5 ms·

It’s already so hard to build a large company, you just don’t have the resources to chase super rare, low pain outcomes. This is the first time this has happen

by tjs8rj 4y ago

It’s already so hard to build a large company, you just don’t have the resources to chase super rare, low pain outcomes. This is the first time this has happened and the total cost of it is at most a few hours revenue. They’ll likely add safeguards to prevent such a thing now, but if they ran the company preparing for every possible way things could go wrong, they’d get absolutely nothing done.

tcgv 4y ago
Good reasoning. Hindsight bias comes to mind: - https://en.wikipedia.org/wiki/Hindsight_bias https://en.wikipedia.org/wiki/Hindsight_bias
onion2k 4y ago
low pain outcomes All your customers thinking your app isn't secure any more isn't "low pain".
- ivan_gammel 4y ago
  99% of customers won’t care, because they will only briefly see the news, this hack did not harm them, they don’t care that much about security of an app and they don’t have a good alternative. The impact of such incidents on company reputation and revenue is often exaggerated.
  - munk-a 4y ago
    A few customers will have strong negative opinions "I was waiting at the airport in the rain for four hours!" but most people will indeed shrug this off. It's a much different issue than what happens when payment systems are compromised. A lot more people care if they're informed their credit card was stolen and told to carefully watch statements for the next month - that leverages a real PITA cost on the customer.
- and-not-drew 4y ago
  That's got nothing to do with what we're talking about. The first comment didn't say they should have spent more time on security, it said they should have spent time creating a system to detect if too many taxis were in one spot. I think we can all agree that security is valuable and should be prioritized, but spending time worrying about how to stop who is already in your system from sending all the cabs to the wrong place seems like a waste of time. Hell, IF (big if) the worst thing a hacker could do once they had access YandexTaxi's servers is send a bunch of cabs to the wrong place, you could almost spin that in a positive light. "We spent so much time protecting customer data that all they could do is send our divers to the wrong place".
  - bee_rider 4y ago
    It is hard to make a solid argument about perceptions. Is it possible that non-technical people would perceive the ability to send all the drivers to one location as a big security problem, even though it doesn't really require any conventional security issues? Maaayybeeee. "Hacks" that intrude into the real world do have a bit of an over-inflated appearance of importance after all.
  - samus 4y ago
    Maybe they managed to also steal or encrypt data, and now the media attention in a sense helps the hackers claim extortion money? Since the showlights are now on that company?
    - and-not-drew 4y ago
      True, but going back to the original argument, if hackers did manage to steal data, that makes the idea of spending time trying to prevent all the taxis from being sent to one place even stupider. In the world where YandexTaxi had extra time to spend on something, they should have spent it on securing their data better.
- golergka 4y ago
  Yandex had already leaked ALL data about their food delivery customers, including addresses and names. Didn't hurt them a bit since they're a monopoly. (It used to be a duopoly, but they're acquiring the only seriously competing service now). When you're a government controlled corporation in an openly fascist state, you couldn't care less what your customers think.
- ornornor 4y ago
  Equifax lost millions of credit files, no consequences for them. The Us government lost the completed forms that people who want a security clearance have to fill and that lists all their hidden skeletons (they must disclose them in the form so the govt can assess the likelihood of them being successfully leveraged by an enemy) and nothing changed[0]: > In 2018, the OPM was reportedly still vulnerable to data thefts, with 29 of the Government Accountability Office's 80 recommendations remaining unaddressed. In particular, the OPM was reportedly still using passwords that had been stolen in the breach. It also had not discontinued the practice of sharing administrative accounts between users, despite that practice having been recommended against as early as 2003. Not to mention the breaches happening at regular interval. I’m concerned about them and even I can’t remember them. People don’t care. It happened to many times. It’s too abstract for a lot of people just like “Facebook and gmail can read my messages, nothing to hide”. There is little to no penalty for not being secure enough/getting breached. [0]: https://en.m.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.m.wikipedia.org/wiki/Office_of_Personnel_Manageme...
monksy 4y ago
When you build a product, your customers expect, and pay, you to be an expert and dedicated to that domain. Not some kind of fly by night scam.
- zibby8 4y ago
  This is such a ridiculous take I’m having trouble understanding if it’s satire or not.
  - renewiltord 4y ago
    When you write a comment, you have to be responsible. Others might read it and take it seriously and your advice might lead to death and dismemberment. If you aren't willing to get insurance before commenting, don't comment. Leave it to the professionals with licences.
heavenlyblue 4y ago
Nobody asks you to build a large company

by tjs8rj 4y ago

tcgv 4y ago

Good reasoning. Hindsight bias comes to mind: - https://en.wikipedia.org/wiki/Hindsight_bias https://en.wikipedia.org/wiki/Hindsight_bias

onion2k 4y ago

low pain outcomes All your customers thinking your app isn't secure any more isn't "low pain".

