13 ms·

> "We're sorry this happened." That about sums it up for all these privacy breaches these days. It's getting to the same level of "thoughts and prayers" for tr

> "We're sorry this happened." That about sums it up for all these privacy breaches these days. It's getting to the same level of "thoughts and prayers" for tragedies. No actual change or consequences for the problems happening, just empty "sorries" and "promises" that it won't happen again/they'll get it fixed. I don't know if this is a GDPR violation or not (as someone else asked), but if it is, I hope we start actually seeing action of these sorts of things.

fullshark 8y ago
Until consumers reveal that they care this is how it will be unless governments regulate/punish.
- Jhndb 8y ago
  And as we've seen so far, consumers do not care in the slightest.
- neurobashing 8y ago
  my response to this is always in the vein of, "how exactly should customers show they care?" "Well, leave!" isn't an option. They can't leave. Quitting Facebook when you're an active user means you lose a huge amount of social contact. I can think of a dozen people I know who are there because it's how they send baby pics and the like to family. They're non-technical and don't care about federated mastodons, they just want to see their niece and go to their high school reunion. So yeah they get really mad at this stuff but the network effect is so strong, you can't simultaneously convince the entire graduating class of whatever to plan reunions via some new thing when 1)everyone's already on facebook and 2)they've been using it for so long it's part of their workflow.
  - ams6110 8y ago
    Most people I know are getting off of Facebook, or were never on it. The only people I know who are really still active are people using it to market themselves/their business, and are not there because they care about Facebook, but because they want to be findable there (and everywhere). I guess I'm old, but I find that email is great for sending baby pics to friends and family, and for planning things.
    - ucosty 8y ago
      I had this problem recently, I wanted to get in contact with an old friend I hadn't seen in years. Because it had been so long I no longer had a current phone number or email address. At this stage we didn't even live in the same country as each other. Solving this problem, or problems like it, might go a long way to reducing the appeal of Facebook.
      - sdenton4 8y ago
        That's exactly why I joined Facebook in the first place...
    - neurobashing 8y ago
      I feel you but a quick search finds "As of the third quarter of 2018, Facebook had 2.27 billion monthly active users" so solve for that, not your dozen or so social group.
      - fullshark 8y ago
        A huge percentage are browsing but not posting anymore I would guess.
    - scarface74 8y ago
      Well anecdotally in your small social group that may be true. But Facebook has 2.27 Billion active users...
      - hazeii 8y ago
        ...for a certain value of 'active' (do they say how it's defined?) My experience of internet companies has generally been that user figures are somewhat exaggerated (to put it politely).
        scarface74 8y ago
        No matter how you define “active”, there is no indication that in the aggregate people are fleeing Facebook - no matter if a few anecdotes are posted on HN.
  - PhDuck 8y ago
    Leaving is of course an option. The fact that they don't leave mearly show that they value the gained social contact higher than the cost of data breaches.
    - neurobashing 8y ago
      that's my point, normal people value social interaction over an absolutist position of "well at least my data is secure!". normal people view never seeing their lil' cousin again as punishment, not the correct position to adopt bc it prevents being caught in a data breach
  - zentiggr 8y ago
    Let's make the next mandated change to Facebook's operations a red bordered, 90% screen coverage dialog, modal: "We are required to notify you that we have leaked information from your account, please be advised that we have no idea who has your profile information, pictures, post history or any other information contained in your posts. Please consider resetiing your entire online persona to avoid financial and/or social consequences." With two buttons: "Erase me from Facebook" or "I get it, I don't care." Just planting seeds, Bill Hicks style...
  - kodablah 8y ago
    > my response to this is always in the vein of, "how exactly should customers show they care?" The answer is the same with any other foul business practice you oppose. The problem is not unique to digital businesses and I really hope those demanding justice don't request something more brash than they otherwise would in a non-digital situation. And yes they can leave. There are real things you can't leave like your only ISP (internet is essential in modern society and no alternatives), then there are websites you can choose not to leave like FB (not essential in modern society). Your misuse of the word "can't" instead of "won't" just discourages any level of consumer responsibility.
