10 ms·

Backblaze Privacy Update: Third-Party Tracking

129 points by dexterdog 6y ago

bdibs 6y ago
> We take the privacy of our customers’ data and personal information very seriously I wish companies would actually mean this and apply it proactively instead of just copy and pasting this in their apology after something like this happens.
- politelemon 6y ago
  Many companies do apply this proactively. It's just that you pay no notice to the 'lack' of incidents.
  - bdibs 6y ago
    I didn’t mean to imply that no companies actually care about privacy and security, I meant companies affected by a public incident like this.
- happymellon 6y ago
  > We take the privacy of our customers’ data and personal information very seriously > a new Facebook campaign was created that started firing a Facebook advertising pixel I think they actually don't give any figment of a shit of their customers data if they are adding to the Facebook hoover of personal information.
- jjbinx007 6y ago
  > We take the privacy of our customers’ data and personal information very seriously Yet the first thing I'm greeted with is a cookie consent dialog with "allow all cookies" being the only prominent button. If I don't want to allow the privacy-invading tracking cookies I need to click a less prominent piece of text called "manage cookies" and avoid clicking on another prominent button called "accept all cookies". They do not give a shit about my privacy.
- harry8 6y ago
  Exposes a law: "Any company announcing that they take their users privacy seriously does not in any way." So a name "Facebook law of privacy" ?
AnonC 6y ago
Firstly, this post does not even mention or describe what kind of information was exposed and makes it seem like some inadvertent tracking that's not serious in any way. You can continue with your root cause analysis, but you already know very well about what kind of information was exposed and shared with Facebook. The least you could do is own it and alert people about it. > We take the privacy of our customers’ data and personal information very seriously... It's astonishing that there is no apology of any kind on this post. Is that too much to ask for such a grievous violation? > On March 8, 2021 at 8:39pm Pacific time, a new Facebook campaign was created that started firing a Facebook advertising pixel, intended to only run on marketing web pages. However, it was inadvertently configured to run on signed-in pages. It went unnoticed for two weeks, with Facebook gathering information about the customers' files! And yet, no apology!
- selckin 6y ago
  on tv at least, they say that apology is the same as admitting guilt, so they might not want to do that for legal reason anyone know if that applies to the real world?
  - tpxl 6y ago
    Could it be any more admitting guilt than >a new Facebook campaign was created that started firing a Facebook advertising pixel, intended to only run on marketing web pages. However, it was inadvertently configured to run on signed-in pages. "We take privacy very seriously" is a sign that they don't take your privacy seriously at all.
    - zepto 6y ago
      inadvertently is the operative word here - I.e. their position is that this was just an accident.
- ClearAndPresent 6y ago
  There will never be an apology. A corporate apology is an admission of guilt. An admission of guilt opens it up to lawsuits. Through its litigeous nature, the US has evolved a culture whereby apologies and human decency are antithetical to survival.
guywhocodes 6y ago
Wow, please try again. Why would I trust you this wont happen again?
neolog 6y ago
I wonder if a class action is coming.
disgu 6y ago
They literally sent file names and file sizes over to Facebook. That might very well include very personal or confidential data. The fact that they don't even mention this and make it sound like some random unimportant tracking happened without them noticing is completely ridiculous.
- emayljames 6y ago
  Yeah, like file names of say PDF's, files with unique identifiers that give insight to the users personal life, worse still profile names of PC backups etc. etc.
- nodamage 6y ago
  The part I don't understand is how exactly does a tracking pixel end up collecting filename information?
  - dexterdog 6y ago
    Because it's a script that examines the DOM and ships the information from the page to facebook for analysys.
    - vineyardmike 6y ago
      How do we know it did this? They didn't say so
      - X-Cubed 6y ago
        Here's the screenshot: https://twitter.com/Benjojo12/status/1373707799054712836 https://twitter.com/Benjojo12/status/1373707799054712836
        vineyardmike 6y ago
        Thanks! Was missing this in the context.
progval 6y ago
More details on the issue: https://twitter.com/Benjojo12/status/1373707799054712836 https://twitter.com/Benjojo12/status/1373707799054712836 HN discussion: https://news.ycombinator.com/item?id=26536019 https://news.ycombinator.com/item?id=26536019
mike_d 6y ago
Backblaze is missing the part where you conduct an investigation, request assistance from Facebook, and determine what data was leaked to third parties.
donmcronald 6y ago
> Our Engineering, Security, and Compliance/Privacy teams—as well as other staff—are continuing to investigate the cause and working on steps to help ensure this doesn’t happen again. Silo the sales and marketing department away from the real products like the person in that other thread was saying. Sales people can't be trusted with private data.
