3 ms·

> Google has a huge number of activist (and surely some corruptible) employees, and yet the incidents of users data getting out are very close to zero Am I rea

> Google has a huge number of activist (and surely some corruptible) employees, and yet the incidents of users data getting out are very close to zero Am I reading this wrong, or are you saying that activists would be more likely to leak data? Then I would wonder what kind of activists you have in mind. Agreed that yes indeed it seems possible to build a security serious company, and that Google is (seems to be) a good example. (Now, there are other things I don't like about Google but I guess that's of topic.)

thu2111 6y ago
Surely they would. We already learned that members of their own security team don't seem to see any problems with employees abusing privileged access to mandatory Chrome extensions to agitate for unionisation (at Google of all places!!). Twitter employees screwed with the account of the president of the United States. Ideological employees of big tech firms taking a sudden disliking to someone or some group and abusing privileged access is certainly a threat that ever larger numbers of people are talking seriously. In particular, it is a concern for industries that do things activists don't like, such as working with immigration control (though perhaps that's no longer an issue now Trump is gone).
- cutemonster 6y ago
  > employees abusing privileged access to mandatory Chrome extensions Sounds interesting, you don't happen to have a link? (So I can read more)
  - thu2111 6y ago
    https://www.nbcnews.com/news/all/security-engineer-says-google-fired-her-trying-notify-co-workers-n1103031 https://www.nbcnews.com/news/all/security-engineer-says-goog... Kathryn Spiers, who worked as a security engineer, updated an internal Chrome browser extension so that each time Google employees visited the website of IRI Consultants — the Troy, Michigan, firm that Google hired this year amid a groundswell of labor activism at the company — they would see a pop-up message that read: “Googlers have the right to participate in protected concerted activities.” Discussion here: https://news.ycombinator.com/item?id=21813619 https://news.ycombinator.com/item?id=21813619 Note that she wasn't able to do that unilaterally. Some other member of the team approved her CL and others defended her in public. I have a vague feeling there was another case like this some years ago where some security engineer modified a Chrome extension for political reasons, but I can't remember the exact details and can no longer find it.

thu2111 6y ago

Surely they would. We already learned that members of their own security team don't seem to see any problems with employees abusing privileged access to mandatory Chrome extensions to agitate for unionisation (at Google of all places!!). Twitter employees screwed with the account of the president of the United States. Ideological employees of big tech firms taking a sudden disliking to someone or some group and abusing privileged access is certainly a threat that ever larger numbers of people are talking seriously. In particular, it is a concern for industries that do things activists don't like, such as working with immigration control (though perhaps that's no longer an issue now Trump is gone).

cutemonster 6y ago
> employees abusing privileged access to mandatory Chrome extensions Sounds interesting, you don't happen to have a link? (So I can read more)
- thu2111 6y ago
  https://www.nbcnews.com/news/all/security-engineer-says-google-fired-her-trying-notify-co-workers-n1103031 https://www.nbcnews.com/news/all/security-engineer-says-goog... Kathryn Spiers, who worked as a security engineer, updated an internal Chrome browser extension so that each time Google employees visited the website of IRI Consultants — the Troy, Michigan, firm that Google hired this year amid a groundswell of labor activism at the company — they would see a pop-up message that read: “Googlers have the right to participate in protected concerted activities.” Discussion here: https://news.ycombinator.com/item?id=21813619 https://news.ycombinator.com/item?id=21813619 Note that she wasn't able to do that unilaterally. Some other member of the team approved her CL and others defended her in public. I have a vague feeling there was another case like this some years ago where some security engineer modified a Chrome extension for political reasons, but I can't remember the exact details and can no longer find it.