4 ms·

Yeah. I don't care if some big business loses their Elasticsearch data and their site stops working until they get it secured and re-hydrated with data from the

Yeah. I don't care if some big business loses their Elasticsearch data and their site stops working until they get it secured and re-hydrated with data from their relational database. Good, they learned a lesson. But I would feel bad if someone's small business had to shut down or lose a bunch of money because they lost all their customer data. I'd feel bad if someone lost all the data they'd been using for a personal project. If they didn't have backups and proper security, shame on them, but ideally they would be contacted and given advice. Ideally, their data would only be deleted if the effect would be minimal. On the other hand, if this is something that happens consistently -- all unsecured databases get deleted immediately -- maybe the data would be stolen less and everyone would have to learn their lesson early...

acdha 6y ago
I’d feel bad if someone’s hobby project was deleted. Small businesses losing customer data is only slightly more sympathetic than people getting sick because they didn’t think the health code applied to them. If you collect it, you need to be responsible for keeping it safe. Anything affected by this is already exposed and has to be assumed to have been breached.
- Wowfunhappy 6y ago
  What if it was a small business's inventory data rather than customer data? Seems to me, there are a lot of things businesses could store in a database which don't necessarily need to be private, or which at worst won't harm anyone other than the database creator if exposed.
  - acdha 6y ago
    That’s why I was specific about customer data: it’s basically a question of who’s harmed - if the cost is borne by the person cutting corners it’s more of a self-correcting problem.
    - atyppo 6y ago
      It's not a matter of "cutting corners." Think of all of the small businesses that recently moved online due to store closures. These businesses simply do not have the budget required to create something comparable to, say, Best Buy's e-commerce. Sure, Shopify might come close, but how do you think Mom and Pop will find and create an e-commerce solution?
      - acdha 6y ago
        That’s the very definition of cutting corners. If they aren’t confident of their ability to operate safely they need to either hire a professional or go without - just as not wanting to pay a plumber doesn’t exempt you from meeting the health code or saving on accountants will be a get out of jail free card when you get audited. If it sounds like I’m unsympathetic, yes, that’s true. Playing around with building your own database is a good learning experience but that changes once you expose other people to your mistakes. I’ve also dealt with a few small businesses and the people trying to run a business like this are always trying to save a buck - they’re the same ones who stiff contractors, avoid paying overtime, do their own taxes creatively, etc. If you have a successful business, you’ll drop a few bucks on Shopify, Wix, etc. to focus on the business rather than a distraction.
        atyppo 6y ago
        Think how easy it is to take advantage of grandma for "tech support," whether it be from India or at a seedy computer repair shop. It wouldn't surprise me to hear that the majority of small business owners have never heard of Shopify or Wix, as they are more likely to turn to someone they trust, whether that be a "tech-literate" cousin or a local service. Keep in mind that many of these businesses didn't even have websites a few months ago, let alone e-commerce solutions. Not everyone lives in SV or NYC and is perennially exposed to their ads. I agree that these businesses shouldn't be doing this by themselves, but the tech industry shares some culpability. It should be ingrained in people's heads to think of security first. Most people outside the SV bubble are still using [SO or pet's name]123 as their password. I go to a university in NYC. I've tried to convince several (college) friends to use password managers to no avail. This isn't just a problem endemic in old people. Someone needs to "mainstream" good security. A good start would come from, say, Apple, by including security keys with new iPhones, as much of a pipe dream as that might be.
paulie_a 6y ago
Personally I hope this becomes so common place that it doesnt even make the news. Like the old days with slammer or codered It took 13 seconds for a freshly installed windows box to be owned when it was put online. Let those days return.
donmcronald 6y ago
> But I would feel bad if someone's small business had to shut down or lose a bunch of money because they lost all their customer data. Don't. When businesses of any size cut corners and provide services they aren't qualified to provide, it gives them an advantage compared to businesses that try to do it properly. They make more money or charge less and can often out compete competent owners. They'll also be the first ones to brag about how brilliant they are at business (in my experience). Small businesses are no exception. Delete away IMO.
- hombre_fatal 6y ago
  Seems like a lost opportunity to have a more nuanced position here. And when you can't think of a single case that could make you feel bad for someone, it's usually a sign that you don't have one.
- 52-6F-62 6y ago
  Said small businesses might have no idea their data wasn’t secure. That would be on whoever developed their technology, not necessarily the business. Not all small businesses with customer or sales data is a technology company.
  - donmcronald 6y ago
    Good point. You're right. I was really only thinking about tech companies that are doing their own deployments, but I guess there's plenty of room for collateral damage where people don't deserve it.
colonwqbang 6y ago
> Yeah, I don't care if a big chain restaurant is closed down for having too poor hygiene. But I would feel bad if someone's small restaurant had to shut down because the cook doesn't bother to wash his hands at work. If you are holding other people's data for them, you have a responsibility to do your best to keep the data safe. If you don't know how to do that and don't have time to learn, you can hire someone who is more knowledgeable.
- gwright 6y ago
  And what about the responsibility to not destroy someone's property? Do you have the same opinion about shoplifters walking away with merchandise? Would your argument be that there should be armed guards and searches in every retail store? Isn't it reasonable that a thief be criticized and penalized for their actions even if the theft was "easy" to commit and is it OK to blame the victim for not being prepared?
  - nkrisc 6y ago
    But it's my personal and sensitive data that they are poor stewards of, not their property.
    - gwright 6y ago
      I agree but I don't think that changes my point that the person who destroys the data has more culpability than the storage service in the destruction of the data. There tends to be a pass given to people destroying data and I don't think that is right.
      - colonwqbang 6y ago
        I agree, but I think it's beside the point. As engineers we have to assume that there is always someone out there looking to break into our systems. We don't get to blame them for our failure to secure our systems. For us to be angry at the hackers is as fruitless as it would be for the unhygienic cook to be angry at the bacteria.
aledalgrande 6y ago
I'm not sure wiping out data from these unsecured databases is the answer, but even for amateur installations which have data of no relevance, the database could be used for nefarious things or the machine itself it runs on could be taken over and used for things such as DDOS attacks. In that sense, receiving a strong notification that your compute is available to anyone and you should secure it is a good thing.