preommr 6y ago
Security in services is all about liability and risk rather than an absolute guarantee. I've seen so much anger over this issue that it's left me confused. Questions like how they can ever be trusted now. They could never be trusted. If the information is really that important, then it should be encrypted before being passed to any other service. Companies will screw up, the question is how are you going to be on the hook for it. The great thing about services is that you can pass the blame the service than if you had dealt with it in-house. That said, this has been an embarrassing display for Backblaze and I hope they redouble their efforts on infosecurity. But mistakes happen. If there's a pattern, then that's a different story.
- nerdponx 6y ago
  Their reaction so far does not appear to be anything but attempting damage control on social media. Maybe a pattern is forming before our eyes.
dlkmp 6y ago
Even the title suggests that it's just a heads up on some minor functionality. Not really what I would expect from a company that puts "Trusted Storage Cloud" in their <h1> and encountered an incident that completely eradicates that trust.
dgellow 6y ago
If you're in the EU and a backblaze user and consider that some PII may have been leaked to 3rd parties, you can contact your local GDPR watchdog (aka national "Data Protection Authority", or DPA). See: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/redress/what-should-i-do-if-i-think-my-personal-data-protection-rights-havent-been-respected_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...
its-summertime 6y ago
Anyone got any alternatives?
- nerdponx 6y ago
  I started looking into it, but I'm concerned there won't be a 1:1 equivalent.
- deleted 6y ago
  [deleted]
- whitepoplar 6y ago
  Wasabi, maybe?
- woliveirajr 6y ago
  Many of them in the previous post about this subject. After reading / comparing prices, for my needs I ended up with: - OVH Cloud Archive: 0.0023/GB for cold storage + incoming/outgoing prices. https://www.ovhcloud.com/en/public-cloud/prices/#storage https://www.ovhcloud.com/en/public-cloud/prices/#storage - iDrive: $ 69.50/5TB/year https://www.idrive.com/pricing https://www.idrive.com/pricing - Wasabi: $5.99 / 1TB/month: https://wasabi.com/cloud-storage-pricing/#cost-calc https://wasabi.com/cloud-storage-pricing/#cost-calc
- kiwijamo 6y ago
  I've started using rsync.net with the borg client (replacing b2 and rclone) and loving it so far. I'm also surprisingly finding borg/rsync.net is suiting my usecase (personal backups) better than b2 did which is a nice bonus. I am paying more but can't complain as the value I'm getting is still good.
freebuju 6y ago
Yeah. Backblaze are addressing this "blunder" only because they got caught. Not because they give 2 shits about their customer's privacy. The smug tone in this joke of a response to the issue proves this.
- bellyfullofbac 6y ago
  Man, your distrust seems toxic to me. The simplest explanation is they goofed as they admitted, if they were malicious, they'd upload those file names from their server straight to FB's, not through your god damned browser. And of course they only addressed it after they "got caught", they didn't know about their fuck up before that, if you want to sneer at them, sneer at them for not being careful enough to let this happen, not what you wrote. I'm not trying to defend them, more like I want to protest against ungrounded casual insulting bashes like yours that seems way too freaking common nowadays. I do think they care about customer privacy, because it affects their income. (Admiteddly they were too casual about it, they were still partnering with Facebook...).
  - mPReDiToR 6y ago
    I agree with you in principle. That said, this way of doing things gives so much plausible deniability that it must at least occur to people. We've been burned on so many fronts by so many companies that it really is a learned behaviour to toxically distrust when things like this happen. It starts with politics. They're never held accountable for lying, evwn brazenly.
- sdfhbdf 6y ago
  never attribute to malice that which is adequately explained by stupidity
q3k 6y ago
> We take the privacy of our customers’ data and personal information very seriously [...] And yet, your blog/landing site wants me to opt into sharing my 'personal data' with 20 different 'advertisement partners'. Come on.
- LunaSea 6y ago
  I would say that opt in is pretty Ok in terms of privacy of customers protection.
  - proactivesvcs 6y ago
    One does not protect one's customer privacy by asking if it can be violated, often using dark patterns.
    - LunaSea 6y ago
      Well that's exactly how you do it. By definition. Asking for consent means that you don't violate their privacy since they agreed to the data being collected and shared. Using dark patterns is of course not Ok but also a different topic.
kinard 6y ago
I wish I hadn't put my PII into the filenames of the files I was backing up. myname_myaddress.txt 4445-3333-2222-1213-0121-354.my.credit.number NW53342211A.my.national.insurance.number facebook_password_is_letmein.txt filename_are_now_storage.exe I_vote_for_trump.doc Now this is public I bet there's hundreds of facebook team members sifting through all of that log data to find this PII and manually transcribe it into my facebook account.
