3 ms·

> Should Pastebin be allowed to exist? Yes, because as far as I know, Pastebin doesn't process sent data to provide its service. They just store it, they could

by antpls 7y ago

> Should Pastebin be allowed to exist? Yes, because as far as I know, Pastebin doesn't process sent data to provide its service. They just store it, they could simply store it encrypted and say they can't access data. On the other hand, GitHub process repositories to provide further services. They already read the sent data. > The "cost" here isn't really money, it's a social cost. It's regular people's access to services that, on net, make their lives much better. What about the cost for people whose data leaked? Are you saying we should treat them as collateral damage for others to have an "accessible" service? That sounds irresponsible. > Should the Open Source developers behind Wordpress and Ghostery be liable for not scrubbing PII off of websites? The "cost" here isn't really money, it's a social cost. No, as long as they don't operate public instances of those softwares, they don't need to include all the tooling for detecting and handling PII. However, anyone who wishes to operate those softwares with a way to publicly sent data to it should implement privacy safeguards. > ordinary developers. In 2000s, we were the "ordinary developers". All the leaks happening today is because we didn't care enough about that aspect of software engineering. The new wave of developers should always have privacy in mind before writing software for businesses, and to change the mentality, changing a platform like GitHub would help spreading a new culture of security and privacy-oriented mindset. > In regards to your edit 2, Github is a collection of software repositories. Say you replace all social security numbers with <number-redacted>. If I'm a screen scraper, that doesn't block me -- I can just clone the repository. There is no way that Github can block this unless they delete or replace the numbers in the actual uploaded code, which would obviously be a bad idea. Github is an opinionated centralized collections of software repositories. It should be simpler : If your repository is private, then there should be no filter or review at all. If you repository is public or becomes public, then it should be draconian about what is posted and shared. No hate speech, no PII, etc. If there is a positive detection, then the repository should automatically turn private or be suspended until it's resolved. > So what happens when ownership transfers? Unsolved issue so far, I don't have proposition about it > I don't understand how a review process would help here unless it was a review process on literally every commit. Regarding publicly sharing information on famous platforms like GitHub, it should be mandatory IMHO. I would happily trade a few false positives for a better peace of mind.

danShumway 7y ago
> What about the cost for people whose data leaked? Are you saying we should treat them as collateral damage for others to have an "accessible" service? Yes. That's what being in a society means, you have to put some thought into the collective good of allowing a service to exist. Living in a society means that sometimes you accept a greater personal risk in order to allow a large number of people to access services that better their lives. It's how cars work, for example. You're drawing a distinction between private and public that seems completely arbitrary to me. If we really ought to be doing everything in our power to limit PII leaks, I don't see why operating a private service is any excuse. Why do I care whether a message was meant to be public or private if it leaks my PII? I could see an argument for something like end-to-end encryption being exempt, because in that case the service provider literally can't scan the messages. But where my texts, or a private software repository, or self-hosted software are concerned, there's nothing technical or legal that prevents companies and software providers from running the exact same tests as they would on publicly facing content. If we're going to hold public hosts accountable, why are we letting private hosts off the hook? And if it seems obvious that private hosts shouldn't be subject to those restrictions, then what's fundamentally different about a public host that means they should? You can't think about PII as a black-and-white issue, these are a set of tradeoffs that have to be run through a cost-benefit analysis. > Github is an opinionated centralized collections of software repositories. A side-effect of making moderation into an indicator of responsibility is that platforms will stop moderating. Platforms like Facebook and Twitter are bad at moderation, but we don't want them to turn off all of their moderation and become 8Chan. The "they already moderate some things" argument can have some really negative side-effects, because it punishes companies and increases their liability just for trying to be better. Quick side-note, Pastebin does do some text processing for spam detection, particularly around links. But let's assume a service which did no moderation at all. It sounds good to say this service should be treated differently than Github. But what you end up with in that scenario is that everybody stops doing moderation. If your goal is to make it harder for people to publicly post PII, then this is counterproductive. You should be trying to make it easier and less risky for companies like Github to moderate content. > Unsolved issue so far, I don't have proposition about it. Well... don't you think you should solve that before you make a policy? If I propose a car with square wheels, I can't just say, "don't worry, I'll figure out how to make them roll after I build it."

by antpls 7y ago

danShumway 7y ago

> What about the cost for people whose data leaked? Are you saying we should treat them as collateral damage for others to have an "accessible" service? Yes. That's what being in a society means, you have to put some thought into the collective good of allowing a service to exist. Living in a society means that sometimes you accept a greater personal risk in order to allow a large number of people to access services that better their lives. It's how cars work, for example. You're drawing a distinction between private and public that seems completely arbitrary to me. If we really ought to be doing everything in our power to limit PII leaks, I don't see why operating a private service is any excuse. Why do I care whether a message was meant to be public or private if it leaks my PII? I could see an argument for something like end-to-end encryption being exempt, because in that case the service provider literally can't scan the messages. But where my texts, or a private software repository, or self-hosted software are concerned, there's nothing technical or legal that prevents companies and software providers from running the exact same tests as they would on publicly facing content. If we're going to hold public hosts accountable, why are we letting private hosts off the hook? And if it seems obvious that private hosts shouldn't be subject to those restrictions, then what's fundamentally different about a public host that means they should? You can't think about PII as a black-and-white issue, these are a set of tradeoffs that have to be run through a cost-benefit analysis. > Github is an opinionated centralized collections of software repositories. A side-effect of making moderation into an indicator of responsibility is that platforms will stop moderating. Platforms like Facebook and Twitter are bad at moderation, but we don't want them to turn off all of their moderation and become 8Chan. The "they already moderate some things" argument can have some really negative side-effects, because it punishes companies and increases their liability just for trying to be better. Quick side-note, Pastebin does do some text processing for spam detection, particularly around links. But let's assume a service which did no moderation at all. It sounds good to say this service should be treated differently than Github. But what you end up with in that scenario is that everybody stops doing moderation. If your goal is to make it harder for people to publicly post PII, then this is counterproductive. You should be trying to make it easier and less risky for companies like Github to moderate content. > Unsolved issue so far, I don't have proposition about it. Well... don't you think you should solve that before you make a policy? If I propose a car with square wheels, I can't just say, "don't worry, I'll figure out how to make them roll after I build it."