3 ms·

"the extension apparently can be configured to use a locally running instance of the server" - well that sounds needlessly complicated, I mean, the code could b

by rob74 4y ago

"the extension apparently can be configured to use a locally running instance of the server" - well that sounds needlessly complicated, I mean, the code could be implemented directly in the extension (I know, that's probably easier than it sounds if you are trying to maintain both the extension and the online version with the same code base). "you post publicly the json, which may or may not be ideal depending on what you're doing" - that's never ideal, it's just a smaller problem (if the JSON is publicly available anyway) or a much bigger problem (if it's sensitive personal data).

TeMPOraL 4y ago
> or a much bigger problem (if it's sensitive personal data). Personal data is a red herring. It's not the only thing that matters. For starters, using this at work with anything not explicitly public is likely a violation of your contract. In some contexts, it may even be gross misconduct or illegal and potentially exposing your employer to large fines. And, in general, I'd say a tool like this that comes without explicit, bold warning that it's shipping data off your machine, is just being rude.
- pletnes 4y ago
  I agree, mostly. But since when isn’t it obvious that posting data with a browser will send that data somewhere? And the users here are (from what I can tell) developers. I think this is a cool tool for public data and obviously I can’t paste private data sets on any public website, ever.
  - TeMPOraL 4y ago
    It's not obvious ever since some of those tools started to blur the line; there are plenty of such little utilities that do everything client-side, or at least claim so. I don't use them with anything but public data, as it takes one mistake or one silent update for the data to get shipped off my machine, but there's a whole generation of devs now who were growing up with webapps and online-first software, so I can easily see some developers making this mistake. Plus, they offer a VS Code extension. It's not so obvious that it's just the same public website underneath. Additionally, developers who understand those concerns kind of expect that other developers also understand them, and thus would not create an on-line tool like this in the first place.
  - simplotek 4y ago
    > I agree, mostly. But since when isn’t it obvious that posting data with a browser will send that data somewhere? I'd be surprised if anyone at all, specially developers, expects a browser to do anything other than transfer data to/from the internet.
- simplotek 4y ago
  > Personal data is a red herring. It's not the only thing that matters. For starters, using this at work with anything not explicitly public is likely a violation of your contract. (...) "Personal data" means the reddest of data. If a system collects and tracks personal information then it will be expected to collect highly sensitive information that is not personal. It makes absolutely no sense at all to try to downplay security problems by coming up with excuses such as "oh it's only leaking personal data".
  - TeMPOraL 4y ago
    I mean it the other way: I see the problems routinely downplayed with excuses like "it's not collecting personal data". See e.g. this, elsewhere in this thread: https://news.ycombinator.com/item?id=33784919 https://news.ycombinator.com/item?id=33784919. What does the linked Microsoft page say? Quoting: > The telemetry feature doesn't collect personal data, such as usernames or email addresses. It doesn't scan your code and doesn't extract project-level data, such as name, repository, or author. The data is sent securely to Microsoft servers using Azure Monitor technology, held under restricted access, and published under strict security controls from secure Azure Storage systems. I.e. "we're not collecting personal data, so you have nothing to worry about". Plus the classic "the data is sent securely to our servers", as if that was supposed to be reassuring. It's one of the most common types of distraction I see: focusing on how the data in-flight won't leak to third parties, and ignoring the fact that it's the first party that shouldn't be getting this data in the first place.
    - simplotek 4y ago
      > I mean it the other way: I see the problems routinely downplayed with excuses like "it's not collecting personal data". You claimed that personal data was a red herring. It is not. Shipping personal data is the worst possible scenario. It's unthinkable to try to make the case that a data leak is not serious because it's just personal data.
      - TeMPOraL 4y ago
        > You claimed that personal data was a red herring. It is not. Shipping personal data is the worst possible scenario. Which is exactly what makes it the red herring. Shipping personal data is one of the worst possible scenarios (I'd argue that, in corporate context, shipping data that's subject to export controls is worse, as it could easily get you fired, the company fined, and potentially land someone in jail) - which makes it a perfect distraction from all the other data that's being exfiltrated. "We're not collecting personal data" is the equivalent of putting a "doesn't contain asbestos" label on food packaging.

