5 ms·

Don’t worry, Facebook will soon put out a press release including the phrase “we need to do better.”

mrweasel 6y ago
That kinda sad, because that is what’s going to happen and then we’ll nothing more. At this point I’m not really sure what it will take for companies, like Facebook, to understand that you need to not fuck around with peoples private data.
- BoiledCabbage 6y ago
  Put a monetary cost of holding user data, and a steep monetary cost on losing user data. Ex, pay x amount per month in perpetuity for each piece of information about a user your keep. And have to pay the "net present value" of those payments if you lose the data. Having to pay for hoarding user personal data changes the incentives from gobble up as much as possible, to instead only pay for a users data that is worth the cost to your business. And as an extra incentive to not hold unneeded user data, know the costs you'd pay if it was breached.
  - mrweasel 6y ago
    Who would get this money? I agree that it needs to be some solution involving a cost, given that most of these companies have shown multiple times that profit isn’t just their main concern, it’s the only concern.
    - gpm 6y ago
      The government typically... who might in turn do something like a tax rebate (write a check to everyone, ontario has been doing with the carbon tax) or just stick it into the general pool of taxes (reducing everyone's taxes).
      - 29083011397778 6y ago
        So the American government gets a cheque for every other nations citizens that use FB, or FB has to determine where each of their users reside? Respectfully, I'm not sure either of these lead to outcomes we want
    - pharke 6y ago
      Think of it like a class action lawsuit on behalf of investors. Instead of entrusting their savings to a company, people are entrusting them with their personal information. If there is gross negligence on part of the company leading to that data being leaked then all of the people whose data was stolen should be able to claim monetary damages. If a legal precedent is established so that these claims can be pursued whenever this happens it should provide enough motivation for these companies to take preventative measures.
  - anticristi 6y ago
    Sounds interesting. Shall we call it "GDPR"?
    - mrweasel 6y ago
      Honestly the EU need to finans a organisation to deal with GDPR violation, hell it could finans it self. The GDPR is the single best piece of legislation ever written, in term of privacy, but enforcement is lacking.
      - donalhunt 6y ago
        They already do. The Data Protection Commissioners in each state are growing rapidly to try and tackle the volume of work.
poqegjrioe 6y ago
I work in the security field and let me tell you something I realized: nobody cares about security. If someone cares about security, it's because they've had many many incidents in the past. We humans are not a species that is good at preventing, we are good at reacting. the security handbook[^1] has a chapter on that actually, and they basically say that role playing is the only way of not getting burned. Humans are excellent at role playing, and it can help you prevent a lot of catastrophe without having experienced them before. [^1]: https://securityhandbook.io/ https://securityhandbook.io/
- anticristi 6y ago
  I think part of the problem is that many orgs see security as an overhead that engineers do to sleep well at night. A few more breaches, a few more fines and it will finally be seen as a feature to keep the CEO out of jail.
  - kevmo 6y ago
    Probably 2/3 of billionaires belong in jail.
    - aloisdg 6y ago
      Probably most of them if not all.
      - Judgmentality 6y ago
        "Behind every great fortune is a crime."
  - hunter-gatherer 6y ago
    This is just it. I also work in the security industry, and the fact of the matter is that we (security professionals) can't give guarantees. I don't know what exotic exploit or bug will exist tomorrow. Security professions basically offer what (to me) seems like a crappy insurance policy. Depending on your orgs threat model, it is often just cheaper to deal with the breaches. --- I am not saying facebook falls into this category. ---
esnard 6y ago
"This is old data that was previously reported on in 2019. We found and fixed this issue in August 2019." https://twitter.com/Liz_Shepherd/status/1378398417450377222 https://twitter.com/Liz_Shepherd/status/1378398417450377222
- varispeed 6y ago
  What a pathetic response. Does it mean users changed where they live? Change their names? Deleted and started a new account so the ID is different?
  - TheRealDunkirk 6y ago
    > Deleted. "You keep using that word. I do not think it means what you think it means." I "deleted my account" in the run-up to the 2016 election, because I could see how social media was being manipulated, and what it is doing to society. And I mean I _deleted_ it. I took the extra steps of researching how to REALLY delete it; not just suspend it. A couple years later, I needed to get a new account to help admin a page. You can guess where this is going. I tried my usual email -- since it should be free, and it was deleted, right? And... what do you know? Everything was still there. All my posts. All my connections. Everything. Facebook never deletes anything.
    - varispeed 6y ago
      I think this is because is very expensive to delete and also to develop true delete process. I think that is not acceptable and cost shouldn't be an excuse for keeping content forever. Even if you manage to get deleted from the live servers, chances are your content is still going to live in backups and will never be deleted. Some backup systems are write-once and could only be deleted by physically destroying the medium. I wish this was properly addressed in legislation.

