33 ms·

I'd like to point out, it's not "DoorDash" that has done anything wrong, it's these people: - Andy Fang - Evan Moore - Stanley Tang - Tony Xu They decided

by geocar 7y ago

I'd like to point out, it's not "DoorDash" that has done anything wrong, it's these people: - Andy Fang - Evan Moore - Stanley Tang - Tony Xu They decided our security and privacy wasn't worth as much as hur hur hur growth hacking startup hur hur next uber, and couldn't be arsed to even give us a proper apology. Look at their blog post: not one mention of the words "we sorry, we fucked up". It's all about the other guys. The bad guys. The guys who stole your data not us, and you should change your password with us to protect your account with us. No. That's wrong. Look at the 295 million people who weren't affected -- all the people who don't use doordash at all! That means the best way to protect yourself is to simply not use doordash. Delete it. Delete the email account and the bank/credit card you used with them (ask your bank/credit card company for a new number). Move if you've got to (drivers license details!?!?!?) You have no other protection now- you're fucked. They have your data, and they're only going to risk it again. And remember how difficult it is to get in control of your data again when the next breach happens, the next time you're thinking about signing up with something, or you're getting ready to vote.

WilliamEdward 7y ago
Could not agree more. There's a tendency to not blame founders... but why? They created the product from the ground up. They had a choice on how to build security and chose the easy way out. They should be held to a higher standard given the power dynamics they have over the company and its users.
- deleted 7y ago
  [deleted]
souterrain 7y ago
The founders are very busy devising wage theft schemes. How can they possibly spend time on security or apologies?
- paulddraper 7y ago
  > devising wage theft schemes Expand?
  - nwsm 7y ago
    Basically if you "tip" a driver through DoorDash, the tip doesn't really end up going to them. https://qz.com/1659475/the-merits-of-tipping-your-doordash-delivery-worker-in-cash/ https://qz.com/1659475/the-merits-of-tipping-your-doordash-d...
    - Choco31415 7y ago
      DoorDash implemented that scheme to give more consistent payments to workers, as tips are quite variable. Anyway, if it helps, DoorDash is currently moving away from that model. [0] [0] https://www.theverge.com/2019/8/22/20828742/doordash-tipping-policy-change-drivers-earning-more-money https://www.theverge.com/2019/8/22/20828742/doordash-tipping...
      - paulddraper 7y ago
        > as tips are quite variable That's kind of the point. And par for the course in any tipped job. If DoorDash had actually wanted to make it consistent, they would've just removed tipping, like everyone else does that wants to do that. What they did was shady as hell, and they know it which is why they are changing it. --- * There is the common, legally mandated practice for employees where minimum wage is paid instead of tips, until base pay plus tips meets that. You could make the argument that DoorDash base pay is simply $0. But (A) base pay of $0 is never done (B) base plus tips don't typical fall below minimum wage (C) this doesn't really apply anyway since DoorDash doesn't pay wages; it pays contractor fees.
  - CocaKoala 7y ago
    There was recently a controversy over how Doordash implemented its tipping policy. Drivers get paid a wage to deliver food to you, and you would expect that if you specify a tip through the application, that tip goes to the driver and their compensation is increased by N, where N is the amount of the tip you specified. It turned out that until recently, that was not the case; drivers would get a wage to deliver food to you, and if you specified a tip through the application, then the driver would have money deducted from their wage equal to the amount of the tip up until tips made up one hundred percent of their wages, at which point tips would increase their take-home. So in effect, Doordash was using tips to subsidize worker pay as opposed to augmenting worker pay, and this was in no way communicated to customers who reasonably expected that a tip would increase the worker's compensation.
deleted 7y ago
[deleted]
cj 7y ago
I agree there should be real people (founders, c-levels, engineering managers, etc) taking responsibility for things like this. Another place to look at is the insurance companies who sell cyber liability policies to basically all (even small) tech companies. Those policies provide near full coverage for the most expensive parts of breaches like these (including a set dollar value, often $100-200k in policies I've seen, to hire a PR firm to recover from the media fallout). These policies are often surprisingly cheap (you can get very good coverage for $10k / year) Edit: A common complaint with these type of announcements is the lack of owning the mistake. Just wanted to point out that this is almost certainly a result of the company contact their insurance carrier about the incident, and the insurance carrier instructing the company how to respond to the event (in order to remain eligible for benefits under the policy). It’s not a great excuse, but there is a reason that’s slightly outside the control of management.
- nwsm 7y ago
  Really interesting. Do you know who the biggest insurers are?
  - cj 7y ago
    A couple examples: Beazley, The Hartford. There are lots. Most companies have an insurance broker who goes out to the various insurance companies and brings the quotes/options to the companies to choose from. https://foundershield.com/ https://foundershield.com/ is one example of a broker for small/medium size companies.
orblivion 7y ago
Is there something about this story that makes you think it's an issue of negligence rather than a capable intruder? We keep getting told that total security is impossible. Isn't this inevitable? Is it just that they waited too long to disclose it?
- orblivion 7y ago
  (clarifying since I've gotten one downvote as of now): Of course we should all be mad about the general state of computer security. I'm just trying to figure out if I really should be avoiding DoorDash in particular or is this just a straw breaking a camel's back?
- geocar 7y ago
  Security is a cost/benefit decision, not a binary one. More security costs more. Putting the drivers licenses and bank details of employees in the same database as the credit cards and names of customers is cheaper than putting them on separate databases. Putting them on the Internet is cheaper than having a separate network. Turning off your logs "when you don't need them" is cheaper than leaving them on all the time. If anyone says "total security is impossible" you just say: So fucking what? That's not an excuse for spending as little on security as possible, and you know someone isn't serious about security if they avoid admitting they are responsible for the security in the first place.
ChrisArchitect 7y ago
sorry, who are these people you've just graciously named??
- icebraining 7y ago
  The founders (and current CEO and CTO) of DoorDash.
  - ChrisArchitect 7y ago
    thx, I just wasn't sure exactly who it was
kexx 7y ago
I would subscribe to a blog you write about the people (with names, photos) behind every single business fuckup, especially if it is a decision made because of greed.
quotemstr 7y ago
I'm very uncomfortable with this level of personal shaming. There's a reason most serious tech companies have adopted a "blameless post-mortem" culture. When you individually vilify people for mistakes, you create a culture of fear and kill initiative and risk-taking. Maybe you think everything worthwhile has already been invented, but I don't.
rvrabec 7y ago
For frustrated folks like myself who are also lazy like myself: How to deactivate: https://help.doordash.com/consumers/s/article/How-to-deactivate-your-DoorDash-Account?language=en_US https://help.doordash.com/consumers/s/article/How-to-deactiv... Where to deactivate: https://help.doordash.com/consumers/s/contactsupport?language=en_US https://help.doordash.com/consumers/s/contactsupport?languag... *for what its worth, deactivation and deletion are mostly semantics if the point is to send a message to a company that their mismanagement erodes trust with users. "churn" is a metric that very much matters to executives and "deactivation" impacts that.

