 So, this is Alex's talk on graphing when your friends, graphing when your Facebook friends are awake. Sorry. So, please give Alex a very warm welcome. Hey, everybody. Thanks for being here. Can you hear me okay? Am I micro-finding? No? I'll just... Oh, there it is. That's the stuff. Okay. Good. Well, okay now. Okay, let's do it. So, hey, I'm Alex. I work on the security team at Alasian. I'm from Sydney, so I hope you can understand my ridiculous accent. And in this talk, actually, before we get to that, here's a photo of me and my friend Baz. And this isn't... Some people will actually believe it, so this is not a real photo of me and Obama. Like, this is some dodgy Photoshop I did, my arm's not that big. That's not right. Oh, recently somebody wrote about a blog post I did, and they referred to me as a hacker who goes by the name Alex. So that's going to be my hacker name now, and I can't change it. And as part of this talk, if you aren't following what I'm doing, or you don't know what I'm talking about, or you think I'm wrong, or you have a question, or you have a heckle, or something, just yell at me, just do it. Like, I have no power over you, I'm just the kid with the microphone, so please do it. There will be a dedicated heckle break later if that's what you're into, but feel free to just go for it any time. Some of you are like, is he kidding with the heckle break thing? Yeah. So let me tell you about a thing that happened to me recently. One day I was on this website, I was on Facebook.com, Facebook is where you can see, it's a website where you can see all the political memes your friends are liking, and I saw this thing on the side. This is like a little Facebook chat sidebar, and it's got these little green dots next to it, and it's got like people and their photos and their name and a green dot next to their name and a little time for some of them. This person's got 18 minutes, and I was like, what's the deal with these green dots? What do they mean? And so I wanted to know more about how they worked. I wanted to kind of go under the hood. I wanted to kind of be a mad hacker like this guy. You can tell this guy's a hacker because he's walking around inflating Java. All right. And so it actually turns out it's really easy to figure out what's going on. I found this really easy two-step process to being a hacker. Step one is to go to your browser and right-click on the browser somewhere, and step two is this. That inspect element button? Good stuff. Thank you to that guy. So yeah, when you right-click and inspect element, that's it. You've done it. You're hacking. And so here we go. I've done it. And so down at the top of the screen is Facebook, and on the bottom of the screen is what's probably the source code to Facebook.com. And so when you look at that stuff, you can see what's happening inside. You can see what's happening, you know, on Facebook.com, at the bottom. And so here's a fun fact. When you open the inspect element developer tool things in Chrome, and when you do it on Facebook.com, and you go to the little JavaScript console thing, this is like a place where you can, like, all your JavaScript areas appears here, and you can, like, write JavaScript in here, and it will execute. But when you go there, on Facebook, there's this big red stop-warning thing, which says, like, hey, if you don't know what you're doing, and if you don't know why you're on this page, don't just copy and paste whatever code someone tells you to do, because it's going to, like, steal all your stuff. So I guess what happened here is that Facebook had a problem where people would send each other, like, here's how you can hack your friend's Facebook account, right-click inspect element, be a hacker, go to this thing, and then paste this JavaScript code that actually just steals your account and gives it to me. So that's why Facebook put this big red stop thing there. But it's okay, because we're hackers, and we know what we're doing, so we can go here. So here we are, we're hacking, and we're inside Facebook.com, and we can see all the network requests that are going off. This is showing you, like, all the stuff that the client is loading, like, as you're on there. So, like, it's, like, stuff from requesting CSS to, like, requesting more HTML, all that kind of stuff. And so the thing that interested me is this one here, this pull thing. I don't know how I found this one, and I was just clicking around randomly, like, an organized person would do. So I have no justification for why I stumbled on this thing, but, oh, well, here it is. And notice that when I click on this pull thing, it shows me, it gives me a bunch of JSON. And the JSON looks like this. And it was really fun for me to get this random spaghetti JSON thing and try and figure out what it means in reverse engineering. So guess what, you guys get to do that. You get to tell me what this does. So I can be a lazy presenter, and you can all, you know, join me in hacking. This is not actually hacking, by the way, in case, it's fine. So what is this? Someone want to tell me? Yeah, it's saying that the type of this is a message. See, this game is easy. It's a message type. Okay, what's this thing? Sorry? Yeah, counter. Why is it called SEQ, though? It's a counter. Yeah, sequence number, that's right. And so it's a message number four. Okay, great. And what's this thing? Yeah, it's a user ID, but whose user ID is it? Yeah, it's my user ID. So if you want to add me on Facebook, it's, like, right here. Just go for it. Yeah, it's too late now. It's already in my slides. Okay, so what is this thing over here? Yeah, it's friends user ID. Does anyone think it's something else? Yeah, timestamp, right? So it starts with one, four, and it's the right number of digits to be a Unix timestamp, you know? The time since January 1, 1970, which is the time