4 ms·

Are you familiar with California's Proposition 65? It was based on the same concept - never not inform. Some might opine that the consequences might have failed

by Kalium 8y ago

Are you familiar with California's Proposition 65? It was based on the same concept - never not inform. Some might opine that the consequences might have failed to meet hopes.

dleslie 8y ago
Nope, am Canadian. Canada is going to require disclosure of breaches starting November 1. That may allow for companies to still fail to disclose the _possibility_ of breaches, however. https://globalnews.ca/news/4122202/data-breach-canada-privacy-commissioner/ https://globalnews.ca/news/4122202/data-breach-canada-privac...
- Kalium 8y ago
  https://en.wikipedia.org/wiki/California_Proposition_65_(1986) https://en.wikipedia.org/wiki/California_Proposition_65_(198... Long story short, California requires labeling of things that may contain chemicals hazardous for a variety of reasons. The idea was simple - never not inform. The intentions were pure. The result is that basically everything has a vague and uninformative label about how it may contain chemicals that could be hazardous. The labels are spectacularly uninformative and incredibly numerous. They are universally ignored by everyone, as they constitute a sea of noise. The net result is that a wonderful, laudable, pure, kind, and compassionate idea - never not inform - has led to a deluge of useless informational notices in which actual useful notices are impossible to find. It might be worth considering that there could be a lesson in there.
  - dleslie 8y ago
    Labeling is slightly different than simply informing, in that it is a specific method of informing. It would be like requiring Google to display information regarding this security issue on all of its pages. Warning labels have dubious efficacy, as evidenced by decades of grotesque warnings upon cigarette packaging and their limited success at reducing consumption; but that's not to say we ought not be able to know about the potential harms of a product or service, just that product labels sort of suck as a method of informing users. OTOH, Canada requires nutritional information on all food, and that's reasonably useful and successful _because_ the content of that label is strictly defined and reasonably useful.
    - Kalium 8y ago
      The core idea you have is amazing! Tell people, be sure they know their risks, communicate them clearly, and then they're empowered to make their own choices. It's a wonderful idea that both protects people and respects their autonomy. Nutritional information is relatively easy to provide is thoroughly exhaustive detail. How does one go about informing about data events that may or may not have occurred, and may or may not occur in the future, in a way that's comprehensible to users who must be assumed to have absolutely no technical grounding whatsoever? The most useful informative warning I think that could be reasonably provided runs like this: "Please be aware that any data you provide this service, and any data this service gathers, could previously, presently, or in the future be the subject of a data breach that may or may not be detected." While the warning could of course be improved by being made more specific about what data is concerned, this does not seem like a good way to produce useful and informative warnings. Instead, it seems to me that attempting to pursue that most wonderful of ideals - never fail to inform - could easily produce a sea of overcautious attempts to ensure a user is never not informed, and instead over-informed into oblivion. While such labels might potentially be successful in scaring users into using services less, this might not be the same as informing users. I do hope I've communicated clearly here. Please let me know if anything could have been better-written. More importantly, I've clearly failed to understand some of your wise and well-made points. Can you help me with what I've missed?
      - dleslie 8y ago
        As a non-technical user, if it were to be simplified like Nutritional Information, I would expect broad categories risk that receive either a check or no-check for the possibility of exposure. IE: X Authentication X Financial X Communications X Property Or such, so I can be aware at-a-glance that my user name, password, credit card information, private messages, or personal documents may have been compromised. I wouldn't be over-informed into oblivion, or at least not as likely to be, if the information available were suitably informative-yet-terse. Like a nutrition label. However, that's just my pie-in-the-sky desire! Pragmatically, as a technical person, I'd personally be happy with regular release notes of product revisions, including SaaS products, and which are paired with a technical-oriented blog that details the notes in further clarity for the technically adept. The role of journalists can step in here, and appropriately severe information will spread much as it does now. The upshot is that technical folks like us may learn a thing or two via such an open communication. If everyone did it then there would be less fear to do it and there would be more information avaialable about common risks and their mitigations.

by Kalium 8y ago

Are you familiar with California's Proposition 65? It was based on the same concept - never not inform. Some might opine that the consequences might have failed to meet hopes.

dleslie 8y ago

Nope, am Canadian. Canada is going to require disclosure of breaches starting November 1. That may allow for companies to still fail to disclose the _possibility_ of breaches, however. https://globalnews.ca/news/4122202/data-breach-canada-privacy-commissioner/ https://globalnews.ca/news/4122202/data-breach-canada-privac...

