> "And how can they ask every person in your contacts if they approve"
By prompting the user the next time they sign into Facebook. This really isn't that hard. You can even make this a blanket permission: "I allow all of my contacts to store my contact info with Facebook". It's still miles better than what's there right now.
> "And that's invading the privacy of the user's address book: they are now sharing that someone is in their address book, even if they didn't want that person to know."
That's not the only choice. Facebook can just as easily say "Hey, we have [X] information about you that [Bob Smith] uploaded. You may [opt out] and we will delete this data."
There are many, many, many ways to mitigate the privacy concerns of this. Facebook right now is doing none of it.
Again, let me ask: you have all these concerns about Facebook optionally letting you upload some data stored on your device to be shared with nobody. Exactly what Google's Contacts, Apple's iCloud, and Microsoft's Live let you do. Why is this any different? All of those companies have competing social networks, why do they get a free pass from you? Why don't you block them in your hosts files and not let them track you on the web with their +1 buttons or Bing results?
But, anyway, how would they ask the person that doesn't have a Facebook account. What if they get the match wrong, if you have two friends named "John Smith"? This is a non-trivial solution for an issue fabricated against Facebook when identical (or even worse, see Google's use of contact data with Buzz: Facebook has never made this info public or even shared the uploaded information with anyone but you) situations have occurred since the first online contact management solution? Why is this the only case where every person should have to agree to let someone else use the service to store information about you?
This is why people let Google Contacts and iCloud "have a free pass". Neither Google Contacts nor iCloud does anything with my data - it's on their servers for backup and sync purposes. Could they be doing anything nefarious in the background with my private information? Sure, but neither company have a strong history of this.
With Facebook this trust simply does not exist, and when coupled with a poorly explained, poorly documented feature that seemed to have very few privacy controls around it (many Facebook features with less privacy impact have more privacy visibility), people flip out. Rightly so.
We cannot trust Facebook not to mine the shit out of the information uploaded from our phonebooks (and in fact, Facebook has never ruled this out), and eventually expose it to other people, even indirectly. When your company has a long track record of taking a cavalier (if not outright dismissive) attitude towards user privacy, the onus is on you to show you're above-board. The phone sync feature hasn't done this due diligence.
The fact that the phonebook data I'd be uploading isn't exposed directly to my other friends is very, very small comfort.
[edit] I've seen this exchange way more times than I'd like to. It's just a total failure of communication on Facebook's part:
By prompting the user the next time they sign into Facebook. This really isn't that hard. You can even make this a blanket permission: "I allow all of my contacts to store my contact info with Facebook". It's still miles better than what's there right now.
> "And that's invading the privacy of the user's address book: they are now sharing that someone is in their address book, even if they didn't want that person to know."
That's not the only choice. Facebook can just as easily say "Hey, we have [X] information about you that [Bob Smith] uploaded. You may [opt out] and we will delete this data."
There are many, many, many ways to mitigate the privacy concerns of this. Facebook right now is doing none of it.