3 ms·

How can it be secure if they are able to track you this far? https://news.ycombinator.com/item?id=31852914 https://news.ycombinator.com/item?id=31852914

Nextgrid 4y ago
> To answer some of the other questions on this thread, no customer logs nor PII get submitted to the 3rd party service that we use, which is called Descartes [...] We pass name and billing address only.
- bradwood 4y ago
  and name and address is not PII?
  - Nextgrid 4y ago
    Name and address of the company purchasing the license, which (in most countries at least) is already published in various business and tax records.
Aachen 4y ago
Security isn't the same as privacy. Using Facebook you don't have privacy, but the platform containing your data isn't likely to be compromised (your account's password being guessed is the most likely method of compromise, and that's in your own hands). Though I wonder if this distinction will go the way of the dodo / hacker / crypto, since a lot of people seem to not understand this in recent years (mostly since privacy became a bigger topic, first with Snowden but even more since GDPR enforced it). If the words privacy and security are both used to mean privacy in common language then we need a new word to communicate the previous meaning of "security". Kind of annoying when a language changes and existing words are redefined, but it's not as if an evolving language a new phenomenon.
tinus_hn 4y ago
It appears the actual problem was that they weren’t able to track things that far and mistakenly sent out notices to the wrong customers.
msh 4y ago
See the update here: https://news.ycombinator.com/item?id=31853107 https://news.ycombinator.com/item?id=31853107 It was a problem sending the email to wrong accounts. The CEO states later in the thread that they don't track that kind of info from selfhosted instances.

Nextgrid 4y ago

> To answer some of the other questions on this thread, no customer logs nor PII get submitted to the 3rd party service that we use, which is called Descartes [...] We pass name and billing address only.

bradwood 4y ago
and name and address is not PII?
- Nextgrid 4y ago
  Name and address of the company purchasing the license, which (in most countries at least) is already published in various business and tax records.

Aachen 4y ago

Security isn't the same as privacy. Using Facebook you don't have privacy, but the platform containing your data isn't likely to be compromised (your account's password being guessed is the most likely method of compromise, and that's in your own hands). Though I wonder if this distinction will go the way of the dodo / hacker / crypto, since a lot of people seem to not understand this in recent years (mostly since privacy became a bigger topic, first with Snowden but even more since GDPR enforced it). If the words privacy and security are both used to mean privacy in common language then we need a new word to communicate the previous meaning of "security". Kind of annoying when a language changes and existing words are redefined, but it's not as if an evolving language a new phenomenon.

tinus_hn 4y ago

It appears the actual problem was that they weren’t able to track things that far and mistakenly sent out notices to the wrong customers.

msh 4y ago

See the update here: https://news.ycombinator.com/item?id=31853107 https://news.ycombinator.com/item?id=31853107 It was a problem sending the email to wrong accounts. The CEO states later in the thread that they don't track that kind of info from selfhosted instances.