4 ms·

as per my other comment, in most of the sufficiently big or historical cases you have to distinguish between two things: - reality - the socially acceptable f

as per my other comment, in most of the sufficiently big or historical cases you have to distinguish between two things: - reality - the socially acceptable fiction in the report the exercise would be to create an output that allows people to pretend we know where all instances of "log4j" were used, or that sufficient depth and resources have been expended on such. but in a sufficiently large and complex organisation, we (and by we I mean technically able, knowledgeable or sufficiently aware individuals) know that the content of such is likely to be as factually true as reading a historian's report entitled: "enumeration of all points in past century where cutlery has been used".

kixiQu 4y ago
On a spectrum of ridiculousness vs. necessity running from "enumerate where cutlery was used for the past one hundred years" to "keep tabs on the radioactive material we have in storage", it is a choice to vacuum up user data and treat it as the former rather than the latter. It is not unavoidable; it is that Facebook does not want to avoid it. If they did want to avoid it, they could do so in the same way that my employer woke me up to verify that there was no log4j running on some machines that did not have Java installed: unpleasant campaigns, building automated checks, checking the checks, pouring manual effort into the gaps, paying the costs. Slowing down development, maybe. Shifting resources. Rendering some designs infeasible (okay, well, not for log4j, but for a compliance thing I'm thinking of). It is very important that we are precise here: they are trying to come up with a story to make this about technicalities, and it is actually about their priorities. People who've done large-scale engineering need to be clear that even within a large organization, things do get hunted down if and only if the organization prioritizes them. Measurements and control mechanisms are built. Systems, social and technical, are designed. And if they're not, Facebook can't honestly say oh but it was so hard it's impossible, we're just too big. We're not talking about detecting I-know-it-when-I-see-it obscenity or whatever social thing people hope AI will fix for them, we're talking about knowing how data is being plumbed from one place to another, and where it lives when it's at rest. It's an embarrassment that this is being presented as a Hard Problem.
- bentinney 4y ago
  That was an impressively long threaded argument just to agree with what the original poster stated. Essentially this boils down to the following: cities and large tech companies are hugely complicated endeavors and if enough money and/or manpower is placed into a "documentation project" we could fully describe either system (using a combination of reality and socially acceptable fiction.) However, it would mostly likely be outdated by the time the project was finished - unless we froze the city/company in place which would most likely kill it.
  - kixiQu 4y ago
    No, I do not agree with what the original poster stated. I think it's possible to get too abstract in discussion with an idea of "documenting a system" since that can of course shoot for a level of detail that can't be maintained. Here is a practical example. https://en.wikipedia.org/wiki/Personal_Information_Protection_Law_of_the_People%27s_Republic_of_China https://en.wikipedia.org/wiki/Personal_Information_Protectio... When this law was to come into effect, every company that does business in China had to audit where they were storing all Chinese PII in order to figure out what they might need to change. For large companies, this involved making everyone perform this audit for their own little fiefdoms. Being as this wasn't the kind of thing one can have lawyers go challenge in court, there were two options: 1. Actually do an audit (and if you're not dealing with exceptionally poor engineering, this should not have been as hard as keeping track of dependency libraries), rebuild everything from scratch (wasteful), or nuke absolutely anything that might have a chance of having Chinese PII (...unlikely from a business perspective). 2. Lie (internally / externally) and thereby break the law. People in these comments seem to love the phrase "socially acceptable fiction" and I want to be very crisp that we are dealing with a clean dichotomy. You do the audit, or you lie and break the law. Yes, I understand there are some among us who have so little integrity that they'll shrug at the latter option, that they'd fake the VW emissions test, that they'll cheat and embezzle and tell themselves that it was all inevitable anyway and anyone in their places would do the same. But this is not actually true. We would not all do this. Pretending this is normal variance gives cover to scummy people. I therefore object to the root comment's characterization of this kind of thing exceeding real understanding as a natural consequence of scale/time. Yes, in terms of how it can come about that no individual knows this stuff, it's accurate – but only in the absence of the institution itself caring to pay attention. I object to succeeding characterizations that it is an inevitable attribute of social systems that meaningful control is impossible, because even educated and carefully hired professionals can apparently only be expected to behave with the ethics one might expect of a sixth grader who would rather let Chegg write his book report. From the article, this is what FB is saying: > “We do not have an adequate level of control and explainability over how our systems use data, and thus we can’t confidently make controlled policy changes or external commitments such as ‘we will not use X data for Y purpose,’” the 2021 document read. This may be accurate about Facebook; I would not know. What I do know is that it is not an inevitable consequence of scale and lifespan.
TomSwirly 4y ago
Then these organizations should be torn down, their executives jailed, and replaced by organizations that are not deliberately designed so compliance with data privacy and retention laws is completely impossible.