that we've just started measuring from. But so what you did is it's a timestamp or as a user ID. It's actually my friend being a massive troll who's, my friend's user ID looks exactly like a timestamp. I didn't choose this example. This is just how it happened to work out. And yeah, what a miracle. And so that's the user ID. And so what is this thing? It's the key for this, the label for this, it's LA. Anyone know? Yeah, it's the last active time. And so it's the last time that this particular user ID was online. And you notice it's a Unix time, so it's got one second resolution, right? It goes down to the second. Okay, and what's, oh, it's the last active time. Good slide awareness. And so what's this one? What's all this stuff? Yeah, I don't know what this is, but I don't know. If you know, that's great, because maybe someone can tell me, nobody has told me yet and I hope it's not important. So there's also this other bit of random JSON. I'm just gonna tell you what this is. You don't have to do any stressful reverse engineering. So this is your friend's user ID. So you get, so there's two kinds of JSON. You get the one on the previous slide and you get this, which has your friend's user ID. And then for that friend, it has what their status is. So online, offline, active, idle, or invisible. Yeah, that's right. And for each of those statuses, it tells you what it's for. So is it the status for the Facebook Messenger app? Is it for Facebook.com? Is it some super overarching one? Is it other? Don't know what other does. And so the Facebook app and the Facebook Messenger app are different, so you can be online on one, but not the other. And so it gives you all this information about somebody being online. And when I saw this, like, I don't know if, I don't know what this says about me as a person, but the first thing I thought when I saw this was, oh, that's really creepy, you can graph this, and then you'll be able to see people online and offline, oh, that's really creepy. And so that's what I did. Well, too late, I've already said it now. So, remember, this talk is about these little green dots, right? So if your status is active, then you get a green dot. And if your status is not active, then you get a little time, which is the last time you had a green dot. And so I was wondering when I saw this thing, well, like, what if there was somebody who was always watching the green dots? Like, every second, they would just check, is there a green dot there? And then check again, is there a green dot there now? Well, I wrote some code one night, and now I have this. Now I have these random log files. And so there's a log file, and it's somebodytheasered.txt, I bled it out for, you know, security. And you'll notice I'm doing, and in each of these log files, I have the time and then the JSON that got logged. So it has, for all the different things, like the website, the Facebook app, it has what are they offline? Are they online? Are they invisible on that thing? And you notice I'm doing head-10 here. There's a lot of lines in this, right, because this has been recording for a long time. And also, I have a lot of these files because, you know, you've got a lot of Facebook friends, or you do if you put your user ID in your talk. And so I realized, I was like, okay, that was easy. I just used this secret Facebook API, the slash pull thing, and I downloaded it, and there was no hacking involved, it's there. It's a feature. And so, you know, just having these files, just having these log files is not enough, right? You want to, like, be able to, you can't really tell what's going on in the log files because they're all just numbers. So I wanted to make a graph out of them. See, like, you can't really understand, is this person awake? Are they asleep? What are they doing? Unless you're like a super nerd and you can read Unix time, which is automatically, in which case, congratulations. So for the graph, no, sorry. Don't let me get ahead of myself. It's actually time for the heckle break. Did anyone have any questions? Did anyone want to say anything? Just do it. Really? No one wants to say your slides are ugly. No one wants to say I can't understand your ridiculous Australian accent. No one? I didn't check. I hope not. Anyone else? I'm sure you could check, but I guess I'm just not that kind of guy. Commercialization, that was quick. All right. I guess I'm not that kind of guy, though. Let it be known that PiconAU had way more heckles than you guys. Just saying. Anyway, so I got all these ugly log files and I'm stalking my friend for some reason and so now I want to turn it into a graph. So I was like, okay. You know, it's text, you turn it into a graph. That's what you do when you want to make, when you want to like look at, look at text in picture form. So I was like, okay, maybe I should use my potlib because I've just been writing my thesis recently and I've used my potlib and that's how you make a graph. I was like, okay, this is how I, okay, let's just do it. I don't have time to think about it. Let's go. Let's start doing my potlib. And so, okay, let's go. Google my potlib. Give me, take me to the home page. Oh, okay, I got a pip install. Okay, pip, oh, pip two or pip three. Oh, geez, okay. And get the right Python version and all that. And then you get my potlib, finally. And then you get this elegant code right here that does the graphing. And so obviously you import the pyplot thing and you alias it to plot because you're a data scientist and you don't have time to type the full thing. And then obviously you're gonna need this figure object which is different to the plot object. That's fine. And then you put, then this is the axis. This is the axis of the object which you alias to one, one, one, one. No, which you alias to AX and you have to type one, one, one in there. No one knows