    - neurobashing 8y ago
      can't and won't are effectively the same thing in this context; you're picking nits about free will. Yes, of course everyone can always leave. The only price - for more than a few of those 2 billion - is the complete disruption of their social lives. Telling someone they can never see cute pics of their lil cousin again is punishment, not a serious decision about consumer responsibility. You can tell because a history of malfeasance and yet, 2 billion active users.
bitxbitxbitcoin 8y ago
Useless, repeatedly broken promises. It is time to see how much teeth the GDPR really has.
- kodablah 8y ago
  Can we look to any other similar regulation to estimate how much teeth it will have when actually enforced?
enjo 8y ago
Genuinely curious on your view: what is an appropriate response?
- ColinDabritz 8y ago
  Not the op, but meaningful fines, executive jail time for gross negligence and especially for intentionally taking inappropriate risks, breaking up or closing companies that are shown over time to be unable to safely handle sensitive information. Proper regulation. Consequences that can't be cynically taken as the cost of doing business.
  - UncleMeat 8y ago
    Jail time for bugs? Have people here every worked on products? Bugs and security vulns are literally inevitable. Security is important but it this was the standard I'm not sure that any company would still exist.
    - vwcx 8y ago
      But why do financial services bugs garner a higher penalty than one that exposes private photos? This is an argument for regulation.
    - mirashii 8y ago
      Nobody said jail time for bugs, and phrasing that way is intentionally obscuring the debate. Gross negligence is an entirely different standard than just software bugs.
      - UncleMeat 8y ago
        Lots of people in this thread are explicitly saying jail time for bugs. What evidence is there that this was gross negligence?
    - ColinDabritz 8y ago
      Jail time for bugs that should have been preventible and caused harm to users. Mistakes and bugs happen, but we also have methods of mitigating them. Standards, quality controls, tests, analysis, and other care. I specifically said jail time for gross negligence because that means not taking care and allowing harm to users. If you had an error that leaked private information, it's worth an investigation. If it made it through despite controls, that's understandable. If they find you failed to do analysis on the risk to users privacy, if you failed to have controls in place, if you didn't code review or test the code, then you have made specific choices that harmed users. That should be criminal. We need to take software engineering seriously as a discipline. We have the potential to do more wide scale aggregate harm than any structural engineering collapse. We need to start acting like it.
canttestthis 8y ago
> I don't know if this is a GDPR violation or not (as someone else asked), but if it is, I hope we start actually seeing action of these sorts of things. Sounds like you're suggesting that we criminalize software bugs.
- inetknght 8y ago
  We criminalize other actions which result in harm to people. Why not software bugs too?
  - sdenton4 8y ago
    Well, there's two big differences... Planes have far fewer unknown unknowns than software: the specter bug in Intel chips is a great example of a place where the standard operating procedure was wrong, but no one ever knew it. It wasn't a case of negligence, though it had real world impact. The other big difference is that (for the most part) keeping a passenger plane in the air isn't an adversarial task. Actual breaches are the result of active bad actors, which is completely different from the problems you encounter in designing a plane. So criminal action seems crazy to me, though I can definitely see a great case for changing the incentives around storing user data. Could definitely see a good case for fines (and even an ongoing per-user tax, to make it an up front cost) for storing PII.
    - orhmeh09 8y ago
      I think it’s disputable that “no one ever knew” (or could have guessed) regarding Spectre and speculative execution generally. Intel took a risk for the sake of performance. This did not take long to find: Wang&already, 2006: “Information leakage through covert channels and side channels is becoming a serious problem, especially when these are enhanced by modern processor architecture features. We show how processor architecture features such as simultaneous multithreading, control speculation and shared caches can inadvertently accelerate such covert channels or enable new covert channels and side channels. We first illustrate the reality and severity of this problem by describing concrete attacks. We identify two new covert channels. We show orders of magnitude increases in covert channel capacities. We then present two solutions, Selective Partitioning and the novel Random Permutation Cache (RPCache). The RPCache can thwart most cache-based software side channel attacks, with minimal hardware costs and negligible performance impact.” http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.190.1003&rep=rep1&type=pdf http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.190...
