6 ms·

Keep in mind that developers hear a user needs to be notified in “the most expedient time possible” and think minutes or hours but the lawyers read that and are

Keep in mind that developers hear a user needs to be notified in “the most expedient time possible” and think minutes or hours but the lawyers read that and are thinking days or potentially even weeks in some circumstances. Just because Instacart hasn’t notified anyone yet doesn’t mean they won’t or that they’ve failed to comply with the obligation.

gruez 6y ago
it's almost as if the law was specifically written this way to sound useful, but is actually toothless
catalogia 6y ago
Perhaps these lawyers should be held underwater and let back up in "the most expedient time possible."
- 0xEFF 6y ago
  Delete this horrible comment.
  - eitland 6y ago
    I'd rather have it rewritten. There is a good idea beneath all that waiting to get out from that violent comment, but sadly GP was not able to release it. Also, for the younger ones here: this used to be totally fine Internet humor. We used to laugh at comments like GPs and none of us ever hurt a lawyer. I actually sometimes miss that time while Internet still understood and valued humor.
    - duncan_bayne 6y ago
      > We used to laugh at comments like GPs Used to? I'm still chuckling.
      - skinkestek 6y ago
        Careful with your opsec if you don't want to be fired from your nice job sometime in the future. People have been fired for less than this ;-)
        duncan_bayne 6y ago
        Eh. If someone wants to fire me for chuckling at a bad-taste lawyer joke, I'd rather not work for them anyway ;)
save_ferris 6y ago
Then the law sounds ineffective to me. There are security researchers featured in this article saying that this dump looks legit, and Instacart still gets to pretend like everything is normal? User data could wind up sitting on the dark web for weeks before Instacart finally gets around to notifying them of the breach. Tools like haveibeenpwned typically rely on companies' cooperation to report breaches since "data breach" is a legal term. But since Instacart still hasn't reported this, do the security tools get updated in a timely way, or are there millions of credit cards and passwords sitting up for sale while lawyers figure out how to handle the legal side of this?

gruez 6y ago

it's almost as if the law was specifically written this way to sound useful, but is actually toothless

catalogia 6y ago

Perhaps these lawyers should be held underwater and let back up in "the most expedient time possible."

0xEFF 6y ago
Delete this horrible comment.
- eitland 6y ago
  I'd rather have it rewritten. There is a good idea beneath all that waiting to get out from that violent comment, but sadly GP was not able to release it. Also, for the younger ones here: this used to be totally fine Internet humor. We used to laugh at comments like GPs and none of us ever hurt a lawyer. I actually sometimes miss that time while Internet still understood and valued humor.
  - duncan_bayne 6y ago
    > We used to laugh at comments like GPs Used to? I'm still chuckling.
    - skinkestek 6y ago
      Careful with your opsec if you don't want to be fired from your nice job sometime in the future. People have been fired for less than this ;-)
      - duncan_bayne 6y ago
        Eh. If someone wants to fire me for chuckling at a bad-taste lawyer joke, I'd rather not work for them anyway ;)

save_ferris 6y ago

Then the law sounds ineffective to me. There are security researchers featured in this article saying that this dump looks legit, and Instacart still gets to pretend like everything is normal? User data could wind up sitting on the dark web for weeks before Instacart finally gets around to notifying them of the breach. Tools like haveibeenpwned typically rely on companies' cooperation to report breaches since "data breach" is a legal term. But since Instacart still hasn't reported this, do the security tools get updated in a timely way, or are there millions of credit cards and passwords sitting up for sale while lawyers figure out how to handle the legal side of this?