acdha 6y ago

I’d feel bad if someone’s hobby project was deleted. Small businesses losing customer data is only slightly more sympathetic than people getting sick because they didn’t think the health code applied to them. If you collect it, you need to be responsible for keeping it safe. Anything affected by this is already exposed and has to be assumed to have been breached.

Wowfunhappy 6y ago
What if it was a small business's inventory data rather than customer data? Seems to me, there are a lot of things businesses could store in a database which don't necessarily need to be private, or which at worst won't harm anyone other than the database creator if exposed.
- acdha 6y ago
  That’s why I was specific about customer data: it’s basically a question of who’s harmed - if the cost is borne by the person cutting corners it’s more of a self-correcting problem.
  - atyppo 6y ago
    It's not a matter of "cutting corners." Think of all of the small businesses that recently moved online due to store closures. These businesses simply do not have the budget required to create something comparable to, say, Best Buy's e-commerce. Sure, Shopify might come close, but how do you think Mom and Pop will find and create an e-commerce solution?
    - acdha 6y ago
      That’s the very definition of cutting corners. If they aren’t confident of their ability to operate safely they need to either hire a professional or go without - just as not wanting to pay a plumber doesn’t exempt you from meeting the health code or saving on accountants will be a get out of jail free card when you get audited. If it sounds like I’m unsympathetic, yes, that’s true. Playing around with building your own database is a good learning experience but that changes once you expose other people to your mistakes. I’ve also dealt with a few small businesses and the people trying to run a business like this are always trying to save a buck - they’re the same ones who stiff contractors, avoid paying overtime, do their own taxes creatively, etc. If you have a successful business, you’ll drop a few bucks on Shopify, Wix, etc. to focus on the business rather than a distraction.
      - atyppo 6y ago
        Think how easy it is to take advantage of grandma for "tech support," whether it be from India or at a seedy computer repair shop. It wouldn't surprise me to hear that the majority of small business owners have never heard of Shopify or Wix, as they are more likely to turn to someone they trust, whether that be a "tech-literate" cousin or a local service. Keep in mind that many of these businesses didn't even have websites a few months ago, let alone e-commerce solutions. Not everyone lives in SV or NYC and is perennially exposed to their ads. I agree that these businesses shouldn't be doing this by themselves, but the tech industry shares some culpability. It should be ingrained in people's heads to think of security first. Most people outside the SV bubble are still using [SO or pet's name]123 as their password. I go to a university in NYC. I've tried to convince several (college) friends to use password managers to no avail. This isn't just a problem endemic in old people. Someone needs to "mainstream" good security. A good start would come from, say, Apple, by including security keys with new iPhones, as much of a pipe dream as that might be.

