3 ms·
I wonder if “Strategic Lack of Log Retention” would make a good conference topic. The problem with what Google is doing is that they are insinuating that a lac
by foobiekr 8y ago
I wonder if “Strategic Lack of Log Retention” would make a good conference topic.
The problem with what Google is doing is that they are insinuating that a lack of evidence is evidence of lack. This is not unlike when companies like Equifax claim “we have no evidence...”
We should not be rewarding companies for strategically avoiding culpability.
- tdb7893 8y agoI feel like lack of logs can increase apparent culpability (as this scenario shows). It seems a little silly they don't store anything after two weeks but I was explained elsewhere that a lot of the reason was that those logs can contain user data and they can't lose it or turn it over to the feds if it doesn't exist.
- foobiekr 8y agoIt can, however it also makes it harder to really pin them on anything. I think that's a net win. I understand the position that excessive log retention can itself create a high-risk metadata pool, but there are ways to mitigate that by tokenizing them or removing PII data without having zero usage information.