6 ms·

I won't comment on whether or not it was wise of them to post that information, except to say that plenty of other services have posted much more revealing data

by csallen 15y ago

I won't comment on whether or not it was wise of them to post that information, except to say that plenty of other services have posted much more revealing data without backlash of any kind. What I will question, however, is the assertion that looking at user filenames is suspect. That's easily fair game, and to claim otherwise is as ridiculous as claiming your dentist has no right to see your dental records, or your bank shouldn't know how much money is in your account. If you're that protective of your data, then it's up to you make wiser decisions. For starters, don't name your files SuperSecretPrivateInfo.doc and then give them to other people to store. Take a look at their extremely readable privacy policy. Send them an email with questions. If you care so much, take action and stop blaming other people for your own laziness.

huggyface 15y ago
Plenty of other services have shown indiscretion about their client's data. That doesn't validate this case, especially considering that many of us look to 37signals as essentially the poster boy of leading behaviors. We expect more from them. I am not trying to be argumentative but want to respond to a point you made as I think it is critically important for many HNers running or aspiring to run SaaS solutions- "If you're that protective of your data, then it's up to you make wiser decisions. For starters, don't name your files SuperSecretPrivateInfo.doc and then give them to other people to store." For real? I guarantee that 37signals would not sanction such a ridiculous statement. Most SaaS companies wouldn't touch such claims with a 40' pole. The industry lives and breathes on the feeling that the data is confidential. We're currently looking at some hosted helpdesk ticket solutions, and I can tell you that if there was even the slightest hint that the vendors casually browsed our data we would rethink the whole adventure.
- walkon 15y ago
  Cat.jpg from an unknown user of Basecamp. This tells us nothing about anyone. Get over it.
  - sunchild 15y ago
    It tells us that they looked at customer data, and that's a really, really big deal to people who are doing serious business that involves private information that is: (1) regulated by government, and/or (2) has significant commercial value. You can waive your arms and talk yourself blue in the face about your security protocols, but in the end it all comes down to trust. This kind of slip-up erodes that trust.
    - csallen 15y ago
      Erodes what trust exactly? You're assuming 37signals made an agreement ("we won't be able to see your filenames in our logs") that they intentionally never made, and then you're claiming they violated said non-existent agreement. If you're a company with super-sensitive data then it's on YOU to choose the appropriate place to store that data. There are services made explicitly for that sort of thing. It's absolutely ridiculous and irresponsible to require a certain level of privacy features, sign up for a service that doesn't have those privacy features, and then act as if they violated your trust.
      - sunchild 15y ago
        Actually, I agree with you. 37Signals is characteristically up-front in their security policy about not being an appropriate solution for sensitive data. That's why I don't use them for my own client work. I respect their decision not to take on that responsibility. Having said that, their security policy does suggest that customers expect some level of privacy. It's just bad form to publicly announce that you've been poking around the content of customer data as part of a fun blog post about metrics. Nobody is building classified weapons on Basecamp. If you say that Basecamp customers shouldn't expect any measure of privacy, I'll respectfully acknowledge that you might be correct about that.
        csallen 15y ago
        > That's why I don't use them for my own client work. I respect their decision not to take on that responsibility I respect that viewpoint immensely, and I wish more people would think like that. I think the main issue here is that the words "privacy" and "security" are so vague as to be meaningless. Consequently, people have mapped their own personal definitions on to them. For example, different people may care about different subsets of the following: - Do you use SSL when I transfer sensitive data to your servers? - How secure is your database? What do you use to protect stored data from hackers? - Do you share user data with third-parties? If so, do you anonymize it? - Do you prevent your own employees from accessing my data? - Do you have an SLA that guarantees I will be able to access my data the vast majority of the time? - Do you have measures in place to ensure my data is never accidentally deleted? Etc. The list could go on and on. If the customer is worried about any of the above (and sadly, most aren't), then she's in luck, because privacy policies and company email addresses are usually a click away on the web. I doubt I know anyone familiar with all the privacy and security processes employed by banks, doctors, financial aid offices, etc. Which is why it's confusing to see so many technically-savvy people up in arms about the name of a jpg file.
- csallen 15y ago
