6 ms·

Would love to use this , but I’m sure this is one those many rushed applications with the startup mentality. Personal and Senstitive data is probably stored in

by asien 8y ago

Would love to use this , but I’m sure this is one those many rushed applications with the startup mentality. Personal and Senstitive data is probably stored in a totally unencrypted manner and developers have unrestricted access to production. We’ve seen what happens in terms of security when you give something like Firebase to startups « developers »[0] Love the concept , but I Care more about privacy. [0] https://searchsecurity.techtarget.com/news/252443616/Unprotected-Firebase-databases-leaked-over-100-million-records https://searchsecurity.techtarget.com/news/252443616/Unprote...

rpedela 8y ago
Do you have evidence or are you just being unnecessarily unkind?
- officialchicken 8y ago
  I don't think it's an unfair assessment about potential or actual security. And it's a fair critique. Whether it's a legitimate concern based on this particular implementation is another matter, but they are correct in that work history is probably sensitive personal history, perhaps not secretive. And there is evidence attached to the OP post - it's the link marked [0].
  - rpedela 8y ago
    This thread is about this specific app/idea/team. It is not about potential security problems in general. The parent could have just asked "what is the security and privacy?" rather than make baseless assumptions and accusations. So no, it is not a fair critique without more information and I don't see how an article about unsecured Firebase databases is related given the current information. I can give you a similar article about unsecured, internet accessible Elasticsearch servers, but does that mean the ones I run are unsecured? You could assume that if you want but that would be an incorrect assumption.
    - fhbdukfrh 8y ago
      If I'm a customer in a domain where these are concerns though, each question you make me ask during my evaluation is a chance for me to quit doing the work and move on to something else that's less effort, like the competing product that pushes their security and privacy policies upfront as a product benefit. So don't ask me to pull myself through your sales funnel, make the process easy by addressing my major concerns before i need to ask.
      - rpedela 8y ago
        Yes! Great advice! That is exactly what Show HNs are for. Tell the founders how they can improve such as including security and privacy information in their marketing materials.
- deleted 8y ago
  [deleted]
- sanderjd 8y ago
  I wouldn't be so blunt as the parent, but I think their comment demonstrates something that would be foolish to ignore if you're a potential business founder: credibility matters, and SaaS has a major credibility problem when it comes to personal data protection. If you're collecting personal data - and especially if you are targeting a market that is particular aware of how widespread data beaches are - it would behoove you to include your data protection approach in your sales pitch.
  - nerdponx 8y ago
    Honestly I'm not so sure. People apparently use Grammarly.
- imh 8y ago
  The next comment down is also about privacy, but in the context of business model instead of security. Maybe people (in our niche, at least) are starting to prioritize their data more than ever.
- abalone 8y ago
  Having evidence of this particular app having poor security practices prior to expressing concerns is an impossibly high standard. The comment is clearly based on a pattern of early stage apps putting security second. I think it's fair to ask early stage apps handling highly sensitive info to at least show some evidence that they are following secure data handling practices. This is a good HN conversation to have, not unnecessarily negative. So that would be my feedback to the poster: Detail how you ensure privacy and secure data. That should be a major part of the product description for this type of app at the outset.
  - Symbiote 8y ago
    > Detail how you ensure privacy and secure data. That should be… I assume the app will target American users, but it could be useful to think through the privacy and data security with the EU GDPR — where that "should" becomes a "must". I'll just copy a few bits, but the articles here are the most relevant: https://gdpr-info.eu/art-13-gdpr/ https://gdpr-info.eu/art-13-gdpr/ : "Provide the data subject with ... the purposes of the processing for which the personal data are intended as well as the legal basis for the processing ... the recipients or categories of recipients of the personal data, if any" Is the data shared with anyone? https://gdpr-info.eu/art-30-gdpr/ https://gdpr-info.eu/art-30-gdpr/ : "...shall maintain a record of ... the envisaged time limits for erasure of the different categories of data ... a general description of the technical and organisational security measures ..." How long is data kept after the interviews are completed? https://gdpr-info.eu/art-32-gdpr/ https://gdpr-info.eu/art-32-gdpr/ : "The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law." Can your developers access private data?
- tozeur 8y ago
  OP isn’t being unkind, it’s simply feedback. Not disrespect intended, but don’t be so sensitive:)
scarejunba 8y ago
Would love to read this comment but it's possible this is one of those Russian troll comments. It's probably coming straight out of the Kremlin. We've all seen how they get someone elected and polarize nations. Love the idea of a comment, but I care more about not enabling evil people from getting control.
web007 8y ago
Hitchen's razor applies here: "What can be asserted without evidence can be dismissed without evidence." It's unfair to assume poor security practices. It's also ridiculous for a Show HN to be expected to meet a burden like "separation of access" when it's likely a person, singular, that has produced this app.
dang 8y ago
This comment breaks the Show HN guidelines. Please read them: https://news.ycombinator.com/showhn.html https://news.ycombinator.com/showhn.html. A fairer way to post something about this would have been to ask a question about privacy concerns.

