4 ms·

Easy - propose a process for releasing data, and get it publicly vetted by privacy/security researchers. I'm pretty sure anyone who understands basic crypto wou

Easy - propose a process for releasing data, and get it publicly vetted by privacy/security researchers. I'm pretty sure anyone who understands basic crypto would know that MD5 hashing low-entropy text fields is problematic. The fact that they missed this means they just handed this procedure off to a random coder who didn't know any better. That doesn't sound like at all like a sane process for releasing gigabytes of highly personal data. Private companies have their own issues, obviously, but just because A is bad doesn't mean we should lower our standards for B. Also, private companies have your data because consumers interact with them directly, so at least there is some implicit consent involved. But I'm less convinced that they should be forced to hand that data over to public agencies that have only a very tangential relationship with the user. If I take an NYC cab ride, why should the city government get to see that, especially if I don't live there?

anigbrowl 10y ago
As for your cab ride, because the government of NYC is who people turn to when they have problems with their cab ride and don't get satisfaction from the cab company. Honestly, talking to some people it's like they were living in some free market garden of Eden one day and then government came along and ruined everything. People institute governments to 'secure their rights'; it's your choice to take an oppositional attitude rather than a participative one towards government. You are the one saying you want certitude about the security of information held by government; why not propose your preferred standard for how data should be released, maybe get some peer security experts to refine it or agree on a suitable candidate, and then promote its adoption by government with an economic argument? It seems not to have crossed your mind that government failure is often the result of past policy decisions imposed by representatives or the voters themselves on how things should be done, and that they're often mandatory for the people who work in government. They may know a policy or procedure or person's performance is flawed, but lack the legal or budgetary authority to do anything about it. Sometimes inefficient policies are in place as a political payoff to a corporation, union, or individual - corruption is a problem, and legislatures are essentially political marketplaces, and subject to certain failures of markets. Other times inefficiencies are just unintended consequences of well-intended legislation that was poorly crafted, or outlived its usefulness, or conflicting imperatives that lead to legal race conditions. Try thinking of government as the operating system (or platform if you prefer) of society. It's buggy, bloated, nominally open but actually with a bunch of closed-source stuff in it, some people mine it for exploits or sneakily implement their own, and so on. You have this huge codebase written in multiple languages running on all sorts of legacy institutional hardware, all strung together in a giant embedded system that is supposed to operate 24-7, often under difficult conditions. Oh, and there's bitter disagreement between two factions of developers with radically different ideas about, well, everything. Refactoring this isn't an easy undertaking. I suggest to you that the problems of government are similar to the problems of a large software project, and involve many of the same sort of trust problems that operating systems do. Consider that there is a relatively small number of successful operating systems/platforms, none of them were built overnight, and they all suffer from various faults and have interoperability issues - some by design, some by oversight. Your black-box approach to government is of limited utility because it's not like you can easily swap it out for a better one.
- smallnamespace 10y ago
  I'm not sure how you somehow found a broad antigovernment oppositional attitude in these posts here. All of what you say about governance can be true, and I largely agree with it, but I still don't want NYC to have my data and I do think the onus is on them to show they will be responsible custodians because they screwed it up in the past. Once bitten, twice shy. I don't know if you've tried to do free work for governments and get them to go along with your initiatives before, but I bet you that it quickly becomes a politicized process and is much more painful than, say, submitting a PR. I don't have the time, energy, or resources to do such a thing, but I do have the ability to vote against policies that I feel are misguided. If you have examples of normal citizens getting municipalities to adopt their initiatives and the process going smoothly, I'm all ears. Also, the point here is that Uber is not a cab ride; if I take a cab ride I can understand why NYC gets the data directly since cabs are a de facto government-established monopoly, but I don't see why that extends to my business dealings with a private corporation.
  - anigbrowl 10y ago
    I still don't want NYC to have my data and I do think the onus is on them to show they will be responsible custodians because they screwed it up in the past As I pointed out in the first place, with a public entity like NYC you can file FOIA requests to find out what they actually did to mitigate the problem and ensure it doesn't recur. Is it enough? Opinions will vary, but reliably ensuring better security practices in the future will require some sort of rule, if only to identify the standard their IT operations need to comply with. Meanwhile, the city is still expected to respond to complaints from residents about the cab service and to carry out its existing oversight functions which are almost certainly mandated by law. Uber's right to operate a transport service is subject to the same laws as every other transit service, so there's no legal basis for them to have a veto over the city contingent on the city meeting some (undefined) standard of reliable data custody. That would be giving a private entity (Uber) authority over the data security policy of NYC, which is an absurdity. Certainly their opinion matters, as does yours as a voter, or even (very indirectly) as someone who chooses to drop some of your tourist $ in NYC or not. But having an opinion which you attempt to everage at election time (occasionally alone or more commonly through donating to some lobbying group to do it for you) is very different from a company unilaterally declining to comply with a rule and then claiming to be doing so in order to uphold your interests rather than their own. Also, the point here is that Uber is not a cab ride Of course it is. You summon a vehicle to transport you in comfort from A to B and you pay on arrival. Summoning them via an app rather than via a telephone call or a wave down is a mere operational detail. You're still hiring a car, for the time being cars are driven by people, and the law in New York is that commercial drivers can't work more than 60 hours a week (because of the increased risks of accidents due to driver fatigue, which is backed up by a lot of data) and have to be able to provide work logs on request. The existence of a difference tells you nothing about its degree. From the point of view of the customer and driver, there is virtually no functional difference between Uber or any pre-existing taxi company. The significantly different business, dispatch and billing practices don't alter the fact that it's a ride-for-hire service.