- sandrone 6y ago
  You are totally right what info could leak a files named: ClinicWhereTheyReattachYourJunkWhenItFallsOff_procedureOverview.txt, ClinicWhereTheyReattachYourJunkWhenItFallsOff_invoice.pdf and ClinicWhereTheyReattachYourJunkWhenItFallsOff_WhatWentWrongWithYourJunkBeGratefulYouHadTheChanceToSayGoodbye.rtf .. It's the old debate on the fact that filenames might be kinda sensitive.
- petee 6y ago
  In certain countries just possessing a file or app of a certain title could get you killed... edit: On further thought, would this have triggered China's firewall?
  - dexterdog 6y ago
    In this country I can think of a couple: RepublicanVoterRegistration.png DemocratVoter Registration.png
anotherhue 6y ago
"Facebook has confirmed that all data inadvertently sent has been deleted" "We have added protections to prevent this error occurring again" Those sentences do - not - appear.
petee 6y ago
So they posted a blog before informing their customers directly? They had time to write, post and update, and I am still not seeing any emails about it
heipei 6y ago
I've been a happy Backblaze B2 user for the past few months, but this and another recent event leaves me feeling like I'll have to abandon their service (or at least mirror everything to S3 just-in-case) soon. Recent event being when GoDaddy suspended their user-facing B2 domain a month ago because of abuse requests that were apparently not handled correctly. That and the fact that they still don't have a user-facing status dashboard to communicate the status of their systems has me worried.
- atYevP 6y ago
  Yev from Backblaze here -> thanks for being a Backblaze customer. We've finished our root cause analysis and have updated that blog post with additional information. We also have moved domain registrars to make sure that behavior doesn't happen again. Sincere apologies for the issues you've experienced.
egeozcan 6y ago
There are known mechanisms to prevent leaks/exploits of this sort by sending some additional headers[0], on most of the modern browsers. Apart from that, the cookies should be strict for such a service. I logged in to my friends account to find neither implemented. They better act quick about "ensuring it doesn't happen" or I will distrust them completely. [0]: Content-Security-Policy (setting at least connect-src) and X-XSS-Protection to start with. More here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...
- emayljames 6y ago
  Wow! is crazy they don't have that implemented.
emayljames 6y ago
Why you would not just use a cloud provider for this, I just don't get it.
- kenmacd 6y ago
  What do you mean?
  - emayljames 6y ago
    s3, Google equivalent storage. Less cost for just about the same effort.
    - berbec 6y ago
      b2 is backblaze's S3 and it is cheaper than either S3 or Google Cloud storage
      - insomniacity 6y ago
        And maybe now we know why!
choward 6y ago
Gross. Why are they involving Google and Facebook? Those are the two main companies I'm trying to get away from and Backblaze is part of my setup.
zomg 6y ago
oof, this blog post is even more cringy than their repeated replies on twitter "...we’ve looked into and verified the issue and have pushed out a fix. We will continue to investigate and will provide updates as we have them." this is a perfect example of how NOT to handle a PR nightmare.
pdimitar 6y ago
Oh well, that's it then. I guess I'll only use Backblaze through `rclone` and utilize client-side end-to-end encryption. And I might still not use Backblaze. A very disappointing article.
newscracker 6y ago
Looking at this submission, comments and its ranking here, I’m sure that nobody from Backblaze will comment here or on HN for some more time. This blog post makes it seem like an internal gag order has been imposed. Some hand wavy updates are what we should expect I suppose. The post title is also dishonest in saying third party tracking and not adding details — this is Backblaze that intentionally and explicitly shared sensitive data with third party tracking. It’s not as if some third party tracked Backblaze’s paying users surreptitiously. This response is actually helpful for the competition as far as the HN audience is concerned. Edit: I’m really curious on the extent of coverage of this issue. I searched online and found only mjtsai.com and theregister.com covering this sensitive information leak. Are there any other major tech sites that have covered it so far?
atYevP 6y ago
Yev from Backblaze here - We've updated the blog post with additional information after completed our root causes analysis. You can read the updates: https://www.backblaze.com/blog/privacy-update-third-party-tracking/ https://www.backblaze.com/blog/privacy-update-third-party-tr....
alkonaut 6y ago
I expect zero http requests to any Facebook servers when I visit anycorp dot com and that’s regardless of whether I’m a paying customer or logged in user. If any actual data is transferred that’s even worse, but already having a connection to Facebook via a tracking pixel for “audience building” or similar is over the line already.
miked85 6y ago
This really isn't an acceptable response. I cancelled my account and moved back to AWS S3. Unfortunate.