  >> I guarantee that 37signals would not sanction such a ridiculous statement. Most SaaS companies wouldn't touch such claims with a 40' pole. The industry lives and breathes on the feeling that the data is confidential. We're currently looking at some hosted helpdesk ticket solutions, and I can tell you that if there was even the slightest hint that the vendors casually browsed our data we would rethink the whole adventure. This encapsulates exactly why I think your position is naive. You're confusing reality with what-companies-say-to-make-money. It's as if you're completely unaware of the concept of marketing. You seem to be in a position to make purchasing decisions for your company, so let me explain: marketing is a tool used to make money. Again: MARKETING IS A TOOL USED TO MAKE MONEY. 37signals knows that people want to feel like their data is confidential. So they plaster pictures of locks and words like "safe", "secure", "24-hour surveillance", and "biometric locks" on their signup page. This is called marketing. It creates a feeling -- and nothing more -- so that people like you will click "Buy". It's like the airline commercials that depict flights as being comfortable and quiet. It's like oil company commercials that talk about how great it is to be green. It's like McDonald's commercials that show thin and healthy people eating Big Macs. It's smoke and mirrors, and you're falling for it. The reality is that you have a choice: belong to the 99% who simply want to buy into a "feeling", or belong to the 1% who read the privacy policy and ask questions. But if you're going to choose to be in the 99%, then do us all a favor and stop complaining about it.
  - huggyface 15y ago
    With all due respect, both of your responses have been completely obnoxious. You seem to be taking some unmerited grizzled vet position that might sell to children, but here it reads like a junior developer talking tough. See, we actually sell software as a service. Data security for our clients isn't marketing, it is the absolutely lifeblood of the company (just as it is a critical principal for this industry). 37signals knows that it was a foolish oversight to casually comment on content trawling, which is a good sign. Your ridiculous arguments in their favor do no one any good.
    - csallen 15y ago
      If you take issue with someone's argument, it's customary to point out the specific flaws and explain why you disagree. Simply slinging ad hominems and calling the argument ridiculous doesn't cut it. An example of how to respond: >> See, we actually sell software as a service. Great, I sell software as a service too. This is an irrelevant fact that doesn't make you or I any more or less correct. >> Data security for our clients isn't marketing, it is the absolutely lifeblood of the company "Data security" is a vague term that has as many different definitions as there are people to talk about it. Your mistake is in assuming that your definition (in which seeing a file name in a log is unethical behavior and/or a security breach) is the one and only correct definition. Many many web developers disagree with your definition. Secondly, security is marketing. You yourself have said, and I quote: "Even if you do casually trawl the data of your users, for the love of all things unholy don't talk about it." So not only do you recognize the importance of data security itself, but you recognize that even the appearance of data security (or lack thereof) can affect a company's bottom-line. From there, it should be easy to understand how companies use the appearance of security as a marketing technique. >> 37signals knows that it was a foolish oversight to casually comment on content trawling It seems to me that they've repeatedly defended their decision on both their blog and in this thread, and haven't removed the reference from their post. You're on your own, here.
- SomeOtherGuy 15y ago
  >considering that many of us look to 37signals as essentially the poster boy of leading behaviors Hopefully you guys learn from your mistake.
Someone 15y ago
"to claim otherwise is as ridiculous as claiming your dentist has no right to see your dental records, or your bank shouldn't know how much money is in your account." The issue is not that they looked at things, the issue is that they chose to tell the world about it.
- csallen 15y ago
  Are you serious? They merely stated that one of their MILLIONS of customers uploaded a picture of a cat. There was zero identifying information there. How can you call that an issue? Really: What is it here that makes you so upset? Would you be concerned if your dentist told you, "I filled a cavity last year"?
  - JeremyBanks 15y ago
    The debate is not over them posting the filename, it is over the fact that it is exposed to them.
    - bad_user 15y ago
      Uploaded data is always exposed, unless the user encrypts it before sending and doesn't give the decryption key to the company. Which of course is impractical for most people. If you think that doesn't happen, then you are naive - so yes, if you talk about your sex life on your GMail account, there's a chance some Google employee will see it. We can go back and forth on this all day long, but these are the facts: (1) your online data is not safe, unless you encrypt it yourself and (2) in this instance, no user identifiable information was given. At least 37signals never said that they don't have access to those files, like other companies would make you believe: http://www.businessinsider.com/dropbox-updates-security-terms-of-service-to-say-it-can-decrpyt-files-if-the-government-asks-it-to-2011-4?op=1 http://www.businessinsider.com/dropbox-updates-security-term...
      - csallen 15y ago
        > Uploaded data is always exposed, unless the user encrypts it before sending and doesn't give the decryption key to the company. Fucking BINGO. I'm always shocked how many people on HN don't understand this, considering the high percentage of techies and programmers.

