6 ms·

Good. I'd prefer that my private data remain private, and private companies like Uber have a responsibility to protect that data.

aetherson 10y ago
You know, it's possible to simultaneously be critical of the government request for data, and the very real concerns that of course they won't successfully anonymize location data, and also have a realistic view that Uber wants to "sell" your data, not "protect" it.
- skybrian 10y ago
  I don't know about this: "of course they won't successfully anonymize location data". Yes, it's well known that they screwed this up. But that doesn't mean that we should therefore distrust them forever. Although it's tricky, figuring out the right level of granularity for revealing taxi ride data to the public seems doable, and we shouldn't let cynicism prevent all attempts at a compromise.
  - smallnamespace 10y ago
    The fact that they screwed it up in the past means they demonstrated a lack of ability to get it right. Unless we have strong evidence that they've fixed that deficiency, it seems unwise to repeat the same mistake. Better safe than sorry seems like the right heuristic here given that once private data is released in the wild, it will remain public forever [1]. [1] https://www.reddit.com/r/bigquery/comments/28ialf/173_million_2013_nyc_taxi_rides_shared_on_bigquery/ https://www.reddit.com/r/bigquery/comments/28ialf/173_millio...
    - anigbrowl 10y ago
      Yeah, and companies in the private sector screw up n similar fashion on a regular basis. What strong evidence do you want that they've fixed the deficiency? Government is about as open organizationally as any entity - you can serve FOIA requests asking what government has done to mitigate some past screwup and get back reams of documentation, which is more than you can say for private entities. I seem to remember Uber having its own history of privacy violations.
      - smallnamespace 10y ago
        Easy - propose a process for releasing data, and get it publicly vetted by privacy/security researchers. I'm pretty sure anyone who understands basic crypto would know that MD5 hashing low-entropy text fields is problematic. The fact that they missed this means they just handed this procedure off to a random coder who didn't know any better. That doesn't sound like at all like a sane process for releasing gigabytes of highly personal data. Private companies have their own issues, obviously, but just because A is bad doesn't mean we should lower our standards for B. Also, private companies have your data because consumers interact with them directly, so at least there is some implicit consent involved. But I'm less convinced that they should be forced to hand that data over to public agencies that have only a very tangential relationship with the user. If I take an NYC cab ride, why should the city government get to see that, especially if I don't live there?
        anigbrowl 10y ago
        As for your cab ride, because the government of NYC is who people turn to when they have problems with their cab ride and don't get satisfaction from the cab company. Honestly, talking to some people it's like they were living in some free market garden of Eden one day and then government came along and ruined everything. People institute governments to 'secure their rights'; it's your choice to take an oppositional attitude rather than a participative one towards government. You are the one saying you want certitude about the security of information held by government; why not propose your preferred standard for how data should be released, maybe get some peer security experts to refine it or agree on a suitable candidate, and then promote its adoption by government with an economic argument? It seems not to have crossed your mind that government failure is often the result of past policy decisions imposed by representatives or the voters themselves on how things should be done, and that they're often mandatory for the people who work in government. They may know a policy or procedure or person's