10 ms·

I don't understand why more people don't understand this. Each "post" is a record with a field called "deleted". You can make that field True. You can't remove

I don't understand why more people don't understand this. Each "post" is a record with a field called "deleted". You can make that field True. You can't remove that record. "Deleting" only gives the database owner one more piece of information about you: that you wanted to delete that record.

CelestialTeapot 9y ago
It's because most people are not computer scientists/hobbyists/engineers. They are laypeople whose knowledge of the internet, and computers in general, is very limited.
- jsemrau 9y ago
  One anecdote from my life. In university one of my best friends at the time found the browser function "view source" and was convinces he can now hack the website.
  - JauntyHatAngle 9y ago
    I mean, depending on the quality of the website, he now can.
  - prepend 9y ago
    I’ve probably had to explain at least 1000 times that our software being open source does not mean that people can edit the functionality of the software running on our servers. One thing that is cool about all these pushes to teach every kid programming is that it might help instill “data values understanding.” Or whatever you call the source->object->runtime. And how data works. Too many people confuse software with data “the data is in the app” and confuse it all with a book in a library. You just burn the book and it’s gone. Or you transfer the book from one library to another. This is a good metaphor for usage, but falls apart if you have privacy or security concerns. Logic that seems natural and instinct to whatever you call people who program/use tech, is incorrectly understood by others. Especially “digital natives” who always had computers and Internet. My kid has all of his files in google from forever. This breaks down in situations where Google’s interests are out of sync with his own.
vincvinc 9y ago
IANAL, but isn’t "true deletion" legally required under GDPR? Wouldn't leaving personal data lying around in your database like this technically leave you liable to massive fines?
- scrollaway 9y ago
  AFAIK GDPR mandates that deleted data is no longer processed (used for marketing, analyzed, etc). I don't remember it saying anything about the data "existing"; nor could it given how backups work in our industry.
  - metaobject 9y ago
    Furthermore, I'd imagine that the host might be required to retain those records for law enforcement purposes (imagine if someone made death threats, etc and law enforcement requested those records for an investigation).
    - zaarn 9y ago
      GDPR does have exceptions for legal compliance, yes. If someone does something illegal and they request deletions you can (IMO, not a lawyer) retain the records if you know there is an investigation or court case going or strongly suspect so or initiate it yourself.
      - asfdsfggtfd 9y ago
        You may even be able to keep comments/posts for longer for general compliance. You will need an audit explaining why and to be prepared to defend it. You won't be able to use such data for analytics. This is based on my personal layman's understanding. I am NOT a lawyer. I am NOT your lawyer. If you need legal advice consult a competent lawyer in your jurisdiction.
      - HenryBemis 9y ago
        Legal/Regulatory compliance is not for Facebook or Amazon. It is to prevent people going to their Bank, where they have a credit card or a consumer loan, or a mortgage, and say "can I please be forgotten/be wiped from your systems - oh and the loan too!".
DINKDINK 9y ago
>I don't understand why more people don't understand this Because of the round trip fallacy: People equate the absence of evidence as evidence of absence P(E|A) != P(A|E)
bootloop 9y ago
In the EU you can.
odammit 9y ago
I assume the did some sort of paranoid delete. I was thinking of getting rid of my Facebook account (once I deal with oauth) and I was thinking if it would be better to delete my account or write a script to flood it with garbage. I was thinking of having it run as a cron on my laptop. Log in via chromedriver, accept a random couple of suggested friends. Download some random images and upload it tagging myself. Grab some random comments off twitter and post it as my own. Like random posts. Remove a few real friends. Repeat. Maybe even Facebook Munging as a Service. :D
- FridgeSeal 9y ago
  I've been entertaining this idea for a while. Train a NN/markov chain on enough of my own and publicly available facebook posts and comments that I can make it spew out realistic-looking posts and comments on demand. Make another script that likes and unlikes pages, joins and leaves groups. Make another that uploads random photos (or randomly generated image content) and tags me in them. Stitch them all together into something that runs all of those on my account, generate so much noise that it becomes a tedious exercise to identify real comments and posts simply by virtue of volume. For bonus points, run it from my home computer. Would it be perfect? Probably not, there's probably way more you could do to simulate a real user, but it'd make a fun project if nothing else.
  - _emacsomancer_ 9y ago
    A lazy implementation of this idea might be to just have it post content from https://www.reddit.com/r/SubredditSimulator/ https://www.reddit.com/r/SubredditSimulator/
    - odammit 9y ago
      That sounds human, albeit confusing. Very cool!
    - FridgeSeal 9y ago
      You say lazy, I say making use of existing resources :P (or not re-inventing the wheel). Seriously though, Subreddit Simulator is probably actually a pretty good idea: a lot of them come with a handy image/gif attached and occasionally you get results that could pass as being written by a human.
kerng 9y ago
Most often true, luckily for European citizens GDPR is changing that.
esturk 9y ago
This can be used against them by updating uncompressible guassian white noise over and over... If what you said is true.
asfdsfggtfd 9y ago
If you are in the EU and press delete and the database owner (data controller) does not delete the post then the database owner is now breaking the law. As of ?may? this will carry significant fines.
- TomMarius 9y ago
  No, they're required to delete data if you specifically ask them to (they most probably will change "delete account" to "deactivate" and you'll have to send them a snail mail request if you want a complete removal) and they're not obliged to delete data partially - it's either this (deleted=true) or whole account.
  - asfdsfggtfd 9y ago
    I suggest that you consult a lawyer. EDIT: In my layman's opinion pressing that button is an explicit request to delete the data. Also the kind of behavior you are suggesting is not private-by-default and goes against the spirit of the law. I don't think that a judge will look kindly on it. I am not a lawyer. I am not your lawyer. I suggest that you consult a lawyer.
    - TomMarius 9y ago
      Yes, but right now the law does not apply. In the future they probably will change 'delete' to 'hide' or even get rid of this option and then the rest of what I said applies. I incorrectly said that "they're" instead of "they'll be".
- thunfischbrot 9y ago
  Let's wait and see, I would guess that we are going to see the first cases within the coming five years.
  - asfdsfggtfd 9y ago
    Why be the test case? Your company will be severely impacted by a fine.

