4 ms·

Why? Using ads to increase business is completely valid. This issue is data leakage due to an implementation error and has nothing to do with using advertising

Why? Using ads to increase business is completely valid. This issue is data leakage due to an implementation error and has nothing to do with using advertising services from Facebook or other companies.

deleted 6y ago
[deleted]
Nextgrid 6y ago
There are ways to use ads without violating privacy nor breaking the law (remember that this practice is illegal under the GDPR). Either way, if you must do ad tracking, do so on your homepage. Once the user is logged in and has paid you money for a service there shouldn’t be any ads nor tracking.
- manigandham 6y ago
  > "without violating privacy" Yes, that's covered by this being a mistake in implementation as I said. > "there shouldn’t be any ads nor tracking" Again, based on what exactly? Finding new users that are similar to your existing customers is a completely valid strategy. Most people in this thread are making wild statements from the typical emotional/outrage driven pile-on when anything happens.
  - Nextgrid 6y ago
    Based on respect, common sense and the GDPR? > Finding new users that are similar to your existing customers is a completely valid strategy. But this can be achieved with tracking in the homepage without embedding trackers in the actual product right next to sensitive data? > Most people in this thread are making wild statements from the typical emotional/outrage driven pile-on when anything happens. This doesn't make these statements any less valid though? Most people are indeed outraged that a paid professional product is ratting them out to Facebook which makes total sense as nobody would've expected that.
    - manigandham 6y ago
      > "But this can be achieved ... without embedding trackers in the actual product right next to sensitive data?" Yes, it was an implementation mistake. How many times do I have to repeat that? See, this is the outrage that doesn't even read the actual comment.
  - tobr 6y ago
    > Finding new users that are similar to your existing customers is a completely valid strategy. What on earth does “valid” mean here? It’s certainly not acceptable (to me as a customer) if it involves exposing your existing customers to these risks. Those ends can not justify those means.
    - manigandham 6y ago
      Valid as in it's a common, reliable and efficient way to gain new customers. Customers weren't intentionally exposed to that risk nor was it part of a trade-off, it was an implementation mistake for many reasons, something I've repeated 3 times now. What is so complicated to understand here?
      - tobr 6y ago
        Customers were intentionally exposed to the risk, because they intentionally added this third-party code. If they’re not thinking in terms of risk management when they add third-party trackers to their site they do not have an adequate security process. There is a trade-off to security whenever you allow code like that in your product. They can’t just wave it off as a mistake, because it’s a mistake that is very telling about their priorities.
        manigandham 6y ago
        The mistake was allowing code into that specific part of the product. Under your definition, there can never be mistakes at all; which is impossible.
        tobr 6y ago
        It’s very simple: if you include un-vettable third-party code in your system, and system also handles sensitive data, you are dealing with a huge risk. You need to make sure that the code is unable to touch the sensitive data. As it turns out, it’s a lot harder than not having untrusted code and sensitive data in the same system in the first place. The direct mistake was probably that the wrong code was included on the wrong page, but if the risks involved had been taken seriously, such a small mistake would not have been able to have such a catastrophic effect.
HelloNurse 6y ago
By this reasoning, using guns to shoot people is completely valid; the issue is stray shots due to inadequate aim and has nothing to do with being a criminal engaged in a drug war. I'll resist the temptation to draw a parallel between "advertising services from Facebook or other companies" and a crime syndicate.
- manigandham 6y ago
  No, that's not the same reasoning at all. It's an irrelevant and outrageous strawman where you compared the use of advertising to "using guns ... as a criminal engaged in a drug war". Ridiculous at best and I'm not sure what temptation you resisted. If you have a real rebuttal against advertising then reply with that instead and we can discuss how technical implementations can be fraught with security mistakes and errors, regardless of industry or product.
  - HelloNurse 6y ago
    The point is that "technical implementations", such as how to shoot properly, shouldn't be discussed "regardless of industry or product", such as being a gangster: sharing PII with Facebook is something most web sites should avoid, not something they should do properly.
    - manigandham 6y ago
      > "shouldn't be discussed" Why not? Technical implementations can always be discussed separately from the context they're used in, and even your extreme example of guns has perfectly valid uses in the police and military. Yet you're making the strange comparison to being "a gangster". Why? What's the point of this convoluted analogy? > "sharing PII with Facebook is something most web sites should avoid, not something they should do properly" Again, why? You seem to claim a lot without any basis. Data has valid uses, and being used properly is foundational to providing privacy.
      - HelloNurse 6y ago

deleted 6y ago

[deleted]

