3 ms·

Does nobody find it unprofessional, perhaps even untrustworthy, to not only discuss the private dealings you have with other companies but also copy+paste e-mai

Does nobody find it unprofessional, perhaps even untrustworthy, to not only discuss the private dealings you have with other companies but also copy+paste e-mails? Even if they're idiots? I don't think you want to go down that road... "Well I thought the guy from Company X was an idiot, so why was it wrong for me to repost our private conversation?"

pja 10y ago
In this case, the company in question is run by dangerously incompetent idiots who’s advice, if followed, would result in their clients not only exposing themselves to serious risk if they ever were targeted by a real hack but would result in instant compliance failure if they were ever put through the compliance procedures of a competent agency. If a major contract was on the line, that kind of thing could put a company out of business.
- PuffinBlue 10y ago
  Ordinarily I'd agree with GP but you are right that this is an unusual situation with potential for very detrimental legal consequence. What's being asked for is absolutely a breach of the UK Data Protection Act and the providing company would be immediately legally liable for revealing this information. I see this public discussion (bearing in mind no names have been revealed) quite invaluable in raising awareness of this sort of harmful request.
abritishguy 10y ago
In general, yes. But I'd consider posting an anonymised email demonstrating such incompetence to be whistleblowing.
raverbashing 10y ago
If you want to be bullied by said idiots, risk violating the PCI standard and take it quietly then please go ahead, it's not my foot to shoot
syshum 10y ago
I think it is extremely dangerous to believe email is a private conversation. One should expect that any email they send will at some point be posted for public consumption and compose emails accordingly Email is not a secure or private means of communications, the faster people learn and accept this the better off everyone will be
- jonsg 10y ago
  Yes. This. One thing you learn the good way or the hard way when you start to run companies is that any email should be considered part of a public audit trail, regardless of whatever unenforceable boiler-plate .sig text the legal beagles insist is appended. It can all end up in the public record as part of court evidence, or from man-in-the-middle capture, or Snowden-style whistle-blowing...or invent your own scenario. In this case, the auditor was asking the poster to do something rather illegal, and certainly extremely unwise, to the point of compromising both the poster's career and his employer's business. Given those points, I'd say that publishing the emails constitutes fair self-defence, and the auditor - to put it bluntly - is very lucky that the poster was too professional to name and shame both himself and his company.
SilasX 10y ago
The poster withheld the name of the companies and used a throwaway account. There's no clear link back to the auditor.

pja 10y ago

In this case, the company in question is run by dangerously incompetent idiots who’s advice, if followed, would result in their clients not only exposing themselves to serious risk if they ever were targeted by a real hack but would result in instant compliance failure if they were ever put through the compliance procedures of a competent agency. If a major contract was on the line, that kind of thing could put a company out of business.

PuffinBlue 10y ago
Ordinarily I'd agree with GP but you are right that this is an unusual situation with potential for very detrimental legal consequence. What's being asked for is absolutely a breach of the UK Data Protection Act and the providing company would be immediately legally liable for revealing this information. I see this public discussion (bearing in mind no names have been revealed) quite invaluable in raising awareness of this sort of harmful request.

abritishguy 10y ago

In general, yes. But I'd consider posting an anonymised email demonstrating such incompetence to be whistleblowing.

raverbashing 10y ago

If you want to be bullied by said idiots, risk violating the PCI standard and take it quietly then please go ahead, it's not my foot to shoot

syshum 10y ago

I think it is extremely dangerous to believe email is a private conversation. One should expect that any email they send will at some point be posted for public consumption and compose emails accordingly Email is not a secure or private means of communications, the faster people learn and accept this the better off everyone will be

jonsg 10y ago
Yes. This. One thing you learn the good way or the hard way when you start to run companies is that any email should be considered part of a public audit trail, regardless of whatever unenforceable boiler-plate .sig text the legal beagles insist is appended. It can all end up in the public record as part of court evidence, or from man-in-the-middle capture, or Snowden-style whistle-blowing...or invent your own scenario. In this case, the auditor was asking the poster to do something rather illegal, and certainly extremely unwise, to the point of compromising both the poster's career and his employer's business. Given those points, I'd say that publishing the emails constitutes fair self-defence, and the auditor - to put it bluntly - is very lucky that the poster was too professional to name and shame both himself and his company.

SilasX 10y ago

The poster withheld the name of the companies and used a throwaway account. There's no clear link back to the auditor.