izzydata 8y ago
The punishment should be mass loss of users due to loss of trust, but for some reason people still use it.
dreamdu5t 8y ago
Comparing Facebook to murder is dramatic and childish. This Facebook hysteria is tiring.
deleted 8y ago
[deleted]
jeklj 8y ago
Nothing bad ever comes to companies as a consequence of these leaks, so what is their incentive to stop them? It happens so often that it goes down the memory hole after maybe a week or two, so even that isn't much of an incentive. We shouldn't be surprised about this.
- ritchiea 8y ago
  There's a crowd here on HN that hates regulation but this is exactly why regulation exists. Massive, wealthy, powerful industries just aren't held accountable by average consumers or markets. There's no serious competitor that benefits if your data isn't safe at Facebook. And average people not only aren't powerful but have their own lives to look after. Without regulation massive companies are entirely unchecked, there is virtually never market pressure to fix problems like this.
  - TangoTrotFox 8y ago
    As one aside on this, the main issue people have with regulations is not regulations in and of themselves, but the negative effect they have on small businesses and competition/entrepreneurship more generally. I think you'd find extremely few genuine voices against regulations that only start to apply once a company (and all associated entities) grosses in excess of e.g. $100 million annual revenue. By that point companies the costs (as a fraction of their total revenue) in ensuring compliance, and complying itself is only going to be a minuscule fraction of revenue. By contrast these same costs can, and do, destroy or simply prevent the formation of smaller companies that could greatly expand the market to the benefit of all.
    - bredren 8y ago
      Seems straight forward to write that compliance to certain measures is based on gaap annual revenue. Though in practice, enforcement of regulations in general is already handled this way. For example a new startup in the valley doesn’t get a note from the gov because they launched without a privacy policy. Same in the App Store, a minor app breaking App Store rules doesn’t get knocked out because the downloads are too small to bother.
buboard 8y ago
Considering that gdpr doesnt contain a single technical requirement (in contrast to all food / safety / medical regulations) , typically anyone and anything or nothing can be a violation. Your guess is as good as mine
LinuxBender 8y ago
This may change when lives are actually lost. Self crashing cars have the potential to destroy the potential saving of life by intentional or accidental software bugs and security vulnerabilities. A congressman I was speaking with rephrased my statement and said that I was suggesting that self driving cars be treated as medical devices. I wholeheartedly agreed with his wording. That said, the same changes won't likely occur with sites like FB unless it can be proven that the data leaked lead to loss of life or physical harm. They create incentive's for people to happily be the product. How do we prove that damage has occurred to the product? Have any forums popped up where people share stories of harm to their family as a result of data leaked from FB? I can imagine GDPR being useful in the EU for corporate FB accounts. Wasn't FB working on a work-specific version of their site? If so, corporate legal teams would get involved in leaks, I would imagine.
- eitland 8y ago
  > I can imagine GDPR being useful in the EU for corporate FB accounts. Wasn't FB working on a work-specific version of their site? If so, corporate legal teams would get involved in leaks, I would imagine. I can imagine GDPR working very well for consumers as well, and it seems we are up for some real legal entertainment in the next few months/years :-) Edit: It also wouldn't surprise me if it gets worse before it gets better. If I was a publisher right now I'd seriously consider blocking access from EU countries. (But that would of course be an invitation for a small, agile publisher who'd succeed either with a micropayments based approach or a context based ads approach.)
- r00fus 8y ago
  It will happen if FB have to suffer financial consequences. GDPR will help, but we need companies to understand that personal data is not an asset, they are also liabilities.
  - LinuxBender 8y ago
    You are probably right. I would be curious to see a review from a lawyer on the AUP that users agree to. Some things can not be waived in certain jurisdictions. Otherwise people may have given permission and ownership of some of their data to FB to do with as they please.
gerdesj 8y ago
Whoops soz .... lol, l8erz. Kerching

