5 ms·

Wait a minute there's a public archive of Compuserve data noone has any clue what it is? What if it's PII? It wasn't that long ago to make this a non-issue.

by chx 8y ago

jboy55 8y ago
Completely scary, what a massive security breach just casually thought of as a digital challenge.
shawnz 8y ago
I wonder, who is responsible in a case like this? Is it the current owners of CompuServe for not clearing the PII before trashing the machines?
- icedchai 8y ago
  This is very common. I've bought machines at auction with databases on them.
  - neilv 8y ago
    Yes, though not as bad as it used to be, IME. It seems a lot of ordinary people now know to pull or wipe drives before disposing of a computer. I've acquired over 100 used computers, and, once I saw how common leaving data on them was, I began always very promptly DBAN-ing any disks, and wiping SSDs. If it has a non-SATA interface, I destroy the medium. Similar with some kind of wipe of smartphones. Besides wiping the disk/device seeming a responsible and considerate thing to do, it avoids remote yet severe liabilities.
    - opless 8y ago
      You know that you can't truly "wipe" SSDs, right?
      - detaro 8y ago
        It's not that simple. A secure erase should wipe all blocks (and since it is done by the firmware, physical blocks, not logical ones), but there have been instances of buggy drives that don't actually do it properly. Some SSDs also transparently encrypt all data written, and the key is replaced on a wipe command. Even if they don't wipe the data fully, it's now unusable, if the encryption works correctly. Quite old SSDs might not support any of this.
        chx 8y ago
        I thought all SSDs support ATA password.
        detaro 8y ago
        I don't think ATA password necessarily means the drive content is encrypted, or helps you fully wipe a drive you obtained from somewhere else.
        veeti 8y ago
        > Even if they don't wipe the data fully, it's now unusable, if the encryption works correctly. Unfortunately, you can't trust the SSD firmware developers to have their shit together [1]. [1] https://techcrunch.com/2018/11/05/crucial-samsung-solid-state-drives-busted-encryption/ https://techcrunch.com/2018/11/05/crucial-samsung-solid-stat...
        detaro 8y ago
        Which is why the if is in there :(
- gowld 8y ago
  The no longer existent corporate person is responsible. Same as if a real person copied all your info, published it, and died.
  - shawnz 8y ago
    They do still exist though, and they are a subsidiary of Verizon. So is Verizon responsible even though nobody at Verizon had anything to do with it? Does the person who redistributed the data have any responsibility?
    - nathan_long 8y ago
      > So is Verizon responsible even though nobody at Verizon had anything to do with it? Imagine if CompuServe still existed, but they had undergone 100% employee turnover in recent years. They'd still be liable, right? It seems to me that when Verizon bought CompuServe, they calculated that its assets minus its liabilities totaled less than the purchase price and hence it was a good deal. If we treat leakable data as a legal liability, it should send the right financial signal - eg, maybe as a company you don't want to collect much.
rkagerer 8y ago
As much as I'm fascinated by this work and the author's tenacity, as a past user of CompuServe I'm quite alarmed at the prospect of my data falling into the hands of a random tech junkie blogging on the internet. Verizon, if you're out there - please get a handle on this breach before my lawyers call you.
- icedchai 8y ago
  Yes, I was a CompuServe user back in 1988. I'm very concerned about my teenage "CB" chat logs falling into the wrong hands.
  - ghaff 8y ago
    :-) Although I was no longer a teenager and don't think I ever used chat, it's hard for me to imagine just about anything in my early online presence that would cause me more than very mild embarrassment today. Yeah, someone should have scrubbed these. But it's hard for me to get too worked up.
  - CamperBob2 8y ago
    Eh, buy the ticket, take the ride. Don't type anything on a keyboard today that you don't want to see on the front page of the newspaper tomorrow. I learned that lesson at 300 baud, long before I had ever heard of CompuServe, but that didn't stop me from forgetting it a time or two when I got my CS account. So if there's anything in this archive that would embarrass you, well, at least you're in good company.
  - zeveb 8y ago
    Past Senate and current Presidential candidate Robert Francis O'Rourke felt a need to apologise for his adolescent fiction, which he posted online. You might be surprised what you posted back then. I know that when I've gone back and reviewed my own history I've been surprised what I posted for posterity as a kid. I didn't understand that it'd be out there for the rest of my life.
    - CamperBob2 8y ago
neilv 8y ago
Perhaps the CompuServe PII wasn't covered by modern 'privacy' policies that have users 'consent' to the company doing whatever it wants. A big company might be vulnerable to class action from a bunch of people who are tech-savvy and affluent enough to have been using Compu$erve.
reaperducer 8y ago
What if it's PII? If anyone finds data for 72167,7570, send a copy back to me.
- ramses0 8y ago
  ...but seriously... I think I still remember my "license plate" number for prodigy.net, which I think was 7 digits alpahnumeric. I've very occasionally searched for it thinking there was maybe an archive or footprints from "those days" but nothing has ever come up. Quite literally the transition of physical paper => digital forums => internet (pre-crawlers/pre-archive) => where the data could have been lost before it had a chance to be "modernized".