by geocar 7y ago

WilliamEdward 7y ago

Could not agree more. There's a tendency to not blame founders... but why? They created the product from the ground up. They had a choice on how to build security and chose the easy way out. They should be held to a higher standard given the power dynamics they have over the company and its users.

deleted 7y ago
[deleted]

souterrain 7y ago

The founders are very busy devising wage theft schemes. How can they possibly spend time on security or apologies?

paulddraper 7y ago
> devising wage theft schemes Expand?
- nwsm 7y ago
  Basically if you "tip" a driver through DoorDash, the tip doesn't really end up going to them. https://qz.com/1659475/the-merits-of-tipping-your-doordash-delivery-worker-in-cash/ https://qz.com/1659475/the-merits-of-tipping-your-doordash-d...
  - Choco31415 7y ago
    DoorDash implemented that scheme to give more consistent payments to workers, as tips are quite variable. Anyway, if it helps, DoorDash is currently moving away from that model. [0] [0] https://www.theverge.com/2019/8/22/20828742/doordash-tipping-policy-change-drivers-earning-more-money https://www.theverge.com/2019/8/22/20828742/doordash-tipping...
    - paulddraper 7y ago
      > as tips are quite variable That's kind of the point. And par for the course in any tipped job. If DoorDash had actually wanted to make it consistent, they would've just removed tipping, like everyone else does that wants to do that. What they did was shady as hell, and they know it which is why they are changing it. --- * There is the common, legally mandated practice for employees where minimum wage is paid instead of tips, until base pay plus tips meets that. You could make the argument that DoorDash base pay is simply $0. But (A) base pay of $0 is never done (B) base plus tips don't typical fall below minimum wage (C) this doesn't really apply anyway since DoorDash doesn't pay wages; it pays contractor fees.
- CocaKoala 7y ago
  There was recently a controversy over how Doordash implemented its tipping policy. Drivers get paid a wage to deliver food to you, and you would expect that if you specify a tip through the application, that tip goes to the driver and their compensation is increased by N, where N is the amount of the tip you specified. It turned out that until recently, that was not the case; drivers would get a wage to deliver food to you, and if you specified a tip through the application, then the driver would have money deducted from their wage equal to the amount of the tip up until tips made up one hundred percent of their wages, at which point tips would increase their take-home. So in effect, Doordash was using tips to subsidize worker pay as opposed to augmenting worker pay, and this was in no way communicated to customers who reasonably expected that a tip would increase the worker's compensation.