by asien 8y ago

rpedela 8y ago

Do you have evidence or are you just being unnecessarily unkind?

officialchicken 8y ago
I don't think it's an unfair assessment about potential or actual security. And it's a fair critique. Whether it's a legitimate concern based on this particular implementation is another matter, but they are correct in that work history is probably sensitive personal history, perhaps not secretive. And there is evidence attached to the OP post - it's the link marked [0].
- rpedela 8y ago
  This thread is about this specific app/idea/team. It is not about potential security problems in general. The parent could have just asked "what is the security and privacy?" rather than make baseless assumptions and accusations. So no, it is not a fair critique without more information and I don't see how an article about unsecured Firebase databases is related given the current information. I can give you a similar article about unsecured, internet accessible Elasticsearch servers, but does that mean the ones I run are unsecured? You could assume that if you want but that would be an incorrect assumption.
  - fhbdukfrh 8y ago
    If I'm a customer in a domain where these are concerns though, each question you make me ask during my evaluation is a chance for me to quit doing the work and move on to something else that's less effort, like the competing product that pushes their security and privacy policies upfront as a product benefit. So don't ask me to pull myself through your sales funnel, make the process easy by addressing my major concerns before i need to ask.
    - rpedela 8y ago
      Yes! Great advice! That is exactly what Show HNs are for. Tell the founders how they can improve such as including security and privacy information in their marketing materials.
deleted 8y ago
[deleted]
sanderjd 8y ago
I wouldn't be so blunt as the parent, but I think their comment demonstrates something that would be foolish to ignore if you're a potential business founder: credibility matters, and SaaS has a major credibility problem when it comes to personal data protection. If you're collecting personal data - and especially if you are targeting a market that is particular aware of how widespread data beaches are - it would behoove you to include your data protection approach in your sales pitch.
- nerdponx 8y ago
  Honestly I'm not so sure. People apparently use Grammarly.
imh 8y ago
The next comment down is also about privacy, but in the context of business model instead of security. Maybe people (in our niche, at least) are starting to prioritize their data more than ever.
abalone 8y ago
Having evidence of this particular app having poor security practices prior to expressing concerns is an impossibly high standard. The comment is clearly based on a pattern of early stage apps putting security second. I think it's fair to ask early stage apps handling highly sensitive info to at least show some evidence that they are following secure data handling practices. This is a good HN conversation to have, not unnecessarily negative. So that would be my feedback to the poster: Detail how you ensure privacy and secure data. That should be a major part of the product description for this type of app at the outset.
- Symbiote 8y ago
  > Detail how you ensure privacy and secure data. That should be… I assume the app will target American users, but it could be useful to think through the privacy and data security with the EU GDPR — where that "should" becomes a "must". I'll just copy a few bits, but the articles here are the most relevant: https://gdpr-info.eu/art-13-gdpr/ https://gdpr-info.eu/art-13-gdpr/ : "Provide the data subject with ... the purposes of the processing for which the personal data are intended as well as the legal basis for the processing ... the recipients or categories of recipients of the personal data, if any" Is the data shared with anyone? https://gdpr-info.eu/art-30-gdpr/ https://gdpr-info.eu/art-30-gdpr/ : "...shall maintain a record of ... the envisaged time limits for erasure of the different categories of data ... a general description of the technical and organisational security measures ..." How long is data kept after the interviews are completed? https://gdpr-info.eu/art-32-gdpr/ https://gdpr-info.eu/art-32-gdpr/ : "The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law." Can your developers access private data?
tozeur 8y ago
OP isn’t being unkind, it’s simply feedback. Not disrespect intended, but don’t be so sensitive:)

scarejunba 8y ago

Would love to read this comment but it's possible this is one of those Russian troll comments. It's probably coming straight out of the Kremlin. We've all seen how they get someone elected and polarize nations. Love the idea of a comment, but I care more about not enabling evil people from getting control.

web007 8y ago

Hitchen's razor applies here: "What can be asserted without evidence can be dismissed without evidence." It's unfair to assume poor security practices. It's also ridiculous for a Show HN to be expected to meet a burden like "separation of access" when it's likely a person, singular, that has produced this app.

dang 8y ago

This comment breaks the Show HN guidelines. Please read them: https://news.ycombinator.com/showhn.html https://news.ycombinator.com/showhn.html. A fairer way to post something about this would have been to ask a question about privacy concerns.