Wait a minute there's a public archive of Compuserve data noone has any clue what it is? What if it's PII? It wasn't that long ago to make this a non-issue.

by chx 8y ago

Wait a minute there's a public archive of Compuserve data noone has any clue what it is? What if it's PII? It wasn't that long ago to make this a non-issue.

jboy55 8y ago

Completely scary, what a massive security breach just casually thought of as a digital challenge.

shawnz 8y ago

I wonder, who is responsible in a case like this? Is it the current owners of CompuServe for not clearing the PII before trashing the machines?

icedchai 8y ago
This is very common. I've bought machines at auction with databases on them.
- neilv 8y ago
  Yes, though not as bad as it used to be, IME. It seems a lot of ordinary people now know to pull or wipe drives before disposing of a computer. I've acquired over 100 used computers, and, once I saw how common leaving data on them was, I began always very promptly DBAN-ing any disks, and wiping SSDs. If it has a non-SATA interface, I destroy the medium. Similar with some kind of wipe of smartphones. Besides wiping the disk/device seeming a responsible and considerate thing to do, it avoids remote yet severe liabilities.
  - opless 8y ago
    You know that you can't truly "wipe" SSDs, right?
    - detaro 8y ago
      It's not that simple. A secure erase should wipe all blocks (and since it is done by the firmware, physical blocks, not logical ones), but there have been instances of buggy drives that don't actually do it properly. Some SSDs also transparently encrypt all data written, and the key is replaced on a wipe command. Even if they don't wipe the data fully, it's now unusable, if the encryption works correctly. Quite old SSDs might not support any of this.
      - chx 8y ago
        I thought all SSDs support ATA password.
        detaro 8y ago
        I don't think ATA password necessarily means the drive content is encrypted, or helps you fully wipe a drive you obtained from somewhere else.
      - veeti 8y ago
        > Even if they don't wipe the data fully, it's now unusable, if the encryption works correctly. Unfortunately, you can't trust the SSD firmware developers to have their shit together [1]. [1] https://techcrunch.com/2018/11/05/crucial-samsung-solid-state-drives-busted-encryption/ https://techcrunch.com/2018/11/05/crucial-samsung-solid-stat...
        detaro 8y ago
        Which is why the if is in there :(
gowld 8y ago
The no longer existent corporate person is responsible. Same as if a real person copied all your info, published it, and died.
- shawnz 8y ago
  They do still exist though, and they are a subsidiary of Verizon. So is Verizon responsible even though nobody at Verizon had anything to do with it? Does the person who redistributed the data have any responsibility?
  - nathan_long 8y ago
    > So is Verizon responsible even though nobody at Verizon had anything to do with it? Imagine if CompuServe still existed, but they had undergone 100% employee turnover in recent years. They'd still be liable, right? It seems to me that when Verizon bought CompuServe, they calculated that its assets minus its liabilities totaled less than the purchase price and hence it was a good deal. If we treat leakable data as a legal liability, it should send the right financial signal - eg, maybe as a company you don't want to collect much.

rkagerer 8y ago

As much as I'm fascinated by this work and the author's tenacity, as a past user of CompuServe I'm quite alarmed at the prospect of my data falling into the hands of a random tech junkie blogging on the internet. Verizon, if you're out there - please get a handle on this breach before my lawyers call you.

icedchai 8y ago
Yes, I was a CompuServe user back in 1988. I'm very concerned about my teenage "CB" chat logs falling into the wrong hands.
- ghaff 8y ago
  :-) Although I was no longer a teenager and don't think I ever used chat, it's hard for me to imagine just about anything in my early online presence that would cause me more than very mild embarrassment today. Yeah, someone should have scrubbed these. But it's hard for me to get too worked up.
- CamperBob2 8y ago
  Eh, buy the ticket, take the ride. Don't type anything on a keyboard today that you don't want to see on the front page of the newspaper tomorrow. I learned that lesson at 300 baud, long before I had ever heard of CompuServe, but that didn't stop me from forgetting it a time or two when I got my CS account. So if there's anything in this archive that would embarrass you, well, at least you're in good company.
- zeveb 8y ago
  Past Senate and current Presidential candidate Robert Francis O'Rourke felt a need to apologise for his adolescent fiction, which he posted online. You might be surprised what you posted back then. I know that when I've gone back and reviewed my own history I've been surprised what I posted for posterity as a kid. I didn't understand that it'd be out there for the rest of my life.
  - CamperBob2 8y ago

neilv 8y ago

Perhaps the CompuServe PII wasn't covered by modern 'privacy' policies that have users 'consent' to the company doing whatever it wants. A big company might be vulnerable to class action from a bunch of people who are tech-savvy and affluent enough to have been using Compu$erve.

reaperducer 8y ago

What if it's PII? If anyone finds data for 72167,7570, send a copy back to me.

ramses0 8y ago
...but seriously... I think I still remember my "license plate" number for prodigy.net, which I think was 7 digits alpahnumeric. I've very occasionally searched for it thinking there was maybe an archive or footprints from "those days" but nothing has ever come up. Quite literally the transition of physical paper => digital forums => internet (pre-crawlers/pre-archive) => where the data could have been lost before it had a chance to be "modernized".