why you type one, one, one in there. I'm sure it's very important though. I'm sure the whole thing will crash if you don't. And then you wanna plot the data and then you have to, you see, okay, I plot my data and you put RO which is this wacky micro language for like, oh, R means red and O means circles. So this makes red circles and there's this whole micro language there and I'm pretty sure you can't do OR because that means like orange R or something. I don't know how that works. So thank goodness that you've got these strings here that specify your language and then you've got to set the major formatting function because of course, otherwise your graph will be all wonky but then you have this ridiculously long function call which has like a billion magic numbers in there and I'm sure they're extremely important that you have, you know, exactly this thing in there and then finally you call a function to show the thing and you get something like, and what are you doing? Why is it so complicated to make a graph? That was code that I took from the map.pl website by the way. And then when you finish running this masterpiece then you get something like this, right? So that's not the exact graph that comes from that code but it's a map.lib graph and like, I mean, it is a graph, it's not a graph. I can't discredit it. Like it's got lines and numbers and everything but I kind of want something more pretty if I'm gonna post this on hack and use, right? I got to impress all these people and so I can't actually use this, it's not gonna work. So next graphing library. This is something called bokeh I think that's how you say it. No one corrected me last time so it must be true and this thing I was Googling like, oh my gosh, please don't make me use map.lib. How do I get a better graphing library? And this thing, here we go, here it is. It's got a homepage, it's got graph examples, it's got HTML and I was like, sure, there's some colors, maybe this is the graph, these are the graphs for me. It markets itself as a map.lib killer so I mean the stakes have never been lower and so now we're going, I'm sorry if one of you is a map.lib author, I don't need it like that. And so here we go, it's time to do a graph. The API is exactly the same as map.lib so you don't have to change your code, you just change the import, so that's good. It's compatible with that thing we saw before and here we go, we have this graph and this doesn't generate an image like map.lib.lib. This generates like HTML, CSS, JavaScript and now this is like an interactive graph so you can change what's going on on the screen here. It's got this little tool panel thing and the tools is like a move tool and it's a zoom tool and there's like a draw a rectangle and zoom to that rectangle tool but I tried to use it and it was really wonky. Like you can only, like you can use the zoom in tool or the move tool so you have to like move and then change and then zoom and then like, I don't know, also it's not that good as a graph, like come on, it's got like, come on. It's too sciency. So no, I can't bring this back and no one will respect me or something. So okay, then somebody said, I think it was Einstein, that you can't graph, that yeah, nobody graphs, nobody generates graphs server-side anymore and okay, so I'm taking a photo of that, all right, sure. That's great, cool, put that on the internet. So somebody said that you don't generate your graph server-side and then serve them to the clients, that's from the 90s, this is 2016. Yep, good, you have the links desktop, that's how I remember and you can't do this. So the new spicy way is that you just send the data from the server and the client has all the fancy graphing stuff and so by the client, I mean like the browser and the browser will do all the graphing and all you do is send the data from the server. So I was like, okay, let's do this, let's be 2016 and maybe someone, my friend recommended, I mean, Einstein recommended that I use nvd3.js, ooh, .js is in green. So here we go, here it is, it's nvd3.js.com or something, I don't remember. How good would it be if there was a .js top-level domain? Anyway, here it is and you can use it and it's reusable charts for d3.js. So before you even started using this, you already need to be using this other JavaScript thing and so like everyone in Hacker News is like, oh what, you mean you weren't already using this d3.js? Oh, obviously, everyone's using that so it's no problem to start using this other thing and so here it is and also you have to download like CSS for this, I just wanna make a graph and I'm like downloading CSS and JavaScript and learning about JS dependencies and oh well, here we are, this is what it takes and so I was wondering is this still graphing library for me and so it's a graphing library, it ends with .js, it depends on another thing and that thing also ends with .js so I don't see how it can go wrong. So, but then after this was on Hacker News, somebody did comment being like, no, but really you weren't using the other JS thing, I thought everyone used that fancy JS thing. Hacker News. Anyway, here's this graph which is obviously way better than the other graph. It's actually, it's not even good, right? Like it's pretty good but this is not like miles above, this is not like, this is not the feature of graphing, it's like it's just a graph but like when you're on your third graphing library and you have like 5,000 Chrome tabs open then you're like fine, this will do. So remember, I have this and I've just learned about the feature of modern JavaScript in order to graph it and now it's time to actually do that graphing. So to do the graph, as promised, since it's not the 90s anymore, we're doing this thing where you just send the data to the browser and so I turned all the data of people being online and offline to a CSV