129 points by dexterdog 6y ago

> We take the privacy of our customers’ data and personal information very seriously I wish companies would actually mean this and apply it proactively instead of just copy and pasting this in their apology after something like this happens.

politelemon 6y ago
Many companies do apply this proactively. It's just that you pay no notice to the 'lack' of incidents.
- bdibs 6y ago
  I didn’t mean to imply that no companies actually care about privacy and security, I meant companies affected by a public incident like this.
happymellon 6y ago
> We take the privacy of our customers’ data and personal information very seriously > a new Facebook campaign was created that started firing a Facebook advertising pixel I think they actually don't give any figment of a shit of their customers data if they are adding to the Facebook hoover of personal information.
jjbinx007 6y ago
> We take the privacy of our customers’ data and personal information very seriously Yet the first thing I'm greeted with is a cookie consent dialog with "allow all cookies" being the only prominent button. If I don't want to allow the privacy-invading tracking cookies I need to click a less prominent piece of text called "manage cookies" and avoid clicking on another prominent button called "accept all cookies". They do not give a shit about my privacy.
harry8 6y ago
Exposes a law: "Any company announcing that they take their users privacy seriously does not in any way." So a name "Facebook law of privacy" ?

AnonC 6y ago

Firstly, this post does not even mention or describe what kind of information was exposed and makes it seem like some inadvertent tracking that's not serious in any way. You can continue with your root cause analysis, but you already know very well about what kind of information was exposed and shared with Facebook. The least you could do is own it and alert people about it. > We take the privacy of our customers’ data and personal information very seriously... It's astonishing that there is no apology of any kind on this post. Is that too much to ask for such a grievous violation? > On March 8, 2021 at 8:39pm Pacific time, a new Facebook campaign was created that started firing a Facebook advertising pixel, intended to only run on marketing web pages. However, it was inadvertently configured to run on signed-in pages. It went unnoticed for two weeks, with Facebook gathering information about the customers' files! And yet, no apology!