deleted 7y ago

[deleted]

cj 7y ago

I agree there should be real people (founders, c-levels, engineering managers, etc) taking responsibility for things like this. Another place to look at is the insurance companies who sell cyber liability policies to basically all (even small) tech companies. Those policies provide near full coverage for the most expensive parts of breaches like these (including a set dollar value, often $100-200k in policies I've seen, to hire a PR firm to recover from the media fallout). These policies are often surprisingly cheap (you can get very good coverage for $10k / year) Edit: A common complaint with these type of announcements is the lack of owning the mistake. Just wanted to point out that this is almost certainly a result of the company contact their insurance carrier about the incident, and the insurance carrier instructing the company how to respond to the event (in order to remain eligible for benefits under the policy). It’s not a great excuse, but there is a reason that’s slightly outside the control of management.

nwsm 7y ago
Really interesting. Do you know who the biggest insurers are?
- cj 7y ago
  A couple examples: Beazley, The Hartford. There are lots. Most companies have an insurance broker who goes out to the various insurance companies and brings the quotes/options to the companies to choose from. https://foundershield.com/ https://foundershield.com/ is one example of a broker for small/medium size companies.

orblivion 7y ago

Is there something about this story that makes you think it's an issue of negligence rather than a capable intruder? We keep getting told that total security is impossible. Isn't this inevitable? Is it just that they waited too long to disclose it?

orblivion 7y ago
(clarifying since I've gotten one downvote as of now): Of course we should all be mad about the general state of computer security. I'm just trying to figure out if I really should be avoiding DoorDash in particular or is this just a straw breaking a camel's back?
geocar 7y ago
Security is a cost/benefit decision, not a binary one. More security costs more. Putting the drivers licenses and bank details of employees in the same database as the credit cards and names of customers is cheaper than putting them on separate databases. Putting them on the Internet is cheaper than having a separate network. Turning off your logs "when you don't need them" is cheaper than leaving them on all the time. If anyone says "total security is impossible" you just say: So fucking what? That's not an excuse for spending as little on security as possible, and you know someone isn't serious about security if they avoid admitting they are responsible for the security in the first place.

ChrisArchitect 7y ago

sorry, who are these people you've just graciously named??

icebraining 7y ago
The founders (and current CEO and CTO) of DoorDash.
- ChrisArchitect 7y ago
  thx, I just wasn't sure exactly who it was

kexx 7y ago

I would subscribe to a blog you write about the people (with names, photos) behind every single business fuckup, especially if it is a decision made because of greed.

quotemstr 7y ago

I'm very uncomfortable with this level of personal shaming. There's a reason most serious tech companies have adopted a "blameless post-mortem" culture. When you individually vilify people for mistakes, you create a culture of fear and kill initiative and risk-taking. Maybe you think everything worthwhile has already been invented, but I don't.

rvrabec 7y ago

For frustrated folks like myself who are also lazy like myself: How to deactivate: https://help.doordash.com/consumers/s/article/How-to-deactivate-your-DoorDash-Account?language=en_US https://help.doordash.com/consumers/s/article/How-to-deactiv... Where to deactivate: https://help.doordash.com/consumers/s/contactsupport?language=en_US https://help.doordash.com/consumers/s/contactsupport?languag... *for what its worth, deactivation and deletion are mostly semantics if the point is to send a message to a company that their mismanagement erodes trust with users. "churn" is a metric that very much matters to executives and "deactivation" impacts that.