and so the CSV is the first thing is the time and then everything else is whether they're online, offline or idle on all the different things, so on Facebook.com or on the app or whatever and so like zero means offline and three means online and so it's like a little proprietary format that I made up for that, please don't steal it. And so now that you've done all the hard work, you've downloaded your graphing library, you've put it all in the CSV, finally it's just easily you just now in the front end you just write JavaScript to do the actual graphing and obviously you just put this code and it's fine and now great, we did it, this is way better than, so no, this is not actually any better, I haven't actually solved my problem at all, all I've done is outsource my problem more and more now it's like oh, I won't do it in Python, I'll do it in JavaScript but now I have to write the same spaghetti code in JavaScript instead, so what was the point of doing all that? I don't actually know how to make a good graph or how to make an easy graph, if you know, please tell me, I think I need like a massive list of like every possible, like a website that has every possible kind of graphing, you just click me, like give me that one or I don't know, I don't know how it works, I'm just a boy. And so the model of the story here, the thing I learned is like no matter what you do, if you wanna make like a non-trivial graph, like more than just a line, then you're gonna have to do some sort of spaghetti thing because you have to like change the format of the x-axis and change the format of the y-axis and oh you have dates, that means you need time zones and oh what if you wanna do more than one line? Who knows off the top of their head how to put more than one line on a graph? I don't know, maybe some of you do. So I guess next time you go and have to graph something, just be ready for the spaghetti. Okay, so we did all that graphing and we did all the downloading stuff and you learned about the future of JavaScript and stuff even though it was Python, so now let's get to the actual thing that you came here for and let's spy on some people or something like that. And so here's a graph of one of my friends who consented to being on this talk on the condition that they're anonymous and so here's some person and you can see on the bottom axis is like how far we've zoomed on this graph. So you can click on them and zoom on them so that's why we did all that JavaScript spaghetti before. So you can zoom in and this is where we've zoomed to and this axis is how online they are because they can be like varying degrees of online. They could be like oh idle or that's more online than offline but it's not online. So I made the left axis is how online they are and there's one different line for each of the things that they could be online on. So there's a line for status which is just a general overarching one which means like whether you get a green dot or not and there's a line for Facebook.com and there's a line for the Facebook app and there's a line for the Facebook Messenger app because they have different lines and there's other to this data, I don't know what other does. Doesn't matter, I hope. And so now you can see like you can't, this, I mean you can see that this is somebody's data but it's not that exciting. You can see them using Facebook from like 9.30 to 9.35 on this day and you're like okay, I guess I know they were on Facebook then and they were sort of maybe on the mobile client, I'm not sure, it's kind of messy but you have a lot of data, you don't just have this picture, you have a lot of stuff to see. So you can just zoom out from there and so now this isn't actually a zoom graph, don't tell anyone, just pretend it's zoomed out, just suspend your belief and so now you'll notice that on the bottom axis you have time just like before but now there's this weird gap like there's stuff happening on the left and there's stuff happening on the right but there's nothing happening in the middle and so you'll notice that they're kind of doing stuff until like 11 o'clock and there's nothing happening and they're doing more stuff at like 10 plus nine and so I mean what do you think is happening between these two points in time? I don't know, I couldn't possibly prove it but they're probably asleep during this time, right? This is probably, as in maybe not the entire time because it's just Facebook, people aren't online on Facebook all the time, unless you are in which case that's fine, no judgment and I mean this probably isn't exactly super accurate but if you're the kind of person who is on Facebook until like shortly before you get asleep and you check Facebook shortly after you wake up then this is like a reasonably accurate estimation of when you're awake and when you're asleep. One of my friends, like I didn't actually do this to my friends by the way, that would be creepy but one of my friends was like, hey Alex, can you send them to me? It's like a free sleep tracking app, I don't have to enter my hours, like please send them to me so I can. I should probably do that. Anyway, so you don't need to stop there because you have a lot of data because you're very creepy and you're collecting this about your friends for a long time, so you can do this and so okay, again none of these times I've ever actually zoomed out but just pretend it's the same graph. This is over a few days now rather than a few hours and you can see at the bottom I have clumsily drawn some red lines on where I think this person is asleep and where I think this person is awake based on when they're online and it's really creepy the stuff you can tell from this so like during the day it looks like they're on Facebook all the time and there's a gap in the middle of the day on both days, it's like is that lunchtime or is that when