selckin 6y ago
on tv at least, they say that apology is the same as admitting guilt, so they might not want to do that for legal reason anyone know if that applies to the real world?
- tpxl 6y ago
  Could it be any more admitting guilt than >a new Facebook campaign was created that started firing a Facebook advertising pixel, intended to only run on marketing web pages. However, it was inadvertently configured to run on signed-in pages. "We take privacy very seriously" is a sign that they don't take your privacy seriously at all.
  - zepto 6y ago
    inadvertently is the operative word here - I.e. their position is that this was just an accident.
ClearAndPresent 6y ago
There will never be an apology. A corporate apology is an admission of guilt. An admission of guilt opens it up to lawsuits. Through its litigeous nature, the US has evolved a culture whereby apologies and human decency are antithetical to survival.

guywhocodes 6y ago

Wow, please try again. Why would I trust you this wont happen again?

neolog 6y ago

I wonder if a class action is coming.

disgu 6y ago

They literally sent file names and file sizes over to Facebook. That might very well include very personal or confidential data. The fact that they don't even mention this and make it sound like some random unimportant tracking happened without them noticing is completely ridiculous.

emayljames 6y ago
Yeah, like file names of say PDF's, files with unique identifiers that give insight to the users personal life, worse still profile names of PC backups etc. etc.
nodamage 6y ago
The part I don't understand is how exactly does a tracking pixel end up collecting filename information?
- dexterdog 6y ago
  Because it's a script that examines the DOM and ships the information from the page to facebook for analysys.
  - vineyardmike 6y ago
    How do we know it did this? They didn't say so
    - X-Cubed 6y ago
      Here's the screenshot: https://twitter.com/Benjojo12/status/1373707799054712836 https://twitter.com/Benjojo12/status/1373707799054712836
      - vineyardmike 6y ago
        Thanks! Was missing this in the context.

progval 6y ago

More details on the issue: https://twitter.com/Benjojo12/status/1373707799054712836 https://twitter.com/Benjojo12/status/1373707799054712836 HN discussion: https://news.ycombinator.com/item?id=26536019 https://news.ycombinator.com/item?id=26536019

mike_d 6y ago

Backblaze is missing the part where you conduct an investigation, request assistance from Facebook, and determine what data was leaked to third parties.

donmcronald 6y ago

> Our Engineering, Security, and Compliance/Privacy teams—as well as other staff—are continuing to investigate the cause and working on steps to help ensure this doesn’t happen again. Silo the sales and marketing department away from the real products like the person in that other thread was saying. Sales people can't be trusted with private data.

preommr 6y ago

Security in services is all about liability and risk rather than an absolute guarantee. I've seen so much anger over this issue that it's left me confused. Questions like how they can ever be trusted now. They could never be trusted. If the information is really that important, then it should be encrypted before being passed to any other service. Companies will screw up, the question is how are you going to be on the hook for it. The great thing about services is that you can pass the blame the service than if you had dealt with it in-house. That said, this has been an embarrassing display for Backblaze and I hope they redouble their efforts on infosecurity. But mistakes happen. If there's a pattern, then that's a different story.

nerdponx 6y ago
Their reaction so far does not appear to be anything but attempting damage control on social media. Maybe a pattern is forming before our eyes.

dlkmp 6y ago

Even the title suggests that it's just a heads up on some minor functionality. Not really what I would expect from a company that puts "Trusted Storage Cloud" in their <h1> and encountered an incident that completely eradicates that trust.

dgellow 6y ago

If you're in the EU and a backblaze user and consider that some PII may have been leaked to 3rd parties, you can contact your local GDPR watchdog (aka national "Data Protection Authority", or DPA). See: https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens/redress/what-should-i-do-if-i-think-my-personal-data-protection-rights-havent-been-respected_en https://ec.europa.eu/info/law/law-topic/data-protection/refo...

its-summertime 6y ago

Anyone got any alternatives?

