5 ms·

Technical users will have no problem, but for non-technical users email it is easier to do permanent record keeping and documented CYA. Non-technical users puz

by VLM 4y ago

Technical users will have no problem, but for non-technical users email it is easier to do permanent record keeping and documented CYA. Non-technical users puzzle over how to document a text message in writing or how to permanently store and document a slack/irc type chat. Screenshots that are printed out on paper and scanned into a .pdf? I've seen things like that. For a lot of situations the benefit of electronic communications is CYA and permanent record keeping, not speed or ability to notify 24/7 around the world. "As you can see by the forwarded email chain below, I emailed ops about the backup process being broken a month ago, then reminded them two weeks later, then escalated the ticket after a month, and still have not heard anything back, as you know SOX compliance requires that we actually keep that data, so given the complete lack of communication over the last month, I'm curious if you know of an ETA to repair the backup process or if we should implement a local non-IT supported solution for backups of SOX compliance data, and if so how would that local process interoperate with existing documented security policies such as PCI-DSS and related requirements?" At least if it comes to a court case I won't be the one blamed, LOL. This is how business gets done at large companies, if someone can't get blamed individually, it ain't getting done.

horsawlarway 4y ago
There's some painful truth in this comment. Not to mention - email is very easy to branch in order to more safely secure that record. If IT owns the email server, and IT is fucking up... very easy to BCC/Forward a copy of the whole chain to my personal email for my own records.
- k0k0r0 4y ago
  I don't know much about that Email and legal stuff, but here in Germany I pay a couple of Euros every month to a well-known and respected company whose server is set up in such a way that my emails can be used in court without any issue (like claims that I altered the emails after receiving them). At least they claim that and I do believe them. I do not (yet) have a business, but I use it nevertheless. Just in case.
  - devmunchies 4y ago
    > but here in Germany I pay a couple of Euros every month to a well-known and respected company whose server is set up in such a way that my emails can be used in court without any issue (like claims that I altered the emails after receiving them) That's already cryptographically built into email with DKIM. An email message is signed with a private key, and can be verified as authentic by the receiver using the public key in the sender's DNS records. Click on "Show Original" in a Gmail mail to see the meta data. https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail
    - woodruffw 4y ago
      While this is technically true, it's not a correct use of DKIM: DKIM is meant to provide authenticity for the receiving mail server (by verifying the message against a key associated with the sending server), not nonrepudiation for the sending user. Many email providers historically used short keys (RSA <512, and later 1024) for DKIM, meaning that lots of emails circa 2012 and older appear to be nonrepudiable but in fact are. Long-term authenticity of emails is very difficult and is arguably an anti-feature; Matt Green correctly observes[1] that Google should be rotating and publishing its DKIM keys regularly to prevent people from falsely concluding that a DKIM signature is "proof" of a message's authenticity. [1]: https://blog.cryptographyengineering.com/2020/11/16/ok-google-please-publish-your-dkim-secret-keys/ https://blog.cryptographyengineering.com/2020/11/16/ok-googl...
  - mytailorisrich 4y ago
    I belive that emails can be used in court without any specific setup within most EU jurisdictions or EU overall.
Jensson 4y ago
Google started deleting old emails, big companies seems to see record keeping as a liability so it is important for them to control this infrastructure so that no inconvenient messages remains in the system when the inevitable lawsuits comes.
- Alex3917 4y ago
  Most big companies started retaining email indefinitely after the Monica Lewinsky scandal, and then started automatically deleting it after the Sony hack. I would expect the balance of whether to retain or delete email to continue to change every decade or so based on what's the least cheapest given the current security threat landscape and legal situation. (The exception being financial firms and other companies in highly regulated industries, which are still required to retain all communication.)
twobitshifter 4y ago
It sounds you see it as more CYA for employees than employers? That’s probably true. The companies I’ve worked at have deleted old emails rather than keep a record of all conversations, so that material doesn’t show up lawsuits. When someone leaves the company, all their emails are deleted.
- Wohlf 4y ago
  Employers don't need CYA as much, they can afford lawyers and write the internal policies.
- VLM 4y ago
  Its not just employee vs employer but at large enough corporations most effort is spent on infighting between departments.
pkulak 4y ago
That sounds perfectly async to me.
skrebbel 4y ago
Apparently CYA is short for "Cover Your Ass".
ajross 4y ago
> For a lot of situations the benefit of electronic communications is CYA and permanent record keeping Note that in a lot of industries, "permanent record keeping" is a regulatory requirement, it's not just politics. The culture of general employee communications being ejectable ephemera is somewhat unique to the US tech industry.
sorokod 4y ago
I find it helpful to think of my emails as documentation. Imagining myself figuring something out months or even years later changes the way I write.
- deleted 4y ago
  [deleted]
belfalas 4y ago
Willie Brown, once the mayor of San Francisco, had this to say about e-mail: the 'e' is for "evidence."
slaymaker1907 4y ago
What I've done for this sort of thing is use email for an evidence trail (and searching), but ping people via chat if it is something that needs to be looked at soon.