this person's on the train, I don't know and then right before the sleep line on the first night you can see they're like doing stuff and then they're offline for a few hours and they're suddenly online at 3 a.m. and then that's the only time they're online and then they're asleep for a while so what have they been doing something and then they got back and looked at Facebook at 3 a.m. Who knows, but like it's kind of like it feels really creepy saying this stuff out loud that I'm like stalking this person but this is a feature of Facebook.com I guess and so you can notice that this person is like you can measure how much, how asleep this person is because you can see the width of the asleep section at the bottom changing, right on the first time it's quite small and then it gets bigger and then it gets smaller and so you can see how much time they're asleep for if you actually, if you assume that the time they're on Facebook is exactly the time they're awake and so like a responsible person would do I put this code on GitHub so you know get out your laptops and start cloning right now that's what you want to do and so I put this on GitHub because I also wrote a blog post about this and I wanted to like do the proof of concept and all that and one weird side effect of you see how it has 17 GitHub issues people like, people make issues being like hey what up I'm just here to report a bug I'm trying to stalk my ex on Facebook because I can't get it to work with the kind of how to put my Facebook cookie in there can you help me? And I'm like, I don't, I don't, oh sorry I don't really check these issues I'm just gonna run away and people are like hey so I'm trying to do this on Windows and I'm trying to do it at a massive scale can you add Python 2 support? And I'm like oh I don't know about that I don't know about at a massive scale and yeah I'm just gonna leave that up there for a bit longer in case anyone needs to copy that link down and we're done so I mean I just showed you how to make a graph of one person but obviously you have graphs for everybody who's your Facebook friend so I just showed you one graph but you actually have a graph of everybody and aside from you know sitting in your ivory tower surrounded by graphs looking at them some other things you could do is you could look for like outliers both in terms of people and in terms of for one particular person so let me explain what I mean you could stalk one person in particular and like measure what time they go to sleep and what time they wake up and stuff and be really creepy but if you noticed that they will, if you noticed it on some days they were going to sleep and waking up at a different time to other days you could be like oh that's interesting what's so strange about this person or you could also average over all your like you could look over all your friends and find somebody who has really weird sleep patterns and now you know about their weird sleep patterns and like I don't think they consented to that when they accepted your Facebook friend request I haven't, sorry, or maybe some people have the same sleep patterns yeah, yeah, yeah some people were telling me nevermind, yeah someone was trying to use this to figure out who was talking to each other like figure out who was Facebook messaging each other because if they were online at the same time I haven't seen that person since so I hope they're okay another thing you could do is you could like I haven't done this but another thing you could do is get like some more code to get the time that somebody woke up and time that they slept and measure how long they were asleep for and get it to every morning at like nine o'clock or whatever email you with the people who slept for like less than five hours and then you can like see them in real life and you'd be like oh you look sleepy what's wrong? I haven't read the Facebook terms of service but I'm pretty sure that's not a feature is anyone from Facebook here? okay good at PiconAU someone asked a question and they were like hey I'm a security engineer at Facebook and I was like oh hey hello nice to see you here anyway so why does this work so the whole reason this is not actually hacking by the way there's been no hardcore hacking in this there's just a secret API out there on Facebook that's not in the official Facebook API it's not documented but that's how the front end works that's how Facebook.com gets the data so I was just pretending that I was Facebook.com and getting the same data and so the reason it works is because there's a secret undocumented API that you just have to poke around and find and so if you're a developer then you should assume that just because you don't document an API someone's gonna find it and figure out how it works somebody really bored like me is gonna go and find it and see what the deal with this API that doesn't mean oh I don't have to document my APIs anymore because somebody really bored well no you still have to document your APIs and if you're looking for interesting stuff to do maybe a good place to start would be looking at the secret APIs of stuff of like lots of websites maybe you'll be the first person to find it but you might be thinking like oh those foolish those foolish developers they weren't thinking about it that's why they made that dodgy API that wish the why can't they be why can't they just be good and not make APIs like this and be nice to them because it's hard it's hard to like think about this stuff it's hard to like realize that oh this is actually a public API I didn't know that like you're not actually thinking about oh but what if somebody comes and uses my API and graphs from their friends are awake like you're not thinking that when you're like doing your development you're like should I use a list or a set like you got other things on your mind and so