ivan_gammel 4y ago
99% of customers won’t care, because they will only briefly see the news, this hack did not harm them, they don’t care that much about security of an app and they don’t have a good alternative. The impact of such incidents on company reputation and revenue is often exaggerated.
- munk-a 4y ago
  A few customers will have strong negative opinions "I was waiting at the airport in the rain for four hours!" but most people will indeed shrug this off. It's a much different issue than what happens when payment systems are compromised. A lot more people care if they're informed their credit card was stolen and told to carefully watch statements for the next month - that leverages a real PITA cost on the customer.
and-not-drew 4y ago
That's got nothing to do with what we're talking about. The first comment didn't say they should have spent more time on security, it said they should have spent time creating a system to detect if too many taxis were in one spot. I think we can all agree that security is valuable and should be prioritized, but spending time worrying about how to stop who is already in your system from sending all the cabs to the wrong place seems like a waste of time. Hell, IF (big if) the worst thing a hacker could do once they had access YandexTaxi's servers is send a bunch of cabs to the wrong place, you could almost spin that in a positive light. "We spent so much time protecting customer data that all they could do is send our divers to the wrong place".
- bee_rider 4y ago
  It is hard to make a solid argument about perceptions. Is it possible that non-technical people would perceive the ability to send all the drivers to one location as a big security problem, even though it doesn't really require any conventional security issues? Maaayybeeee. "Hacks" that intrude into the real world do have a bit of an over-inflated appearance of importance after all.
- samus 4y ago
  Maybe they managed to also steal or encrypt data, and now the media attention in a sense helps the hackers claim extortion money? Since the showlights are now on that company?
  - and-not-drew 4y ago
    True, but going back to the original argument, if hackers did manage to steal data, that makes the idea of spending time trying to prevent all the taxis from being sent to one place even stupider. In the world where YandexTaxi had extra time to spend on something, they should have spent it on securing their data better.
golergka 4y ago
Yandex had already leaked ALL data about their food delivery customers, including addresses and names. Didn't hurt them a bit since they're a monopoly. (It used to be a duopoly, but they're acquiring the only seriously competing service now). When you're a government controlled corporation in an openly fascist state, you couldn't care less what your customers think.
ornornor 4y ago
Equifax lost millions of credit files, no consequences for them. The Us government lost the completed forms that people who want a security clearance have to fill and that lists all their hidden skeletons (they must disclose them in the form so the govt can assess the likelihood of them being successfully leveraged by an enemy) and nothing changed[0]: > In 2018, the OPM was reportedly still vulnerable to data thefts, with 29 of the Government Accountability Office's 80 recommendations remaining unaddressed. In particular, the OPM was reportedly still using passwords that had been stolen in the breach. It also had not discontinued the practice of sharing administrative accounts between users, despite that practice having been recommended against as early as 2003. Not to mention the breaches happening at regular interval. I’m concerned about them and even I can’t remember them. People don’t care. It happened to many times. It’s too abstract for a lot of people just like “Facebook and gmail can read my messages, nothing to hide”. There is little to no penalty for not being secure enough/getting breached. [0]: https://en.m.wikipedia.org/wiki/Office_of_Personnel_Management_data_breach https://en.m.wikipedia.org/wiki/Office_of_Personnel_Manageme...

monksy 4y ago

When you build a product, your customers expect, and pay, you to be an expert and dedicated to that domain. Not some kind of fly by night scam.

zibby8 4y ago
This is such a ridiculous take I’m having trouble understanding if it’s satire or not.
- renewiltord 4y ago
  When you write a comment, you have to be responsible. Others might read it and take it seriously and your advice might lead to death and dismemberment. If you aren't willing to get insurance before commenting, don't comment. Leave it to the professionals with licences.

heavenlyblue 4y ago

Nobody asks you to build a large company