performance is flawed, but lack the legal or budgetary authority to do anything about it. Sometimes inefficient policies are in place as a political payoff to a corporation, union, or individual - corruption is a problem, and legislatures are essentially political marketplaces, and subject to certain failures of markets. Other times inefficiencies are just unintended consequences of well-intended legislation that was poorly crafted, or outlived its usefulness, or conflicting imperatives that lead to legal race conditions. Try thinking of government as the operating system (or platform if you prefer) of society. It's buggy, bloated, nominally open but actually with a bunch of closed-source stuff in it, some people mine it for exploits or sneakily implement their own, and so on. You have this huge codebase written in multiple languages running on all sorts of legacy institutional hardware, all strung together in a giant embedded system that is supposed to operate 24-7, often under difficult conditions. Oh, and there's bitter disagreement between two factions of developers with radically different ideas about, well, everything. Refactoring this isn't an easy undertaking. I suggest to you that the problems of government are similar to the problems of a large software project, and involve many of the same sort of trust problems that operating systems do. Consider that there is a relatively small number of successful operating systems/platforms, none of them were built overnight, and they all suffer from various faults and have interoperability issues - some by design, some by oversight. Your black-box approach to government is of limited utility because it's not like you can easily swap it out for a better one.
- maverick_iceman 10y ago
  With a private business I can always decide to stop using their services. The problem with government is there is no legal way to escape it.
  - deleted 10y ago
    [deleted]
mhurron 10y ago
'Responsibility' without any repercussions for not protecting it. Who still really believes that private companies are any better or have more responsibility to protect your data. You want to protect your data, don't give it out.
- raiyu 10y ago
  Consumers vote with their wallet and if the transgression is large enough the company feels it. It's easy to get lost in the tech echo chamber where we take security seriously, but many average consumers don't. So we incorrectly associate our priorities with theres. Just take a look at Chipotle for evidence of this with the average consumer. A number of incidents of e. coli outbreaks led to sales plummeting and wiped away nearly 50% of their equity in the ensuing troubles. Though same store sales have rebounded considerably they are still off 50% and questions continue to remain. So trust me, when the consumer is affected directly in a way that they prioritize they take action and the company is definitely affected. Unfortunately many security related incidents never trickle down to the consumer in the way that an E.coli outbreak did. Just compare what happened to Chipotle for a handful of E.coli cases versus Yahoo being compromised for 1 billion users data.
  - mhurron 10y ago
    > Consumers vote with their wallet Evidence shows that in the vast majority of cases (home depot, target, psn, jp morgan etc) they do no such thing. Chipotle is getting people sick, people don't like to be sick. Uber, the above mentioned breaches, and the GP were talking about their data. People don't care about that, hence companies face no real penalty for not protecting data.
    - raiyu 10y ago
      That's the point I was making. That for most consumers a security breach isn't viewed the same as an E.Coli outbreak. Although the likelihood of you catching E.Coli is less than 1% the resulting impact was huge. Meanwhile like you mentioned there have been a number of large retailers where your likelihood of having your data compromised was well over 50% and people didn't react at all.
tomcam 10y ago
Do their terms of service indicate they protect it?