and the reason you have other things on your mind is because you can only pay attention to so many things at once this doesn't have that much to do with this talk but it's a fun exercise so I'm gonna do it anyway and so to show you what I'm talking about with you can only pay attention to something that once let me can I ask all of you who want to play this game to close your eyes right now okay somebody grab their wallets I don't know it's okay so keep your eyes closed and so I've been talking to you for like 20 minutes or something so without opening your eyes and without saying anything just think to yourself what am I wearing right now what clothes do I have don't don't look yet just think about it once you have an answer okay open your eyes who is right put your hand if you're right oh yeah that's most of you that's pretty good maybe I'm wearing very distinctive clothes today okay so everybody close your eyes again so you just had you just had your eyes open for a second so you have no excuses now so what clothes are you wearing right now just just think about it just think about what clothes am I wearing okay open your eyes okay who was right this time it's about no it's close but it's about maybe 25% less of you maybe 50% less of you right this time and so the reason the reason oh also did anyone notice that it now says giraffe instead of attention on the slides yeah so the good some of you did so the reason that that works is because you can only concentrate on one thing at a time so just don't don't don't hate on those developers who make those secret undocumented APIs because they were probably thinking about something else at the time you really have to consciously think about it to not do that kind of thing okay I'll be less than over so you might be wondering like hey I'm your Facebook friend can like maybe some of you just added me on Facebook because he's on my user ID and you're like can I stop you from doing this to me can I not be can I not opt in to this NSA program and the answer is kind of so I didn't know this but I found out recently that you can like turn off the live feature of Facebook chat so you can like it's called turn off chat and it's in the menu somewhere on facebook.com or messenger.com but not the other one I always forget which one and you just go in there and you turn off chat and so what that means is nobody can see when you've read their message you can't like you don't get the red message thing people can't see when you've read their message you can't see when they've read it it's like email and also you don't ever appear online or offline but you can't see when other people are online or offline it's kind of like an opt in thing so if you want to see when other people are online you also have to let other people see when you're online so you can do that if you want incidentally I'm online all the time because my thing is always running you know my script is always running downloading stuff logged in as me so I'm always online and you might be wondering like why did you do this like what were you thinking when you saw that weird pull thing and decided to do all this work I don't know I just don't get out much I guess I don't know but I encourage you to go in like when you see that secret undocumented API don't just be like that's weird to move on when you see something that's weird like you should like jump onto that and be like that's weird tantal and everything about it so if you like this talk you might like this website it might you might find some content that's relatable to you on this site and you also might be wondering like this talk's mostly been about like weird internet stuff and there was some JavaScript in there so like what's in this why is this why is this a pack on what talk what's in it for me if I'm like a Python developer thank you very much all right did we have any extra questions so you didn't get to ask during the talk or any heckles just go for it thanks for the talk I just have one question so do you need to handle authentication problem so do you need to use script to log into Facebook before you fetch the data yeah the short answer is yes so you need to supply like so to for the code on GitHub you need to supply your like Facebook cookie and Facebook user ID and stuff so this script so yes you have to log in as yourself or whatever Facebook account you happen to be using but I mean like for example I wouldn't make a fake Facebook account do that with a fake entity because that's against the terms of service so I would never do that anyone else do you know if that only works for your friends or does it work for any user ID good question does it work for any user ID I don't know I haven't tried searching for random user IDs because I'm not creepy like that but I imagine that it wouldn't work because you are just asking this you're at the mercy of the facebook.com slash pull endpoint and all you do is pulling all you're doing is pulling that and saying please give me whatever you have and it gives you your friends or who would thinks that you want to see on the sidebar and so it probably isn't going to give you random people who you aren't friends with but I haven't I haven't searched for it so the question was is it all your friends or is it just the people who appear on the sidebar I don't know I looked into this a little bit I think the people so obviously you get everybody who appears on the sidebar because that's what it would render on the front end but I noticed that when you resize the Facebook window when you make it longer it makes the chat sidebar longer so you actually have more people there so I don't think it's all your friends all the time but I think it's like a lot and it's whoever Facebook thinks that you want to see on the sidebar any more questions no all right well thank you very much Alex so can we all