7 ms·
> Last - and most important for me - in industries like my own (healthcare), you work with highly regulated data that has to be stored securely, where having mu
by marcus_holmes 8y ago
> Last - and most important for me - in industries like my own (healthcare), you work with highly regulated data that has to be stored securely, where having multiple copies of data on multiple laptops can pose an unacceptably large risk.
um... please tell me devs don't have access to production data in a healthcare environment (of all places!).
I mean, I understand the need for a representative dataset to develop and test against, but this is people's lives they're playing with!
And, you know, if you had a decent set of anonymised or fictitious customer data to work with, you wouldn't need to run your IDE in docker, and there would be less surface area for attackers to get to the data.
- hjk05 8y agoIf you only work with fictitious data, the conclusions of your analysis and models... will be fictitious. Even anonymised date (which most healthcare data is btw.) has strict requirements on access control and copying. As for “develop and test against”. There’s the entire field of data science and modeling that’s not focused with developing systems to expose the data, but doing analysis on the data.
- Tenoke 8y ago>If you only work with fictitious data, the conclusions of your analysis and models... will be fictitious. Not necessarily, there is a lot of work done on synthetic data which closely matches the properties of the real data both in academia and increasingly in industry.
- onion2k 8y agoIf you only work with fictitious data, the conclusions of your analysis and models... will be fictitious. That doesn't have to mean it's worse though. Testing with 10,000,000 fictitious accounts generated to cover lots of permutations of user data is a great idea even if the real data won't ever have some of those permutations. It's a testing technique called "fuzzing", and it's quite common.
- IanCal 8y agoIt entirely depends on what you're trying to deal with. You may solve some problems there but looking at real data is a must for solving others.
- achompas 8y agoHow do you ensure your fuzzed data has statistical signal that approximates those present in the true data?
- hjk05 8y agoThat’s testing not modeling. If someone asks you to do analysis of a drug trial and you come back with a report based on fictitious user data because “devs should not have access to real data” you’ll be laughed out the room.
- marcus_holmes 8y agosure, but are data scientists analysing vast amounts of actual customer data really using VSCode?
- jldugger 8y agoThey tend to just use a browser IDE like Jupyter... =(
- hjk05 8y agoYes... What do you think they’d use? Those who prefer python are using PyCharm and VSCode, and then some use Jupyther, while others use Rstudio, matlab or Mathematica. Of cause you also have some doing emacs or vim, but that’s a minority.
- bmj 8y agoAnd, you know, if you had a decent set of anonymised or fictitious customer data to work with, you wouldn't need to run your IDE in docker, and there would be less surface area for attackers to get to the data. I see this particular development environment as an advantage for this particular situation. I work in health care, and in R&D we often have to help debug issues with a client implementation, which means having an anonymized snapshot of their data in our reporting system. Typically, we end up passing around DB backups and zip files of the client-specific code. It would be significantly easier to fire up a Docker container that was ready to go.
- 0xDEFC0DE 8y ago>um... please tell me devs don't have access to production data in a healthcare environment (of all places!). Have seen it quite a few times, but there needed to be a good reason and other options had to be exhausted. A few examples were due to zero-width characters which were sanitized by whatever tool that anonymized data, but broke something in the program. There are brittle systems in healthcare.
- stevehawk 8y agosometimes it feels like there are only brittle systems in healthcare.
- FrozenTuna 8y agoThey do. In my experience, every query containing PII was logged. I trust it since I got a stern talking to when I emailed my private email some code I wrote for an unrelated side-project while at work. Lesson learned.
- Kuraj 8y ago> I got a stern talking to when I emailed my private email some code I wrote for an unrelated side-project while at work. I made the same mistake once. We should we glad we weren't fired.
- kuzehanka 8y ago> um... please tell me devs don't have access to production data If developers don't have access to production data, then the solution is useless. How do people not understand this in 2019? Millions of dollars have been dumped into various products centred around the idea of synthesizing 'production-like' data and all have failed. Because synthesizing fake data destroys the signal that makes the original data useful in the first place. If the engineers don't have access to it, then they can't extract the value from it, then what the hell are you doing in the first place? You think if you give engineers a synthetic dataset and they build a blind solution around it, that the users will be extract value out of that data? That myth was dispelled a decade ago and there doesn't exist a single synthetic data success story since then. I've had clients coming to us with the notion that they can give us fake imaging data and we can generate diagnostic insights from it. This crap needs to stop. If you can't trust engineers with your data to extract value out of it, then go ahead and munge it in excel.
- MuffinFlavored 8y ago> If developers don't have access to production data, then the solution is useless. How do people not understand this in 2019? ... what?
- jldugger 8y agoThink machine learning.
- inetknght 8y agoI am thinking machine learning. I am thinking I don't want a developer to run machine learning algorithms in a (unsanitized) development environment with access to production data.
- kuzehanka 8y agoHow do you train validate and market test an ml model without access to production data? Please teach us all, this is literally a billion dollar industry question.
- bazylion 8y agoI work for healthcare and you are right, this article is bullshit. 90% of time we work on data that comes from expensive medical simulators. When we need specific real cases (e.g. for feeding to machine learning algorithms), we use real data from patients but this data goes through process of full anonymisation done by special team. Devs dont have access to production medical data, regulators would kill us otherwise
- johnmurray_io 8y agoNot sure about VSCode, but I use CLion's remote-development workflow with a local docker container. Works well enough for my purposes.
- munchbunny 8y agoYou don't want standing access to this data. That would be a very bad idea. On the other hand, you do need devs to be able to look at real data when it's absolutely necessary (generally with a code-enforced gatekeeper and an audit trail). And you need to make sure a dev can SSL into a node for repair/maintenance (again with an audit trail). That's the argument for using one of the many Identity and Access Management tools/providers out there, including the systems that come baked into the cloud providers.
- binalpatel 8y agoYou certainly read a lot into that statement. Who said the data isn't anomymized and deidentifed? It's not a matter of just stripping identifiers off data and sending it off left and right, even then it's better to control access in a central, secure area. Even if you've deidentifed to an individual level there's inherent risk, that's why accessing even "public" datasets like Mimic III is still process heavy.