fullshark 8y ago

Until consumers reveal that they care this is how it will be unless governments regulate/punish.

Jhndb 8y ago
And as we've seen so far, consumers do not care in the slightest.
neurobashing 8y ago
my response to this is always in the vein of, "how exactly should customers show they care?" "Well, leave!" isn't an option. They can't leave. Quitting Facebook when you're an active user means you lose a huge amount of social contact. I can think of a dozen people I know who are there because it's how they send baby pics and the like to family. They're non-technical and don't care about federated mastodons, they just want to see their niece and go to their high school reunion. So yeah they get really mad at this stuff but the network effect is so strong, you can't simultaneously convince the entire graduating class of whatever to plan reunions via some new thing when 1)everyone's already on facebook and 2)they've been using it for so long it's part of their workflow.
- ams6110 8y ago
  Most people I know are getting off of Facebook, or were never on it. The only people I know who are really still active are people using it to market themselves/their business, and are not there because they care about Facebook, but because they want to be findable there (and everywhere). I guess I'm old, but I find that email is great for sending baby pics to friends and family, and for planning things.
  - ucosty 8y ago
    I had this problem recently, I wanted to get in contact with an old friend I hadn't seen in years. Because it had been so long I no longer had a current phone number or email address. At this stage we didn't even live in the same country as each other. Solving this problem, or problems like it, might go a long way to reducing the appeal of Facebook.
    - sdenton4 8y ago
      That's exactly why I joined Facebook in the first place...
  - neurobashing 8y ago
    I feel you but a quick search finds "As of the third quarter of 2018, Facebook had 2.27 billion monthly active users" so solve for that, not your dozen or so social group.
    - fullshark 8y ago
      A huge percentage are browsing but not posting anymore I would guess.
  - scarface74 8y ago
    Well anecdotally in your small social group that may be true. But Facebook has 2.27 Billion active users...
    - hazeii 8y ago
      ...for a certain value of 'active' (do they say how it's defined?) My experience of internet companies has generally been that user figures are somewhat exaggerated (to put it politely).
      - scarface74 8y ago
        No matter how you define “active”, there is no indication that in the aggregate people are fleeing Facebook - no matter if a few anecdotes are posted on HN.
- PhDuck 8y ago
  Leaving is of course an option. The fact that they don't leave mearly show that they value the gained social contact higher than the cost of data breaches.
  - neurobashing 8y ago
    that's my point, normal people value social interaction over an absolutist position of "well at least my data is secure!". normal people view never seeing their lil' cousin again as punishment, not the correct position to adopt bc it prevents being caught in a data breach
- zentiggr 8y ago
  Let's make the next mandated change to Facebook's operations a red bordered, 90% screen coverage dialog, modal: "We are required to notify you that we have leaked information from your account, please be advised that we have no idea who has your profile information, pictures, post history or any other information contained in your posts. Please consider resetiing your entire online persona to avoid financial and/or social consequences." With two buttons: "Erase me from Facebook" or "I get it, I don't care." Just planting seeds, Bill Hicks style...
- kodablah 8y ago
  > my response to this is always in the vein of, "how exactly should customers show they care?" The answer is the same with any other foul business practice you oppose. The problem is not unique to digital businesses and I really hope those demanding justice don't request something more brash than they otherwise would in a non-digital situation. And yes they can leave. There are real things you can't leave like your only ISP (internet is essential in modern society and no alternatives), then there are websites you can choose not to leave like FB (not essential in modern society). Your misuse of the word "can't" instead of "won't" just discourages any level of consumer responsibility.
  - neurobashing 8y ago
    can't and won't are effectively the same thing in this context; you're picking nits about free will. Yes, of course everyone can always leave. The only price - for more than a few of those 2 billion - is the complete disruption of their social lives. Telling someone they can never see cute pics of their lil cousin again is punishment, not a serious decision about consumer responsibility. You can tell because a history of malfeasance and yet, 2 billion active users.

