4 ms·

So basically very primitive security compared to say how banks are handling client data in jurisdictions like Switzerland (one of my daily tasks). The fact that

So basically very primitive security compared to say how banks are handling client data in jurisdictions like Switzerland (one of my daily tasks). The fact that dev can have access to PROD logs just by himself unsupervised (even if for obviously good reasons from his/company point of view) is a big fat red flag. That all mentioned here clearly means google doesn't have data privacy at the core of their priorities and this won't change unless forced by fines/regulation, just like banks. Slightly disappointed when reading this, but I guess I shouldn't have expected more.

sangnoir 4y ago
> The fact that dev can have access to PROD logs just by himself unsupervised (even if for obviously good reasons from his/company point of view) is a big fat red flag What's wrong with granting engineers access to PII-less logs[1] by default? How does that compromise privacy? I'm willing to bet your bank differed on the following ways from Google in absolute numbers and per-engineer: * handled significantly less requests per second - at least 2 orders of magnitude - therefore lower log volumes * shipped less changes to prod per unit time, so fewer problems to investigate 1. No IP client address, raw session id or username