by VLM 4y ago

horsawlarway 4y ago

There's some painful truth in this comment. Not to mention - email is very easy to branch in order to more safely secure that record. If IT owns the email server, and IT is fucking up... very easy to BCC/Forward a copy of the whole chain to my personal email for my own records.

k0k0r0 4y ago
I don't know much about that Email and legal stuff, but here in Germany I pay a couple of Euros every month to a well-known and respected company whose server is set up in such a way that my emails can be used in court without any issue (like claims that I altered the emails after receiving them). At least they claim that and I do believe them. I do not (yet) have a business, but I use it nevertheless. Just in case.
- devmunchies 4y ago
  > but here in Germany I pay a couple of Euros every month to a well-known and respected company whose server is set up in such a way that my emails can be used in court without any issue (like claims that I altered the emails after receiving them) That's already cryptographically built into email with DKIM. An email message is signed with a private key, and can be verified as authentic by the receiver using the public key in the sender's DNS records. Click on "Show Original" in a Gmail mail to see the meta data. https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail
  - woodruffw 4y ago
    While this is technically true, it's not a correct use of DKIM: DKIM is meant to provide authenticity for the receiving mail server (by verifying the message against a key associated with the sending server), not nonrepudiation for the sending user. Many email providers historically used short keys (RSA <512, and later 1024) for DKIM, meaning that lots of emails circa 2012 and older appear to be nonrepudiable but in fact are. Long-term authenticity of emails is very difficult and is arguably an anti-feature; Matt Green correctly observes[1] that Google should be rotating and publishing its DKIM keys regularly to prevent people from falsely concluding that a DKIM signature is "proof" of a message's authenticity. [1]: https://blog.cryptographyengineering.com/2020/11/16/ok-google-please-publish-your-dkim-secret-keys/ https://blog.cryptographyengineering.com/2020/11/16/ok-googl...
- mytailorisrich 4y ago
  I belive that emails can be used in court without any specific setup within most EU jurisdictions or EU overall.

Jensson 4y ago

Google started deleting old emails, big companies seems to see record keeping as a liability so it is important for them to control this infrastructure so that no inconvenient messages remains in the system when the inevitable lawsuits comes.

Alex3917 4y ago
Most big companies started retaining email indefinitely after the Monica Lewinsky scandal, and then started automatically deleting it after the Sony hack. I would expect the balance of whether to retain or delete email to continue to change every decade or so based on what's the least cheapest given the current security threat landscape and legal situation. (The exception being financial firms and other companies in highly regulated industries, which are still required to retain all communication.)

twobitshifter 4y ago

It sounds you see it as more CYA for employees than employers? That’s probably true. The companies I’ve worked at have deleted old emails rather than keep a record of all conversations, so that material doesn’t show up lawsuits. When someone leaves the company, all their emails are deleted.

Wohlf 4y ago
Employers don't need CYA as much, they can afford lawyers and write the internal policies.
VLM 4y ago
Its not just employee vs employer but at large enough corporations most effort is spent on infighting between departments.

pkulak 4y ago

That sounds perfectly async to me.

skrebbel 4y ago

Apparently CYA is short for "Cover Your Ass".

ajross 4y ago

> For a lot of situations the benefit of electronic communications is CYA and permanent record keeping Note that in a lot of industries, "permanent record keeping" is a regulatory requirement, it's not just politics. The culture of general employee communications being ejectable ephemera is somewhat unique to the US tech industry.

sorokod 4y ago

I find it helpful to think of my emails as documentation. Imagining myself figuring something out months or even years later changes the way I write.

deleted 4y ago
[deleted]

belfalas 4y ago

Willie Brown, once the mayor of San Francisco, had this to say about e-mail: the 'e' is for "evidence."

slaymaker1907 4y ago

What I've done for this sort of thing is use email for an evidence trail (and searching), but ping people via chat if it is something that needs to be looked at soon.