bitxbitxbitcoin 8y ago

Useless, repeatedly broken promises. It is time to see how much teeth the GDPR really has.

kodablah 8y ago
Can we look to any other similar regulation to estimate how much teeth it will have when actually enforced?

enjo 8y ago

Genuinely curious on your view: what is an appropriate response?

ColinDabritz 8y ago
Not the op, but meaningful fines, executive jail time for gross negligence and especially for intentionally taking inappropriate risks, breaking up or closing companies that are shown over time to be unable to safely handle sensitive information. Proper regulation. Consequences that can't be cynically taken as the cost of doing business.
- UncleMeat 8y ago
  Jail time for bugs? Have people here every worked on products? Bugs and security vulns are literally inevitable. Security is important but it this was the standard I'm not sure that any company would still exist.
  - vwcx 8y ago
    But why do financial services bugs garner a higher penalty than one that exposes private photos? This is an argument for regulation.
  - mirashii 8y ago
    Nobody said jail time for bugs, and phrasing that way is intentionally obscuring the debate. Gross negligence is an entirely different standard than just software bugs.
    - UncleMeat 8y ago
      Lots of people in this thread are explicitly saying jail time for bugs. What evidence is there that this was gross negligence?
  - ColinDabritz 8y ago
    Jail time for bugs that should have been preventible and caused harm to users. Mistakes and bugs happen, but we also have methods of mitigating them. Standards, quality controls, tests, analysis, and other care. I specifically said jail time for gross negligence because that means not taking care and allowing harm to users. If you had an error that leaked private information, it's worth an investigation. If it made it through despite controls, that's understandable. If they find you failed to do analysis on the risk to users privacy, if you failed to have controls in place, if you didn't code review or test the code, then you have made specific choices that harmed users. That should be criminal. We need to take software engineering seriously as a discipline. We have the potential to do more wide scale aggregate harm than any structural engineering collapse. We need to start acting like it.

canttestthis 8y ago

> I don't know if this is a GDPR violation or not (as someone else asked), but if it is, I hope we start actually seeing action of these sorts of things. Sounds like you're suggesting that we criminalize software bugs.

inetknght 8y ago
We criminalize other actions which result in harm to people. Why not software bugs too?
- sdenton4 8y ago
  Well, there's two big differences... Planes have far fewer unknown unknowns than software: the specter bug in Intel chips is a great example of a place where the standard operating procedure was wrong, but no one ever knew it. It wasn't a case of negligence, though it had real world impact. The other big difference is that (for the most part) keeping a passenger plane in the air isn't an adversarial task. Actual breaches are the result of active bad actors, which is completely different from the problems you encounter in designing a plane. So criminal action seems crazy to me, though I can definitely see a great case for changing the incentives around storing user data. Could definitely see a good case for fines (and even an ongoing per-user tax, to make it an up front cost) for storing PII.
  - orhmeh09 8y ago
    I think it’s disputable that “no one ever knew” (or could have guessed) regarding Spectre and speculative execution generally. Intel took a risk for the sake of performance. This did not take long to find: Wang&already, 2006: “Information leakage through covert channels and side channels is becoming a serious problem, especially when these are enhanced by modern processor architecture features. We show how processor architecture features such as simultaneous multithreading, control speculation and shared caches can inadvertently accelerate such covert channels or enable new covert channels and side channels. We first illustrate the reality and severity of this problem by describing concrete attacks. We identify two new covert channels. We show orders of magnitude increases in covert channel capacities. We then present two solutions, Selective Partitioning and the novel Random Permutation Cache (RPCache). The RPCache can thwart most cache-based software side channel attacks, with minimal hardware costs and negligible performance impact.” http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.190.1003&rep=rep1&type=pdf http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.190...