Nextgrid 6y ago

There are ways to use ads without violating privacy nor breaking the law (remember that this practice is illegal under the GDPR). Either way, if you must do ad tracking, do so on your homepage. Once the user is logged in and has paid you money for a service there shouldn’t be any ads nor tracking.

manigandham 6y ago
> "without violating privacy" Yes, that's covered by this being a mistake in implementation as I said. > "there shouldn’t be any ads nor tracking" Again, based on what exactly? Finding new users that are similar to your existing customers is a completely valid strategy. Most people in this thread are making wild statements from the typical emotional/outrage driven pile-on when anything happens.
- Nextgrid 6y ago
  Based on respect, common sense and the GDPR? > Finding new users that are similar to your existing customers is a completely valid strategy. But this can be achieved with tracking in the homepage without embedding trackers in the actual product right next to sensitive data? > Most people in this thread are making wild statements from the typical emotional/outrage driven pile-on when anything happens. This doesn't make these statements any less valid though? Most people are indeed outraged that a paid professional product is ratting them out to Facebook which makes total sense as nobody would've expected that.
  - manigandham 6y ago
    > "But this can be achieved ... without embedding trackers in the actual product right next to sensitive data?" Yes, it was an implementation mistake. How many times do I have to repeat that? See, this is the outrage that doesn't even read the actual comment.
- tobr 6y ago
  > Finding new users that are similar to your existing customers is a completely valid strategy. What on earth does “valid” mean here? It’s certainly not acceptable (to me as a customer) if it involves exposing your existing customers to these risks. Those ends can not justify those means.
  - manigandham 6y ago
    Valid as in it's a common, reliable and efficient way to gain new customers. Customers weren't intentionally exposed to that risk nor was it part of a trade-off, it was an implementation mistake for many reasons, something I've repeated 3 times now. What is so complicated to understand here?
    - tobr 6y ago
      Customers were intentionally exposed to the risk, because they intentionally added this third-party code. If they’re not thinking in terms of risk management when they add third-party trackers to their site they do not have an adequate security process. There is a trade-off to security whenever you allow code like that in your product. They can’t just wave it off as a mistake, because it’s a mistake that is very telling about their priorities.
      - manigandham 6y ago
        The mistake was allowing code into that specific part of the product. Under your definition, there can never be mistakes at all; which is impossible.
        tobr 6y ago
        It’s very simple: if you include un-vettable third-party code in your system, and system also handles sensitive data, you are dealing with a huge risk. You need to make sure that the code is unable to touch the sensitive data. As it turns out, it’s a lot harder than not having untrusted code and sensitive data in the same system in the first place. The direct mistake was probably that the wrong code was included on the wrong page, but if the risks involved had been taken seriously, such a small mistake would not have been able to have such a catastrophic effect.

HelloNurse 6y ago

By this reasoning, using guns to shoot people is completely valid; the issue is stray shots due to inadequate aim and has nothing to do with being a criminal engaged in a drug war. I'll resist the temptation to draw a parallel between "advertising services from Facebook or other companies" and a crime syndicate.

manigandham 6y ago
No, that's not the same reasoning at all. It's an irrelevant and outrageous strawman where you compared the use of advertising to "using guns ... as a criminal engaged in a drug war". Ridiculous at best and I'm not sure what temptation you resisted. If you have a real rebuttal against advertising then reply with that instead and we can discuss how technical implementations can be fraught with security mistakes and errors, regardless of industry or product.
- HelloNurse 6y ago
  The point is that "technical implementations", such as how to shoot properly, shouldn't be discussed "regardless of industry or product", such as being a gangster: sharing PII with Facebook is something most web sites should avoid, not something they should do properly.
  - manigandham 6y ago
    > "shouldn't be discussed" Why not? Technical implementations can always be discussed separately from the context they're used in, and even your extreme example of guns has perfectly valid uses in the police and military. Yet you're making the strange comparison to being "a gangster". Why? What's the point of this convoluted analogy? > "sharing PII with Facebook is something most web sites should avoid, not something they should do properly" Again, why? You seem to claim a lot without any basis. Data has valid uses, and being used properly is foundational to providing privacy.
    - HelloNurse 6y ago