On Sunday morning I opened Facebook, waited for the home page to finish loading, and saved the page source to a text file. The feed showed two posts: a friend offering a pair of 35mm cameras and a flash for $75, pickup only, and a Bob’s Discount Furniture carousel. The file was 4,752,886 bytes, about 4.7 megabytes, which is roughly the complete text of the King James Bible. The words I could read on screen, every label, menu item and the whole camera post, came to 2,046 characters. That is four hundredths of one percent of what my browser received. This piece is about the other 99.96 percent.
I am a database engineer by trade, so the method here is the one I’d use on any unfamiliar system: count things, group them, and ask what each group is for. Nothing below required anything but a text editor and a few lines of Python. Everything I describe is in a file that any Facebook user can produce with Ctrl-U.
The ratio. Two posts, 4.7 megabytes. The page contains 410 script blocks, 215 of them pointing to external JavaScript bundles on Facebook’s content network, plus 189 instructions to preload or prefetch more. Of 566 named code modules the page loads by name, one is the thing that renders a post. The rest are infrastructure: loggers, experiment readers, performance timers, video telemetry, Messenger plumbing, Meta AI hooks. By object type, the data the page carries describes 142 user records, 65 ad media attachments, 60 product items, 62 external links, and three posts. The furniture ad is sixty products deep. The friend’s cameras are one.
The switches. Facebook runs the site as a permanent experiment, and the evidence is a block of 1,108 numbered settings, each a key with a value, that tell the code which version of itself to be for me. Industry people call these feature flags or knobs; Facebook’s internal name appears in the file as “jk,” which engineers who have worked there have described publicly as JustKnobs. The number means that my home page is one of a very large number of possible home pages, assembled for my account, and that the version a friend sees is probably not the one I see. There is no way from the outside to tell which of the 1,108 are tests of ranking, which are tests of ad load, and which are the ones that decide whether I see the little bell that says a friend posted. That is the point of them.
The loggers. The page loads 115 distinct kinds of logging event, each a named module that ends in the word FalcoEvent, which is the name of Facebook’s client logging pipeline. Some record what you’d expect: a click on a menu item, an impression of a bookmark, the moment the feed runs out and reloads. Others are more specific than I would have guessed. There is an event for when a friend request is seen and a separate one for when it’s clicked. One for when the “message requests” banner is shown, one for when a thread action is tapped and one for when it’s confirmed. One called WellbeingGeneric and one called FbTimeLimitsTriggerAction, which is to say the code that measures how long you’ve been here and the code that decides whether to say something about it ship together. One for interactions with Meta AI agents inside messages and one for Meta AI image editing. One for a click on a WhatsApp link and a separate one for the link merely being rendered. There are 187 instances of a translation-quality event and 170 of a JavaScript statistics event, which are the page measuring itself. The point is less any single event than the completeness. Looking is logged. Not clicking is logged, because an impression without a click is the measurement that matters most to the people selling the next ad.
The watchers in the sidebar. The Messenger contact tray on the right is sorted by a ranking record for each friend that includes an availability status and the Unix timestamp of the last time they were active, to the second. Seventeen of those records were in the page when it loaded. I did not ask who was online. The page knew, and knew when, for every friend in the tray, so that it could put the most recently active ones on top. That is a convenience. It is also a presence log of my friends, delivered to my browser, refreshed every time I load the page.
The images carry passengers. The page references 44 distinct images, from profile pictures to the sixty sofas, and every one of them is fetched with a URL that carries between ten and twelve parameters: a signature, an expiry, a cache bucket, a session identifier, a content ID, and several whose names are two letters and whose purpose I can’t determine. Across the file those parameters appear 1,269 times. An image URL on most websites is a path to a picture. On Facebook it is a picture plus a record of which account requested it, in which session, and until when it should be allowed to load. Copy the URL and send it to someone and you have sent them a token with your request in it.
The sponsored label is misspelled on purpose. This was the part I didn’t expect. Facebook’s internal name for the data attached to an ad is “SponsoredData.” In my page source, the furniture ad’s data object is typed “SposnoredDaat,” and near the top of the file there is a small table that maps the misspelling back to the real name so the code can find it. Separately, the text that identifies the post, the label and the time stamp, is stored in the markup as individual letters in scrambled order, interleaved with 120 copies of an invisible Unicode character called the combining grapheme joiner, and reassembled into readable order by the stylesheet. A human sees “Sponsored” and a time. A program reading the page sees “t r o d p S s e n o” with ghosts between the letters. I can’t read Facebook’s intent from a file, so I’ll mark this as my inference: the only purpose I can find for misspelling your own data type and scrambling your own label is to keep the word “Sponsored” from appearing anywhere a filter, an ad blocker or a researcher’s script could match it. The disclosure the law requires is on the screen. The disclosure a machine could count is not.
The ads know you from the right column too. Besides the furniture carousel, the page carried a right-column unit with two ads, a handbag retailer’s gift-with-purchase offer and Adobe’s AI image generator, each with a field called “encrypted_tracking” holding a long opaque token and a target URL stamped with the campaign source “Facebook_Right_Column.” The furniture ad carried an advertiser identifier and a request identifier of its own. Every ad, in other words, arrives with its own serial number for the auction that placed it there, so that what I do next can be billed to the right account.
The page guesses where I’m going. Buried in the configuration is a table of 49 destinations, each with a number: the photo viewer at 800, the home feed at 680, a single post at 350, a profile at 161, the Reels player at 110, Marketplace at 61, Messenger at 51. I can’t tell from the file whether those are predicted probabilities of my next click or priorities for what to load first, and the two uses overlap, so I’ll say only what’s there: the page arrives with a ranked list of where its author expects me to go, and the photo viewer is at the top. Facebook knows I click on pictures.
The routes it keeps warm. The file also lists several dozen server paths the page is prepared to send me to, which is ordinary for a web application, but the list is worth reading as a map of what Facebook thinks a session might turn into. Among them: /checkpoint/, which is where you land when the system decides your account needs to prove itself; /contact-importer/, which is the door through which your address book enters the graph; /autologin.php; and two versions of /birthday_help.php, the page for people who entered a birth date the system doesn’t believe. A home page that is ready, at load time, to route me to a checkpoint or a birthday dispute is a home page built for a relationship in which the other party is sometimes under review.
What this adds up to. Nothing here is secret. It is all in the file, and nearly all of it has a defensible engineering purpose taken one piece at a time: you can’t run a site for three billion people without experiments, logging, cached images and signed URLs. What the file shows is the proportion. A page that exists, in its own description of itself, so that I can see what my friends are up to spent 0.04 percent of its weight on that and the rest on measuring me, testing me, routing me and making sure the furniture ad could not be told apart from the cameras by anything but a human eye. The friend with the cameras wrote about 90 words. Facebook wrote 4.7 million characters around them, and the only one of those it went to the trouble of hiding was the word that tells you which post someone paid for.
I’ll do this again with the Substack reader’s view of this publication, because fair is fair, and because I’d like to know what the number is here.