CelestialTeapot 9y ago

It's because most people are not computer scientists/hobbyists/engineers. They are laypeople whose knowledge of the internet, and computers in general, is very limited.

jsemrau 9y ago
One anecdote from my life. In university one of my best friends at the time found the browser function "view source" and was convinces he can now hack the website.
- JauntyHatAngle 9y ago
  I mean, depending on the quality of the website, he now can.
- prepend 9y ago
  I’ve probably had to explain at least 1000 times that our software being open source does not mean that people can edit the functionality of the software running on our servers. One thing that is cool about all these pushes to teach every kid programming is that it might help instill “data values understanding.” Or whatever you call the source->object->runtime. And how data works. Too many people confuse software with data “the data is in the app” and confuse it all with a book in a library. You just burn the book and it’s gone. Or you transfer the book from one library to another. This is a good metaphor for usage, but falls apart if you have privacy or security concerns. Logic that seems natural and instinct to whatever you call people who program/use tech, is incorrectly understood by others. Especially “digital natives” who always had computers and Internet. My kid has all of his files in google from forever. This breaks down in situations where Google’s interests are out of sync with his own.

vincvinc 9y ago

IANAL, but isn’t "true deletion" legally required under GDPR? Wouldn't leaving personal data lying around in your database like this technically leave you liable to massive fines?