That kinda sad, because that is what’s going to happen and then we’ll nothing more. At this point I’m not really sure what it will take for companies, like Facebook, to understand that you need to not fuck around with peoples private data.

BoiledCabbage 6y ago
Put a monetary cost of holding user data, and a steep monetary cost on losing user data. Ex, pay x amount per month in perpetuity for each piece of information about a user your keep. And have to pay the "net present value" of those payments if you lose the data. Having to pay for hoarding user personal data changes the incentives from gobble up as much as possible, to instead only pay for a users data that is worth the cost to your business. And as an extra incentive to not hold unneeded user data, know the costs you'd pay if it was breached.
- mrweasel 6y ago
  Who would get this money? I agree that it needs to be some solution involving a cost, given that most of these companies have shown multiple times that profit isn’t just their main concern, it’s the only concern.
  - gpm 6y ago
    The government typically... who might in turn do something like a tax rebate (write a check to everyone, ontario has been doing with the carbon tax) or just stick it into the general pool of taxes (reducing everyone's taxes).
    - 29083011397778 6y ago
      So the American government gets a cheque for every other nations citizens that use FB, or FB has to determine where each of their users reside? Respectfully, I'm not sure either of these lead to outcomes we want
  - pharke 6y ago
    Think of it like a class action lawsuit on behalf of investors. Instead of entrusting their savings to a company, people are entrusting them with their personal information. If there is gross negligence on part of the company leading to that data being leaked then all of the people whose data was stolen should be able to claim monetary damages. If a legal precedent is established so that these claims can be pursued whenever this happens it should provide enough motivation for these companies to take preventative measures.
- anticristi 6y ago
  Sounds interesting. Shall we call it "GDPR"?
  - mrweasel 6y ago
    Honestly the EU need to finans a organisation to deal with GDPR violation, hell it could finans it self. The GDPR is the single best piece of legislation ever written, in term of privacy, but enforcement is lacking.
    - donalhunt 6y ago
      They already do. The Data Protection Commissioners in each state are growing rapidly to try and tackle the volume of work.

poqegjrioe 6y ago

I work in the security field and let me tell you something I realized: nobody cares about security. If someone cares about security, it's because they've had many many incidents in the past. We humans are not a species that is good at preventing, we are good at reacting. the security handbook[^1] has a chapter on that actually, and they basically say that role playing is the only way of not getting burned. Humans are excellent at role playing, and it can help you prevent a lot of catastrophe without having experienced them before. [^1]: https://securityhandbook.io/ https://securityhandbook.io/

anticristi 6y ago
I think part of the problem is that many orgs see security as an overhead that engineers do to sleep well at night. A few more breaches, a few more fines and it will finally be seen as a feature to keep the CEO out of jail.
- kevmo 6y ago
  Probably 2/3 of billionaires belong in jail.
  - aloisdg 6y ago
    Probably most of them if not all.
    - Judgmentality 6y ago
      "Behind every great fortune is a crime."
- hunter-gatherer 6y ago
  This is just it. I also work in the security industry, and the fact of the matter is that we (security professionals) can't give guarantees. I don't know what exotic exploit or bug will exist tomorrow. Security professions basically offer what (to me) seems like a crappy insurance policy. Depending on your orgs threat model, it is often just cheaper to deal with the breaches. --- I am not saying facebook falls into this category. ---

esnard 6y ago

"This is old data that was previously reported on in 2019. We found and fixed this issue in August 2019." https://twitter.com/Liz_Shepherd/status/1378398417450377222 https://twitter.com/Liz_Shepherd/status/1378398417450377222

varispeed 6y ago
What a pathetic response. Does it mean users changed where they live? Change their names? Deleted and started a new account so the ID is different?
- TheRealDunkirk 6y ago
  > Deleted. "You keep using that word. I do not think it means what you think it means." I "deleted my account" in the run-up to the 2016 election, because I could see how social media was being manipulated, and what it is doing to society. And I mean I _deleted_ it. I took the extra steps of researching how to REALLY delete it; not just suspend it. A couple years later, I needed to get a new account to help admin a page. You can guess where this is going. I tried my usual email -- since it should be free, and it was deleted, right? And... what do you know? Everything was still there. All my posts. All my connections. Everything. Facebook never deletes anything.
  - varispeed 6y ago
    I think this is because is very expensive to delete and also to develop true delete process. I think that is not acceptable and cost shouldn't be an excuse for keeping content forever. Even if you manage to get deleted from the live servers, chances are your content is still going to live in backups and will never be deleted. Some backup systems are write-once and could only be deleted by physically destroying the medium. I wish this was properly addressed in legislation.