nerdponx 6y ago
I started looking into it, but I'm concerned there won't be a 1:1 equivalent.
deleted 6y ago
[deleted]
whitepoplar 6y ago
Wasabi, maybe?
woliveirajr 6y ago
Many of them in the previous post about this subject. After reading / comparing prices, for my needs I ended up with: - OVH Cloud Archive: 0.0023/GB for cold storage + incoming/outgoing prices. https://www.ovhcloud.com/en/public-cloud/prices/#storage https://www.ovhcloud.com/en/public-cloud/prices/#storage - iDrive: $ 69.50/5TB/year https://www.idrive.com/pricing https://www.idrive.com/pricing - Wasabi: $5.99 / 1TB/month: https://wasabi.com/cloud-storage-pricing/#cost-calc https://wasabi.com/cloud-storage-pricing/#cost-calc
kiwijamo 6y ago
I've started using rsync.net with the borg client (replacing b2 and rclone) and loving it so far. I'm also surprisingly finding borg/rsync.net is suiting my usecase (personal backups) better than b2 did which is a nice bonus. I am paying more but can't complain as the value I'm getting is still good.

freebuju 6y ago

Yeah. Backblaze are addressing this "blunder" only because they got caught. Not because they give 2 shits about their customer's privacy. The smug tone in this joke of a response to the issue proves this.

bellyfullofbac 6y ago
Man, your distrust seems toxic to me. The simplest explanation is they goofed as they admitted, if they were malicious, they'd upload those file names from their server straight to FB's, not through your god damned browser. And of course they only addressed it after they "got caught", they didn't know about their fuck up before that, if you want to sneer at them, sneer at them for not being careful enough to let this happen, not what you wrote. I'm not trying to defend them, more like I want to protest against ungrounded casual insulting bashes like yours that seems way too freaking common nowadays. I do think they care about customer privacy, because it affects their income. (Admiteddly they were too casual about it, they were still partnering with Facebook...).
- mPReDiToR 6y ago
  I agree with you in principle. That said, this way of doing things gives so much plausible deniability that it must at least occur to people. We've been burned on so many fronts by so many companies that it really is a learned behaviour to toxically distrust when things like this happen. It starts with politics. They're never held accountable for lying, evwn brazenly.
sdfhbdf 6y ago
never attribute to malice that which is adequately explained by stupidity

q3k 6y ago

> We take the privacy of our customers’ data and personal information very seriously [...] And yet, your blog/landing site wants me to opt into sharing my 'personal data' with 20 different 'advertisement partners'. Come on.

LunaSea 6y ago
I would say that opt in is pretty Ok in terms of privacy of customers protection.
- proactivesvcs 6y ago
  One does not protect one's customer privacy by asking if it can be violated, often using dark patterns.
  - LunaSea 6y ago
    Well that's exactly how you do it. By definition. Asking for consent means that you don't violate their privacy since they agreed to the data being collected and shared. Using dark patterns is of course not Ok but also a different topic.

kinard 6y ago

I wish I hadn't put my PII into the filenames of the files I was backing up. myname_myaddress.txt 4445-3333-2222-1213-0121-354.my.credit.number NW53342211A.my.national.insurance.number facebook_password_is_letmein.txt filename_are_now_storage.exe I_vote_for_trump.doc Now this is public I bet there's hundreds of facebook team members sifting through all of that log data to find this PII and manually transcribe it into my facebook account.

sandrone 6y ago
You are totally right what info could leak a files named: ClinicWhereTheyReattachYourJunkWhenItFallsOff_procedureOverview.txt, ClinicWhereTheyReattachYourJunkWhenItFallsOff_invoice.pdf and ClinicWhereTheyReattachYourJunkWhenItFallsOff_WhatWentWrongWithYourJunkBeGratefulYouHadTheChanceToSayGoodbye.rtf .. It's the old debate on the fact that filenames might be kinda sensitive.
petee 6y ago
In certain countries just possessing a file or app of a certain title could get you killed... edit: On further thought, would this have triggered China's firewall?
- dexterdog 6y ago
  In this country I can think of a couple: RepublicanVoterRegistration.png DemocratVoter Registration.png

anotherhue 6y ago

"Facebook has confirmed that all data inadvertently sent has been deleted" "We have added protections to prevent this error occurring again" Those sentences do - not - appear.

