4 ms·

We take this stuff very seriously, and I just worked with Rob (CEO), and we implemented this solution: http://www.etsy.com/teams/7716/announcements/discuss/6818

by gfodor 16y ago

We take this stuff very seriously, and I just worked with Rob (CEO), and we implemented this solution: http://www.etsy.com/teams/7716/announcements/discuss/6818578/page/1/ http://www.etsy.com/teams/7716/announcements/discuss/6818578... Being able to react to issues like this quickly is one of the great things about the Continuous Deployment process we have set up at Etsy. You can read more about that here: http://codeascraft.etsy.com/2010/05/20/quantum-of-deployment/ http://codeascraft.etsy.com/2010/05/20/quantum-of-deployment...

jswinghammer 16y ago
That first link took me to an error page.
- gfodor 16y ago
  Hmm, URL shortening breaking it? It works for me. Trying again: http://www.etsy.com/teams/7716/announcements/discuss/6818578/page/1/ http://www.etsy.com/teams/7716/announcements/discuss/6818578...
  - jswinghammer 16y ago
    I was using the iPhone hacker news reader and it was broken there. Thanks.
bigiain 16y ago
Nice to see a timely response, and that it's closed the privacy leakage at least for now. The statement linked there doesn't reassure me that Etsy might not "do a Facebook" and back down on privacy complaints for now, only to re-introduce them later on. Would anybody from Etsy like to state for the record that they understand that they made a serious mistake, and assure current and future users of their site that they _do_ respect our privacy and guarantee not to "leak" information like this, at least not without a very well explained opt-in mechanism in place first?
- code_duck 16y ago
  That's what Etsy has done on past controversial/unpopular changes. They back off or modify it, only to trot it back out, sometimes bit by bit, later on when people aren't paying attention. That is, if they listen to their customers at all. Other times they just say 'we think this will be beneficial to sellers' and ignore their customers' opinions.
azernik 16y ago
Odd - this comment was posted 5 hours ago, and 15 minutes ago I went to my Etsy account and still saw, as my account's default privacy setting: Purchases Who can see your purchases? [x] Everyone (public) [ ]Only you (private, between you and the shop owner) I then decided to opt out - a decision I only knew I had to make after reading the Ars article.
- gfodor 16y ago
  We've just pushed a change to remove the source of confusion. That option is no longer relevant as we no longer show purchase information in feedback to 3rd parties, so we've replaced the option with a message indicating that your purchases are private on Etsy.
bugmenot 16y ago
You say that, but your site still provides an easy way of associating people's real names with their usernames -- something highly useful for social engineering.
mukyu 16y ago
It sounds more like your continuous deployment resulted in deploying a change without considering the ramifications of it. Can you really consider that a 'win'?
- gfodor 16y ago
  The issue here was stemmed from the fact that seller feedback for buyers made it so the items you buy became linked to your profile through your feedback page. In other words, even if you left no public feedback, a seller could still do something that associated that item with your account on your public profile. This, combined with the fact that folks now optionally have their real names linked to their Etsy account, made it so that a persons real name (if they chose to make it available) could be linked to a particular item through the seller feedback mechanism through no action of their own. This combined with the fact that buyer feedback is less relevant to Etsy now than it was years ago made us decide it was time to remove the buyer feedback from public view. The seller feedback mechanism we changed last night was something that had been in place since the beginning of Etsy. So, this particular issue we addressed was not a bugfix or a reversion of a previous change.
primigenus 16y ago
Don't you think it's kind of inappropriate to respond to a serious accusation with a marketing statement about the technical architecture of your site? I mean, sure, before reading this I thought Etsy was cool because of the continuous deployment thing, but now I think two things: 1. perhaps continuous deployment leads to launching features without thinking about their consequences for long enough; 2. Etsy's team is more interested in thumping its chest about continuous deployment than owning up to a serious mistake.
- gfodor 16y ago
  Perhaps you're right. My comment was primarily intended to link to the explanation of the change we made to address some of the concerns people had. Plugging CI was probably not necessary, though this is hacker news and so I thought it was relevant to the discussion.
kmfrk 16y ago
Do I have this right? * Seller feedback hidden * Buyer feedback hidden (or at least anonymized) * Purchase history can be hidden by opting out
- gfodor 16y ago
  Feedback from a seller -> buyer is now hidden from public view. Feedback from a buyer -> seller is marked as public or private by the person giving the feedback. The public or private purchase option is opt-out and right now determines if the items you purchase are seen on your public feedback.
  - kmfrk 16y ago
    Thanks for clarifying.