aetherson 10y ago

You know, it's possible to simultaneously be critical of the government request for data, and the very real concerns that of course they won't successfully anonymize location data, and also have a realistic view that Uber wants to "sell" your data, not "protect" it.

skybrian 10y ago
I don't know about this: "of course they won't successfully anonymize location data". Yes, it's well known that they screwed this up. But that doesn't mean that we should therefore distrust them forever. Although it's tricky, figuring out the right level of granularity for revealing taxi ride data to the public seems doable, and we shouldn't let cynicism prevent all attempts at a compromise.
- smallnamespace 10y ago
  The fact that they screwed it up in the past means they demonstrated a lack of ability to get it right. Unless we have strong evidence that they've fixed that deficiency, it seems unwise to repeat the same mistake. Better safe than sorry seems like the right heuristic here given that once private data is released in the wild, it will remain public forever [1]. [1] https://www.reddit.com/r/bigquery/comments/28ialf/173_million_2013_nyc_taxi_rides_shared_on_bigquery/ https://www.reddit.com/r/bigquery/comments/28ialf/173_millio...
  - anigbrowl 10y ago
    Yeah, and companies in the private sector screw up n similar fashion on a regular basis. What strong evidence do you want that they've fixed the deficiency? Government is about as open organizationally as any entity - you can serve FOIA requests asking what government has done to mitigate some past screwup and get back reams of documentation, which is more than you can say for private entities. I seem to remember Uber having its own history of privacy violations.
    - smallnamespace 10y ago
      Easy - propose a process for releasing data, and get it publicly vetted by privacy/security researchers. I'm pretty sure anyone who understands basic crypto would know that MD5 hashing low-entropy text fields is problematic. The fact that they missed this means they just handed this procedure off to a random coder who didn't know any better. That doesn't sound like at all like a sane process for releasing gigabytes of highly personal data. Private companies have their own issues, obviously, but just because A is bad doesn't mean we should lower our standards for B. Also, private companies have your data because consumers interact with them directly, so at least there is some implicit consent involved. But I'm less convinced that they should be forced to hand that data over to public agencies that have only a very tangential relationship with the user. If I take an NYC cab ride, why should the city government get to see that, especially if I don't live there?
      - anigbrowl 10y ago
        As for your cab ride, because the government of NYC is who people turn to when they have problems with their cab ride and don't get satisfaction from the cab company. Honestly, talking to some people it's like they were living in some free market garden of Eden one day and then government came along and ruined everything. People institute governments to 'secure their rights'; it's your choice to take an oppositional attitude rather than a participative one towards government. You are the one saying you want certitude about the security of information held by government; why not propose your preferred standard for how data should be released, maybe get some peer security experts to refine it or agree on a suitable candidate, and then promote its adoption by government with an economic argument? It seems not to have crossed your mind that government failure is often the result of past policy decisions imposed by representatives or the voters themselves on how things should be done, and that they're often mandatory for the people who work in government. They may know a policy or procedure or person's performance is flawed, but lack the legal or budgetary authority to do anything about it. Sometimes inefficient policies are in place as a political payoff to a corporation, union, or individual - corruption is a problem, and legislatures are essentially political marketplaces, and subject to certain failures of markets. Other times inefficiencies are just unintended consequences of well-intended legislation that was poorly crafted, or outlived its usefulness, or conflicting imperatives that lead to legal race conditions. Try thinking of government as the operating system (or platform if you prefer) of society. It's buggy, bloated, nominally open but actually with a bunch of closed-source stuff in it, some people mine it for exploits or sneakily implement their own, and so on. You have this huge codebase written in multiple languages running on all sorts of legacy institutional hardware, all strung together in a giant embedded system that is supposed to operate 24-7, often under difficult conditions. Oh, and there's bitter disagreement between two factions of developers with radically different ideas about, well, everything. Refactoring this isn't an easy undertaking. I suggest to you that the problems of government are similar to the problems of a large software project, and involve many of the same sort of trust problems that operating systems do. Consider that there is a relatively small number of successful operating systems/platforms, none of them were built overnight, and they all suffer from various faults and have interoperability issues - some by design, some by oversight. Your black-box approach to government is of limited utility because it's not like you can easily swap it out for a better one.
maverick_iceman 10y ago
With a private business I can always decide to stop using their services. The problem with government is there is no legal way to escape it.
- deleted 10y ago
  [deleted]

mhurron 10y ago

'Responsibility' without any repercussions for not protecting it. Who still really believes that private companies are any better or have more responsibility to protect your data. You want to protect your data, don't give it out.

raiyu 10y ago
Consumers vote with their wallet and if the transgression is large enough the company feels it. It's easy to get lost in the tech echo chamber where we take security seriously, but many average consumers don't. So we incorrectly associate our priorities with theres. Just take a look at Chipotle for evidence of this with the average consumer. A number of incidents of e. coli outbreaks led to sales plummeting and wiped away nearly 50% of their equity in the ensuing troubles. Though same store sales have rebounded considerably they are still off 50% and questions continue to remain. So trust me, when the consumer is affected directly in a way that they prioritize they take action and the company is definitely affected. Unfortunately many security related incidents never trickle down to the consumer in the way that an E.coli outbreak did. Just compare what happened to Chipotle for a handful of E.coli cases versus Yahoo being compromised for 1 billion users data.
- mhurron 10y ago
  > Consumers vote with their wallet Evidence shows that in the vast majority of cases (home depot, target, psn, jp morgan etc) they do no such thing. Chipotle is getting people sick, people don't like to be sick. Uber, the above mentioned breaches, and the GP were talking about their data. People don't care about that, hence companies face no real penalty for not protecting data.
  - raiyu 10y ago
    That's the point I was making. That for most consumers a security breach isn't viewed the same as an E.Coli outbreak. Although the likelihood of you catching E.Coli is less than 1% the resulting impact was huge. Meanwhile like you mentioned there have been a number of large retailers where your likelihood of having your data compromised was well over 50% and people didn't react at all.

tomcam 10y ago

Do their terms of service indicate they protect it?