Kalium 8y ago
https://en.wikipedia.org/wiki/California_Proposition_65_(1986) https://en.wikipedia.org/wiki/California_Proposition_65_(198... Long story short, California requires labeling of things that may contain chemicals hazardous for a variety of reasons. The idea was simple - never not inform. The intentions were pure. The result is that basically everything has a vague and uninformative label about how it may contain chemicals that could be hazardous. The labels are spectacularly uninformative and incredibly numerous. They are universally ignored by everyone, as they constitute a sea of noise. The net result is that a wonderful, laudable, pure, kind, and compassionate idea - never not inform - has led to a deluge of useless informational notices in which actual useful notices are impossible to find. It might be worth considering that there could be a lesson in there.
- dleslie 8y ago
  Labeling is slightly different than simply informing, in that it is a specific method of informing. It would be like requiring Google to display information regarding this security issue on all of its pages. Warning labels have dubious efficacy, as evidenced by decades of grotesque warnings upon cigarette packaging and their limited success at reducing consumption; but that's not to say we ought not be able to know about the potential harms of a product or service, just that product labels sort of suck as a method of informing users. OTOH, Canada requires nutritional information on all food, and that's reasonably useful and successful _because_ the content of that label is strictly defined and reasonably useful.
  - Kalium 8y ago
    The core idea you have is amazing! Tell people, be sure they know their risks, communicate them clearly, and then they're empowered to make their own choices. It's a wonderful idea that both protects people and respects their autonomy. Nutritional information is relatively easy to provide is thoroughly exhaustive detail. How does one go about informing about data events that may or may not have occurred, and may or may not occur in the future, in a way that's comprehensible to users who must be assumed to have absolutely no technical grounding whatsoever? The most useful informative warning I think that could be reasonably provided runs like this: "Please be aware that any data you provide this service, and any data this service gathers, could previously, presently, or in the future be the subject of a data breach that may or may not be detected." While the warning could of course be improved by being made more specific about what data is concerned, this does not seem like a good way to produce useful and informative warnings. Instead, it seems to me that attempting to pursue that most wonderful of ideals - never fail to inform - could easily produce a sea of overcautious attempts to ensure a user is never not informed, and instead over-informed into oblivion. While such labels might potentially be successful in scaring users into using services less, this might not be the same as informing users. I do hope I've communicated clearly here. Please let me know if anything could have been better-written. More importantly, I've clearly failed to understand some of your wise and well-made points. Can you help me with what I've missed?
    - dleslie 8y ago
      As a non-technical user, if it were to be simplified like Nutritional Information, I would expect broad categories risk that receive either a check or no-check for the possibility of exposure. IE: X Authentication X Financial X Communications X Property Or such, so I can be aware at-a-glance that my user name, password, credit card information, private messages, or personal documents may have been compromised. I wouldn't be over-informed into oblivion, or at least not as likely to be, if the information available were suitably informative-yet-terse. Like a nutrition label. However, that's just my pie-in-the-sky desire! Pragmatically, as a technical person, I'd personally be happy with regular release notes of product revisions, including SaaS products, and which are paired with a technical-oriented blog that details the notes in further clarity for the technically adept. The role of journalists can step in here, and appropriately severe information will spread much as it does now. The upshot is that technical folks like us may learn a thing or two via such an open communication. If everyone did it then there would be less fear to do it and there would be more information avaialable about common risks and their mitigations.