by gfodor 16y ago

jswinghammer 16y ago

That first link took me to an error page.

gfodor 16y ago
Hmm, URL shortening breaking it? It works for me. Trying again: http://www.etsy.com/teams/7716/announcements/discuss/6818578/page/1/ http://www.etsy.com/teams/7716/announcements/discuss/6818578...
- jswinghammer 16y ago
  I was using the iPhone hacker news reader and it was broken there. Thanks.

bigiain 16y ago

Nice to see a timely response, and that it's closed the privacy leakage at least for now. The statement linked there doesn't reassure me that Etsy might not "do a Facebook" and back down on privacy complaints for now, only to re-introduce them later on. Would anybody from Etsy like to state for the record that they understand that they made a serious mistake, and assure current and future users of their site that they _do_ respect our privacy and guarantee not to "leak" information like this, at least not without a very well explained opt-in mechanism in place first?

code_duck 16y ago
That's what Etsy has done on past controversial/unpopular changes. They back off or modify it, only to trot it back out, sometimes bit by bit, later on when people aren't paying attention. That is, if they listen to their customers at all. Other times they just say 'we think this will be beneficial to sellers' and ignore their customers' opinions.

azernik 16y ago

Odd - this comment was posted 5 hours ago, and 15 minutes ago I went to my Etsy account and still saw, as my account's default privacy setting: Purchases Who can see your purchases? [x] Everyone (public) [ ]Only you (private, between you and the shop owner) I then decided to opt out - a decision I only knew I had to make after reading the Ars article.

gfodor 16y ago
We've just pushed a change to remove the source of confusion. That option is no longer relevant as we no longer show purchase information in feedback to 3rd parties, so we've replaced the option with a message indicating that your purchases are private on Etsy.

bugmenot 16y ago

You say that, but your site still provides an easy way of associating people's real names with their usernames -- something highly useful for social engineering.

mukyu 16y ago

It sounds more like your continuous deployment resulted in deploying a change without considering the ramifications of it. Can you really consider that a 'win'?

gfodor 16y ago
The issue here was stemmed from the fact that seller feedback for buyers made it so the items you buy became linked to your profile through your feedback page. In other words, even if you left no public feedback, a seller could still do something that associated that item with your account on your public profile. This, combined with the fact that folks now optionally have their real names linked to their Etsy account, made it so that a persons real name (if they chose to make it available) could be linked to a particular item through the seller feedback mechanism through no action of their own. This combined with the fact that buyer feedback is less relevant to Etsy now than it was years ago made us decide it was time to remove the buyer feedback from public view. The seller feedback mechanism we changed last night was something that had been in place since the beginning of Etsy. So, this particular issue we addressed was not a bugfix or a reversion of a previous change.

primigenus 16y ago

Don't you think it's kind of inappropriate to respond to a serious accusation with a marketing statement about the technical architecture of your site? I mean, sure, before reading this I thought Etsy was cool because of the continuous deployment thing, but now I think two things: 1. perhaps continuous deployment leads to launching features without thinking about their consequences for long enough; 2. Etsy's team is more interested in thumping its chest about continuous deployment than owning up to a serious mistake.

gfodor 16y ago
Perhaps you're right. My comment was primarily intended to link to the explanation of the change we made to address some of the concerns people had. Plugging CI was probably not necessary, though this is hacker news and so I thought it was relevant to the discussion.

kmfrk 16y ago

Do I have this right? * Seller feedback hidden * Buyer feedback hidden (or at least anonymized) * Purchase history can be hidden by opting out

gfodor 16y ago
Feedback from a seller -> buyer is now hidden from public view. Feedback from a buyer -> seller is marked as public or private by the person giving the feedback. The public or private purchase option is opt-out and right now determines if the items you purchase are seen on your public feedback.
- kmfrk 16y ago
  Thanks for clarifying.