paulie_a 6y ago

Personally I hope this becomes so common place that it doesnt even make the news. Like the old days with slammer or codered It took 13 seconds for a freshly installed windows box to be owned when it was put online. Let those days return.

donmcronald 6y ago

> But I would feel bad if someone's small business had to shut down or lose a bunch of money because they lost all their customer data. Don't. When businesses of any size cut corners and provide services they aren't qualified to provide, it gives them an advantage compared to businesses that try to do it properly. They make more money or charge less and can often out compete competent owners. They'll also be the first ones to brag about how brilliant they are at business (in my experience). Small businesses are no exception. Delete away IMO.

hombre_fatal 6y ago
Seems like a lost opportunity to have a more nuanced position here. And when you can't think of a single case that could make you feel bad for someone, it's usually a sign that you don't have one.
52-6F-62 6y ago
Said small businesses might have no idea their data wasn’t secure. That would be on whoever developed their technology, not necessarily the business. Not all small businesses with customer or sales data is a technology company.
- donmcronald 6y ago
  Good point. You're right. I was really only thinking about tech companies that are doing their own deployments, but I guess there's plenty of room for collateral damage where people don't deserve it.

colonwqbang 6y ago

> Yeah, I don't care if a big chain restaurant is closed down for having too poor hygiene. But I would feel bad if someone's small restaurant had to shut down because the cook doesn't bother to wash his hands at work. If you are holding other people's data for them, you have a responsibility to do your best to keep the data safe. If you don't know how to do that and don't have time to learn, you can hire someone who is more knowledgeable.

gwright 6y ago
And what about the responsibility to not destroy someone's property? Do you have the same opinion about shoplifters walking away with merchandise? Would your argument be that there should be armed guards and searches in every retail store? Isn't it reasonable that a thief be criticized and penalized for their actions even if the theft was "easy" to commit and is it OK to blame the victim for not being prepared?
- nkrisc 6y ago
  But it's my personal and sensitive data that they are poor stewards of, not their property.
  - gwright 6y ago
    I agree but I don't think that changes my point that the person who destroys the data has more culpability than the storage service in the destruction of the data. There tends to be a pass given to people destroying data and I don't think that is right.
    - colonwqbang 6y ago
      I agree, but I think it's beside the point. As engineers we have to assume that there is always someone out there looking to break into our systems. We don't get to blame them for our failure to secure our systems. For us to be angry at the hackers is as fruitless as it would be for the unhygienic cook to be angry at the bacteria.

aledalgrande 6y ago

I'm not sure wiping out data from these unsecured databases is the answer, but even for amateur installations which have data of no relevance, the database could be used for nefarious things or the machine itself it runs on could be taken over and used for things such as DDOS attacks. In that sense, receiving a strong notification that your compute is available to anyone and you should secure it is a good thing.