by rob74 4y ago

TeMPOraL 4y ago

> or a much bigger problem (if it's sensitive personal data). Personal data is a red herring. It's not the only thing that matters. For starters, using this at work with anything not explicitly public is likely a violation of your contract. In some contexts, it may even be gross misconduct or illegal and potentially exposing your employer to large fines. And, in general, I'd say a tool like this that comes without explicit, bold warning that it's shipping data off your machine, is just being rude.

pletnes 4y ago
I agree, mostly. But since when isn’t it obvious that posting data with a browser will send that data somewhere? And the users here are (from what I can tell) developers. I think this is a cool tool for public data and obviously I can’t paste private data sets on any public website, ever.
- TeMPOraL 4y ago
  It's not obvious ever since some of those tools started to blur the line; there are plenty of such little utilities that do everything client-side, or at least claim so. I don't use them with anything but public data, as it takes one mistake or one silent update for the data to get shipped off my machine, but there's a whole generation of devs now who were growing up with webapps and online-first software, so I can easily see some developers making this mistake. Plus, they offer a VS Code extension. It's not so obvious that it's just the same public website underneath. Additionally, developers who understand those concerns kind of expect that other developers also understand them, and thus would not create an on-line tool like this in the first place.
- simplotek 4y ago
  > I agree, mostly. But since when isn’t it obvious that posting data with a browser will send that data somewhere? I'd be surprised if anyone at all, specially developers, expects a browser to do anything other than transfer data to/from the internet.
simplotek 4y ago
> Personal data is a red herring. It's not the only thing that matters. For starters, using this at work with anything not explicitly public is likely a violation of your contract. (...) "Personal data" means the reddest of data. If a system collects and tracks personal information then it will be expected to collect highly sensitive information that is not personal. It makes absolutely no sense at all to try to downplay security problems by coming up with excuses such as "oh it's only leaking personal data".
- TeMPOraL 4y ago
  I mean it the other way: I see the problems routinely downplayed with excuses like "it's not collecting personal data". See e.g. this, elsewhere in this thread: https://news.ycombinator.com/item?id=33784919 https://news.ycombinator.com/item?id=33784919. What does the linked Microsoft page say? Quoting: > The telemetry feature doesn't collect personal data, such as usernames or email addresses. It doesn't scan your code and doesn't extract project-level data, such as name, repository, or author. The data is sent securely to Microsoft servers using Azure Monitor technology, held under restricted access, and published under strict security controls from secure Azure Storage systems. I.e. "we're not collecting personal data, so you have nothing to worry about". Plus the classic "the data is sent securely to our servers", as if that was supposed to be reassuring. It's one of the most common types of distraction I see: focusing on how the data in-flight won't leak to third parties, and ignoring the fact that it's the first party that shouldn't be getting this data in the first place.
  - simplotek 4y ago
    > I mean it the other way: I see the problems routinely downplayed with excuses like "it's not collecting personal data". You claimed that personal data was a red herring. It is not. Shipping personal data is the worst possible scenario. It's unthinkable to try to make the case that a data leak is not serious because it's just personal data.
    - TeMPOraL 4y ago
      > You claimed that personal data was a red herring. It is not. Shipping personal data is the worst possible scenario. Which is exactly what makes it the red herring. Shipping personal data is one of the worst possible scenarios (I'd argue that, in corporate context, shipping data that's subject to export controls is worse, as it could easily get you fired, the company fined, and potentially land someone in jail) - which makes it a perfect distraction from all the other data that's being exfiltrated. "We're not collecting personal data" is the equivalent of putting a "doesn't contain asbestos" label on food packaging.