3 ms·

Data is divided into many different logs, with engineers having access only if it's needed for their role. Access can be at the per-log level or the per-column

by jefftk 4y ago

Data is divided into many different logs, with engineers having access only if it's needed for their role. Access can be at the per-log level or the per-column level: working on Ads JS I had access to raw frontend logs, but I didn't have access to the identities of the users sending those queries (if I'd needed that for a project I could have applied and had my need reviewed). Every few months you need your access renewed, so if you've switched roles you stop having access. What queries you run are logged, and I believe there was some sort of random auditing of those logs to make sure people were running queries that made sense, though I never interacted with that part. (I left Google in June.)

saiya-jin 4y ago
So basically very primitive security compared to say how banks are handling client data in jurisdictions like Switzerland (one of my daily tasks). The fact that dev can have access to PROD logs just by himself unsupervised (even if for obviously good reasons from his/company point of view) is a big fat red flag. That all mentioned here clearly means google doesn't have data privacy at the core of their priorities and this won't change unless forced by fines/regulation, just like banks. Slightly disappointed when reading this, but I guess I shouldn't have expected more.
- sangnoir 4y ago
  > The fact that dev can have access to PROD logs just by himself unsupervised (even if for obviously good reasons from his/company point of view) is a big fat red flag What's wrong with granting engineers access to PII-less logs[1] by default? How does that compromise privacy? I'm willing to bet your bank differed on the following ways from Google in absolute numbers and per-engineer: * handled significantly less requests per second - at least 2 orders of magnitude - therefore lower log volumes * shipped less changes to prod per unit time, so fewer problems to investigate 1. No IP client address, raw session id or username

by jefftk 4y ago

saiya-jin 4y ago

So basically very primitive security compared to say how banks are handling client data in jurisdictions like Switzerland (one of my daily tasks). The fact that dev can have access to PROD logs just by himself unsupervised (even if for obviously good reasons from his/company point of view) is a big fat red flag. That all mentioned here clearly means google doesn't have data privacy at the core of their priorities and this won't change unless forced by fines/regulation, just like banks. Slightly disappointed when reading this, but I guess I shouldn't have expected more.

sangnoir 4y ago
> The fact that dev can have access to PROD logs just by himself unsupervised (even if for obviously good reasons from his/company point of view) is a big fat red flag What's wrong with granting engineers access to PII-less logs[1] by default? How does that compromise privacy? I'm willing to bet your bank differed on the following ways from Google in absolute numbers and per-engineer: * handled significantly less requests per second - at least 2 orders of magnitude - therefore lower log volumes * shipped less changes to prod per unit time, so fewer problems to investigate 1. No IP client address, raw session id or username