kixiQu 4y ago

On a spectrum of ridiculousness vs. necessity running from "enumerate where cutlery was used for the past one hundred years" to "keep tabs on the radioactive material we have in storage", it is a choice to vacuum up user data and treat it as the former rather than the latter. It is not unavoidable; it is that Facebook does not want to avoid it. If they did want to avoid it, they could do so in the same way that my employer woke me up to verify that there was no log4j running on some machines that did not have Java installed: unpleasant campaigns, building automated checks, checking the checks, pouring manual effort into the gaps, paying the costs. Slowing down development, maybe. Shifting resources. Rendering some designs infeasible (okay, well, not for log4j, but for a compliance thing I'm thinking of). It is very important that we are precise here: they are trying to come up with a story to make this about technicalities, and it is actually about their priorities. People who've done large-scale engineering need to be clear that even within a large organization, things do get hunted down if and only if the organization prioritizes them. Measurements and control mechanisms are built. Systems, social and technical, are designed. And if they're not, Facebook can't honestly say oh but it was so hard it's impossible, we're just too big. We're not talking about detecting I-know-it-when-I-see-it obscenity or whatever social thing people hope AI will fix for them, we're talking about knowing how data is being plumbed from one place to another, and where it lives when it's at rest. It's an embarrassment that this is being presented as a Hard Problem.

bentinney 4y ago
That was an impressively long threaded argument just to agree with what the original poster stated. Essentially this boils down to the following: cities and large tech companies are hugely complicated endeavors and if enough money and/or manpower is placed into a "documentation project" we could fully describe either system (using a combination of reality and socially acceptable fiction.) However, it would mostly likely be outdated by the time the project was finished - unless we froze the city/company in place which would most likely kill it.
- kixiQu 4y ago
  No, I do not agree with what the original poster stated. I think it's possible to get too abstract in discussion with an idea of "documenting a system" since that can of course shoot for a level of detail that can't be maintained. Here is a practical example. https://en.wikipedia.org/wiki/Personal_Information_Protection_Law_of_the_People%27s_Republic_of_China https://en.wikipedia.org/wiki/Personal_Information_Protectio... When this law was to come into effect, every company that does business in China had to audit where they were storing all Chinese PII in order to figure out what they might need to change. For large companies, this involved making everyone perform this audit for their own little fiefdoms. Being as this wasn't the kind of thing one can have lawyers go challenge in court, there were two options: 1. Actually do an audit (and if you're not dealing with exceptionally poor engineering, this should not have been as hard as keeping track of dependency libraries), rebuild everything from scratch (wasteful), or nuke absolutely anything that might have a chance of having Chinese PII (...unlikely from a business perspective). 2. Lie (internally / externally) and thereby break the law. People in these comments seem to love the phrase "socially acceptable fiction" and I want to be very crisp that we are dealing with a clean dichotomy. You do the audit, or you lie and break the law. Yes, I understand there are some among us who have so little integrity that they'll shrug at the latter option, that they'd fake the VW emissions test, that they'll cheat and embezzle and tell themselves that it was all inevitable anyway and anyone in their places would do the same. But this is not actually true. We would not all do this. Pretending this is normal variance gives cover to scummy people. I therefore object to the root comment's characterization of this kind of thing exceeding real understanding as a natural consequence of scale/time. Yes, in terms of how it can come about that no individual knows this stuff, it's accurate – but only in the absence of the institution itself caring to pay attention. I object to succeeding characterizations that it is an inevitable attribute of social systems that meaningful control is impossible, because even educated and carefully hired professionals can apparently only be expected to behave with the ethics one might expect of a sixth grader who would rather let Chegg write his book report. From the article, this is what FB is saying: > “We do not have an adequate level of control and explainability over how our systems use data, and thus we can’t confidently make controlled policy changes or external commitments such as ‘we will not use X data for Y purpose,’” the 2021 document read. This may be accurate about Facebook; I would not know. What I do know is that it is not an inevitable consequence of scale and lifespan.

TomSwirly 4y ago

Then these organizations should be torn down, their executives jailed, and replaced by organizations that are not deliberately designed so compliance with data privacy and retention laws is completely impossible.