anigbrowl 10y ago

As for your cab ride, because the government of NYC is who people turn to when they have problems with their cab ride and don't get satisfaction from the cab company. Honestly, talking to some people it's like they were living in some free market garden of Eden one day and then government came along and ruined everything. People institute governments to 'secure their rights'; it's your choice to take an oppositional attitude rather than a participative one towards government. You are the one saying you want certitude about the security of information held by government; why not propose your preferred standard for how data should be released, maybe get some peer security experts to refine it or agree on a suitable candidate, and then promote its adoption by government with an economic argument? It seems not to have crossed your mind that government failure is often the result of past policy decisions imposed by representatives or the voters themselves on how things should be done, and that they're often mandatory for the people who work in government. They may know a policy or procedure or person's performance is flawed, but lack the legal or budgetary authority to do anything about it. Sometimes inefficient policies are in place as a political payoff to a corporation, union, or individual - corruption is a problem, and legislatures are essentially political marketplaces, and subject to certain failures of markets. Other times inefficiencies are just unintended consequences of well-intended legislation that was poorly crafted, or outlived its usefulness, or conflicting imperatives that lead to legal race conditions. Try thinking of government as the operating system (or platform if you prefer) of society. It's buggy, bloated, nominally open but actually with a bunch of closed-source stuff in it, some people mine it for exploits or sneakily implement their own, and so on. You have this huge codebase written in multiple languages running on all sorts of legacy institutional hardware, all strung together in a giant embedded system that is supposed to operate 24-7, often under difficult conditions. Oh, and there's bitter disagreement between two factions of developers with radically different ideas about, well, everything. Refactoring this isn't an easy undertaking. I suggest to you that the problems of government are similar to the problems of a large software project, and involve many of the same sort of trust problems that operating systems do. Consider that there is a relatively small number of successful operating systems/platforms, none of them were built overnight, and they all suffer from various faults and have interoperability issues - some by design, some by oversight. Your black-box approach to government is of limited utility because it's not like you can easily swap it out for a better one.

smallnamespace 10y ago
I'm not sure how you somehow found a broad antigovernment oppositional attitude in these posts here. All of what you say about governance can be true, and I largely agree with it, but I still don't want NYC to have my data and I do think the onus is on them to show they will be responsible custodians because they screwed it up in the past. Once bitten, twice shy. I don't know if you've tried to do free work for governments and get them to go along with your initiatives before, but I bet you that it quickly becomes a politicized process and is much more painful than, say, submitting a PR. I don't have the time, energy, or resources to do such a thing, but I do have the ability to vote against policies that I feel are misguided. If you have examples of normal citizens getting municipalities to adopt their initiatives and the process going smoothly, I'm all ears. Also, the point here is that Uber is not a cab ride; if I take a cab ride I can understand why NYC gets the data directly since cabs are a de facto government-established monopoly, but I don't see why that extends to my business dealings with a private corporation.
- anigbrowl 10y ago
  I still don't want NYC to have my data and I do think the onus is on them to show they will be responsible custodians because they screwed it up in the past As I pointed out in the first place, with a public entity like NYC you can file FOIA requests to find out what they actually did to mitigate the problem and ensure it doesn't recur. Is it enough? Opinions will vary, but reliably ensuring better security practices in the future will require some sort of rule, if only to identify the standard their IT operations need to comply with. Meanwhile, the city is still expected to respond to complaints from residents about the cab service and to carry out its existing oversight functions which are almost certainly mandated by law. Uber's right to operate a transport service is subject to the same laws as every other transit service, so there's no legal basis for them to have a veto over the city contingent on the city meeting some (undefined) standard of reliable data custody. That would be giving a private entity (Uber) authority over the data security policy of NYC, which is an absurdity. Certainly their opinion matters, as does yours as a voter, or even (very indirectly) as someone who chooses to drop some of your tourist $ in NYC or not. But having an opinion which you attempt to everage at election time (occasionally alone or more commonly through donating to some lobbying group to do it for you) is very different from a company unilaterally declining to comply with a rule and then claiming to be doing so in order to uphold your interests rather than their own. Also, the point here is that Uber is not a cab ride Of course it is. You summon a vehicle to transport you in comfort from A to B and you pay on arrival. Summoning them via an app rather than via a telephone call or a wave down is a mere operational detail. You're still hiring a car, for the time being cars are driven by people, and the law in New York is that commercial drivers can't work more than 60 hours a week (because of the increased risks of accidents due to driver fatigue, which is backed up by a lot of data) and have to be able to provide work logs on request. The existence of a difference tells you nothing about its degree. From the point of view of the customer and driver, there is virtually no functional difference between Uber or any pre-existing taxi company. The significantly different business, dispatch and billing practices don't alter the fact that it's a ride-for-hire service.