This website is trying to spy on your local devices, do you want to allow this?"
I'm sorry if people don't know what "access local devices" means but actively lying to them about the mechanisms is not going to inform anyone
But still make it clear what can happen.
"Attention! This website wants to get access to other web apps running on this device, do you want to allow this?"
And then a link explaining some more. But better words are surely possible.
Access to my router's web interface was not blocked (understandably) but this left me rather confused for a while.
Since that discussion in 2025
Rose v Meta was consolidated with some other privacy cases against Meta
A first amended complaint was filed,^1 Google was added as a defendant
Defendants motion to dismiss was denied
A third amended complaint was filed on Monday
Here are the PDFs
1.
1st amended complaint
https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...
Meta motion to dismiss
https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...
Google motion to dismiss
https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...
Plaintiffs response
https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...
Meta reply
https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...
Google reply
https://dn711508.ca.archive.org/0/items/gov.uscourts.cand.45...
Order
(Payment required)
https://pacer.login.uscourts.gov/csologin/login.jsf?pscCourt...
2nd amended complaint
(Payment required)
https://pacer.login.uscourts.gov/csologin/login.jsf?pscCourt...
If you push back against unethical feature requests:
No union: you get fired
Union: you still get fired
Unions are always touted as a panacea, but logically, it doesn't compute for me. They feel more like ponzi schemes than anything else.
https://en.wikipedia.org/wiki/Ontario_Teachers%27_Pension_Pl...
That is how all unions were born.
Yes, obviously. That's how every insurance works.
Just leave or be fired without the song and dance.
(That’s what these people want)
... why not both?