scrollaway 9y ago
AFAIK GDPR mandates that deleted data is no longer processed (used for marketing, analyzed, etc). I don't remember it saying anything about the data "existing"; nor could it given how backups work in our industry.
- metaobject 9y ago
  Furthermore, I'd imagine that the host might be required to retain those records for law enforcement purposes (imagine if someone made death threats, etc and law enforcement requested those records for an investigation).
  - zaarn 9y ago
    GDPR does have exceptions for legal compliance, yes. If someone does something illegal and they request deletions you can (IMO, not a lawyer) retain the records if you know there is an investigation or court case going or strongly suspect so or initiate it yourself.
    - asfdsfggtfd 9y ago
      You may even be able to keep comments/posts for longer for general compliance. You will need an audit explaining why and to be prepared to defend it. You won't be able to use such data for analytics. This is based on my personal layman's understanding. I am NOT a lawyer. I am NOT your lawyer. If you need legal advice consult a competent lawyer in your jurisdiction.
    - HenryBemis 9y ago
      Legal/Regulatory compliance is not for Facebook or Amazon. It is to prevent people going to their Bank, where they have a credit card or a consumer loan, or a mortgage, and say "can I please be forgotten/be wiped from your systems - oh and the loan too!".

DINKDINK 9y ago

>I don't understand why more people don't understand this Because of the round trip fallacy: People equate the absence of evidence as evidence of absence P(E|A) != P(A|E)

bootloop 9y ago

In the EU you can.

odammit 9y ago

I assume the did some sort of paranoid delete. I was thinking of getting rid of my Facebook account (once I deal with oauth) and I was thinking if it would be better to delete my account or write a script to flood it with garbage. I was thinking of having it run as a cron on my laptop. Log in via chromedriver, accept a random couple of suggested friends. Download some random images and upload it tagging myself. Grab some random comments off twitter and post it as my own. Like random posts. Remove a few real friends. Repeat. Maybe even Facebook Munging as a Service. :D

FridgeSeal 9y ago
I've been entertaining this idea for a while. Train a NN/markov chain on enough of my own and publicly available facebook posts and comments that I can make it spew out realistic-looking posts and comments on demand. Make another script that likes and unlikes pages, joins and leaves groups. Make another that uploads random photos (or randomly generated image content) and tags me in them. Stitch them all together into something that runs all of those on my account, generate so much noise that it becomes a tedious exercise to identify real comments and posts simply by virtue of volume. For bonus points, run it from my home computer. Would it be perfect? Probably not, there's probably way more you could do to simulate a real user, but it'd make a fun project if nothing else.
- _emacsomancer_ 9y ago
  A lazy implementation of this idea might be to just have it post content from https://www.reddit.com/r/SubredditSimulator/ https://www.reddit.com/r/SubredditSimulator/
  - odammit 9y ago
    That sounds human, albeit confusing. Very cool!
  - FridgeSeal 9y ago
    You say lazy, I say making use of existing resources :P (or not re-inventing the wheel). Seriously though, Subreddit Simulator is probably actually a pretty good idea: a lot of them come with a handy image/gif attached and occasionally you get results that could pass as being written by a human.

kerng 9y ago

Most often true, luckily for European citizens GDPR is changing that.

esturk 9y ago

This can be used against them by updating uncompressible guassian white noise over and over... If what you said is true.

asfdsfggtfd 9y ago

If you are in the EU and press delete and the database owner (data controller) does not delete the post then the database owner is now breaking the law. As of ?may? this will carry significant fines.

TomMarius 9y ago
No, they're required to delete data if you specifically ask them to (they most probably will change "delete account" to "deactivate" and you'll have to send them a snail mail request if you want a complete removal) and they're not obliged to delete data partially - it's either this (deleted=true) or whole account.
- asfdsfggtfd 9y ago
  I suggest that you consult a lawyer. EDIT: In my layman's opinion pressing that button is an explicit request to delete the data. Also the kind of behavior you are suggesting is not private-by-default and goes against the spirit of the law. I don't think that a judge will look kindly on it. I am not a lawyer. I am not your lawyer. I suggest that you consult a lawyer.
  - TomMarius 9y ago
    Yes, but right now the law does not apply. In the future they probably will change 'delete' to 'hide' or even get rid of this option and then the rest of what I said applies. I incorrectly said that "they're" instead of "they'll be".
thunfischbrot 9y ago
Let's wait and see, I would guess that we are going to see the first cases within the coming five years.
- asfdsfggtfd 9y ago
  Why be the test case? Your company will be severely impacted by a fine.