petee 6y ago

So they posted a blog before informing their customers directly? They had time to write, post and update, and I am still not seeing any emails about it

heipei 6y ago

I've been a happy Backblaze B2 user for the past few months, but this and another recent event leaves me feeling like I'll have to abandon their service (or at least mirror everything to S3 just-in-case) soon. Recent event being when GoDaddy suspended their user-facing B2 domain a month ago because of abuse requests that were apparently not handled correctly. That and the fact that they still don't have a user-facing status dashboard to communicate the status of their systems has me worried.

atYevP 6y ago
Yev from Backblaze here -> thanks for being a Backblaze customer. We've finished our root cause analysis and have updated that blog post with additional information. We also have moved domain registrars to make sure that behavior doesn't happen again. Sincere apologies for the issues you've experienced.

egeozcan 6y ago

There are known mechanisms to prevent leaks/exploits of this sort by sending some additional headers[0], on most of the modern browsers. Apart from that, the cookies should be strict for such a service. I logged in to my friends account to find neither implemented. They better act quick about "ensuring it doesn't happen" or I will distrust them completely. [0]: Content-Security-Policy (setting at least connect-src) and X-XSS-Protection to start with. More here: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Co...

emayljames 6y ago
Wow! is crazy they don't have that implemented.

emayljames 6y ago

Why you would not just use a cloud provider for this, I just don't get it.

kenmacd 6y ago
What do you mean?
- emayljames 6y ago
  s3, Google equivalent storage. Less cost for just about the same effort.
  - berbec 6y ago
    b2 is backblaze's S3 and it is cheaper than either S3 or Google Cloud storage
    - insomniacity 6y ago
      And maybe now we know why!

choward 6y ago

Gross. Why are they involving Google and Facebook? Those are the two main companies I'm trying to get away from and Backblaze is part of my setup.

zomg 6y ago

oof, this blog post is even more cringy than their repeated replies on twitter "...we’ve looked into and verified the issue and have pushed out a fix. We will continue to investigate and will provide updates as we have them." this is a perfect example of how NOT to handle a PR nightmare.

pdimitar 6y ago

Oh well, that's it then. I guess I'll only use Backblaze through `rclone` and utilize client-side end-to-end encryption. And I might still not use Backblaze. A very disappointing article.

newscracker 6y ago

Looking at this submission, comments and its ranking here, I’m sure that nobody from Backblaze will comment here or on HN for some more time. This blog post makes it seem like an internal gag order has been imposed. Some hand wavy updates are what we should expect I suppose. The post title is also dishonest in saying third party tracking and not adding details — this is Backblaze that intentionally and explicitly shared sensitive data with third party tracking. It’s not as if some third party tracked Backblaze’s paying users surreptitiously. This response is actually helpful for the competition as far as the HN audience is concerned. Edit: I’m really curious on the extent of coverage of this issue. I searched online and found only mjtsai.com and theregister.com covering this sensitive information leak. Are there any other major tech sites that have covered it so far?

atYevP 6y ago

Yev from Backblaze here - We've updated the blog post with additional information after completed our root causes analysis. You can read the updates: https://www.backblaze.com/blog/privacy-update-third-party-tracking/ https://www.backblaze.com/blog/privacy-update-third-party-tr....

alkonaut 6y ago

I expect zero http requests to any Facebook servers when I visit anycorp dot com and that’s regardless of whether I’m a paying customer or logged in user. If any actual data is transferred that’s even worse, but already having a connection to Facebook via a tracking pixel for “audience building” or similar is over the line already.

miked85 6y ago

This really isn't an acceptable response. I cancelled my account and moved back to AWS S3. Unfortunate.