izzydata 8y ago

The punishment should be mass loss of users due to loss of trust, but for some reason people still use it.

dreamdu5t 8y ago

Comparing Facebook to murder is dramatic and childish. This Facebook hysteria is tiring.

deleted 8y ago

[deleted]

jeklj 8y ago

Nothing bad ever comes to companies as a consequence of these leaks, so what is their incentive to stop them? It happens so often that it goes down the memory hole after maybe a week or two, so even that isn't much of an incentive. We shouldn't be surprised about this.

ritchiea 8y ago
There's a crowd here on HN that hates regulation but this is exactly why regulation exists. Massive, wealthy, powerful industries just aren't held accountable by average consumers or markets. There's no serious competitor that benefits if your data isn't safe at Facebook. And average people not only aren't powerful but have their own lives to look after. Without regulation massive companies are entirely unchecked, there is virtually never market pressure to fix problems like this.
- TangoTrotFox 8y ago
  As one aside on this, the main issue people have with regulations is not regulations in and of themselves, but the negative effect they have on small businesses and competition/entrepreneurship more generally. I think you'd find extremely few genuine voices against regulations that only start to apply once a company (and all associated entities) grosses in excess of e.g. $100 million annual revenue. By that point companies the costs (as a fraction of their total revenue) in ensuring compliance, and complying itself is only going to be a minuscule fraction of revenue. By contrast these same costs can, and do, destroy or simply prevent the formation of smaller companies that could greatly expand the market to the benefit of all.
  - bredren 8y ago
    Seems straight forward to write that compliance to certain measures is based on gaap annual revenue. Though in practice, enforcement of regulations in general is already handled this way. For example a new startup in the valley doesn’t get a note from the gov because they launched without a privacy policy. Same in the App Store, a minor app breaking App Store rules doesn’t get knocked out because the downloads are too small to bother.

buboard 8y ago

Considering that gdpr doesnt contain a single technical requirement (in contrast to all food / safety / medical regulations) , typically anyone and anything or nothing can be a violation. Your guess is as good as mine

LinuxBender 8y ago

This may change when lives are actually lost. Self crashing cars have the potential to destroy the potential saving of life by intentional or accidental software bugs and security vulnerabilities. A congressman I was speaking with rephrased my statement and said that I was suggesting that self driving cars be treated as medical devices. I wholeheartedly agreed with his wording. That said, the same changes won't likely occur with sites like FB unless it can be proven that the data leaked lead to loss of life or physical harm. They create incentive's for people to happily be the product. How do we prove that damage has occurred to the product? Have any forums popped up where people share stories of harm to their family as a result of data leaked from FB? I can imagine GDPR being useful in the EU for corporate FB accounts. Wasn't FB working on a work-specific version of their site? If so, corporate legal teams would get involved in leaks, I would imagine.

eitland 8y ago
> I can imagine GDPR being useful in the EU for corporate FB accounts. Wasn't FB working on a work-specific version of their site? If so, corporate legal teams would get involved in leaks, I would imagine. I can imagine GDPR working very well for consumers as well, and it seems we are up for some real legal entertainment in the next few months/years :-) Edit: It also wouldn't surprise me if it gets worse before it gets better. If I was a publisher right now I'd seriously consider blocking access from EU countries. (But that would of course be an invitation for a small, agile publisher who'd succeed either with a micropayments based approach or a context based ads approach.)
r00fus 8y ago
It will happen if FB have to suffer financial consequences. GDPR will help, but we need companies to understand that personal data is not an asset, they are also liabilities.
- LinuxBender 8y ago
  You are probably right. I would be curious to see a review from a lawyer on the AUP that users agree to. Some things can not be waived in certain jurisdictions. Otherwise people may have given permission and ownership of some of their data to FB to do with as they please.

gerdesj 8y ago

Whoops soz .... lol, l8erz. Kerching