by csallen 15y ago

huggyface 15y ago

Plenty of other services have shown indiscretion about their client's data. That doesn't validate this case, especially considering that many of us look to 37signals as essentially the poster boy of leading behaviors. We expect more from them. I am not trying to be argumentative but want to respond to a point you made as I think it is critically important for many HNers running or aspiring to run SaaS solutions- "If you're that protective of your data, then it's up to you make wiser decisions. For starters, don't name your files SuperSecretPrivateInfo.doc and then give them to other people to store." For real? I guarantee that 37signals would not sanction such a ridiculous statement. Most SaaS companies wouldn't touch such claims with a 40' pole. The industry lives and breathes on the feeling that the data is confidential. We're currently looking at some hosted helpdesk ticket solutions, and I can tell you that if there was even the slightest hint that the vendors casually browsed our data we would rethink the whole adventure.

walkon 15y ago
Cat.jpg from an unknown user of Basecamp. This tells us nothing about anyone. Get over it.
- sunchild 15y ago
  It tells us that they looked at customer data, and that's a really, really big deal to people who are doing serious business that involves private information that is: (1) regulated by government, and/or (2) has significant commercial value. You can waive your arms and talk yourself blue in the face about your security protocols, but in the end it all comes down to trust. This kind of slip-up erodes that trust.
  - csallen 15y ago
    Erodes what trust exactly? You're assuming 37signals made an agreement ("we won't be able to see your filenames in our logs") that they intentionally never made, and then you're claiming they violated said non-existent agreement. If you're a company with super-sensitive data then it's on YOU to choose the appropriate place to store that data. There are services made explicitly for that sort of thing. It's absolutely ridiculous and irresponsible to require a certain level of privacy features, sign up for a service that doesn't have those privacy features, and then act as if they violated your trust.
    - sunchild 15y ago
      Actually, I agree with you. 37Signals is characteristically up-front in their security policy about not being an appropriate solution for sensitive data. That's why I don't use them for my own client work. I respect their decision not to take on that responsibility. Having said that, their security policy does suggest that customers expect some level of privacy. It's just bad form to publicly announce that you've been poking around the content of customer data as part of a fun blog post about metrics. Nobody is building classified weapons on Basecamp. If you say that Basecamp customers shouldn't expect any measure of privacy, I'll respectfully acknowledge that you might be correct about that.
      - csallen 15y ago
        > That's why I don't use them for my own client work. I respect their decision not to take on that responsibility I respect that viewpoint immensely, and I wish more people would think like that. I think the main issue here is that the words "privacy" and "security" are so vague as to be meaningless. Consequently, people have mapped their own personal definitions on to them. For example, different people may care about different subsets of the following: - Do you use SSL when I transfer sensitive data to your servers? - How secure is your database? What do you use to protect stored data from hackers? - Do you share user data with third-parties? If so, do you anonymize it? - Do you prevent your own employees from accessing my data? - Do you have an SLA that guarantees I will be able to access my data the vast majority of the time? - Do you have measures in place to ensure my data is never accidentally deleted? Etc. The list could go on and on. If the customer is worried about any of the above (and sadly, most aren't), then she's in luck, because privacy policies and company email addresses are usually a click away on the web. I doubt I know anyone familiar with all the privacy and security processes employed by banks, doctors, financial aid offices, etc. Which is why it's confusing to see so many technically-savvy people up in arms about the name of a jpg file.
csallen 15y ago
>> I guarantee that 37signals would not sanction such a ridiculous statement. Most SaaS companies wouldn't touch such claims with a 40' pole. The industry lives and breathes on the feeling that the data is confidential. We're currently looking at some hosted helpdesk ticket solutions, and I can tell you that if there was even the slightest hint that the vendors casually browsed our data we would rethink the whole adventure. This encapsulates exactly why I think your position is naive. You're confusing reality with what-companies-say-to-make-money. It's as if you're completely unaware of the concept of marketing. You seem to be in a position to make purchasing decisions for your company, so let me explain: marketing is a tool used to make money. Again: MARKETING IS A TOOL USED TO MAKE MONEY. 37signals knows that people want to feel like their data is confidential. So they plaster pictures of locks and words like "safe", "secure", "24-hour surveillance", and "biometric locks" on their signup page. This is called marketing. It creates a feeling -- and nothing more -- so that people like you will click "Buy". It's like the airline commercials that depict flights as being comfortable and quiet. It's like oil company commercials that talk about how great it is to be green. It's like McDonald's commercials that show thin and healthy people eating Big Macs. It's smoke and mirrors, and you're falling for it. The reality is that you have a choice: belong to the 99% who simply want to buy into a "feeling", or belong to the 1% who read the privacy policy and ask questions. But if you're going to choose to be in the 99%, then do us all a favor and stop complaining about it.
- huggyface 15y ago
  With all due respect, both of your responses have been completely obnoxious. You seem to be taking some unmerited grizzled vet position that might sell to children, but here it reads like a junior developer talking tough. See, we actually sell software as a service. Data security for our clients isn't marketing, it is the absolutely lifeblood of the company (just as it is a critical principal for this industry). 37signals knows that it was a foolish oversight to casually comment on content trawling, which is a good sign. Your ridiculous arguments in their favor do no one any good.
  - csallen 15y ago
    If you take issue with someone's argument, it's customary to point out the specific flaws and explain why you disagree. Simply slinging ad hominems and calling the argument ridiculous doesn't cut it. An example of how to respond: >> See, we actually sell software as a service. Great, I sell software as a service too. This is an irrelevant fact that doesn't make you or I any more or less correct. >> Data security for our clients isn't marketing, it is the absolutely lifeblood of the company "Data security" is a vague term that has as many different definitions as there are people to talk about it. Your mistake is in assuming that your definition (in which seeing a file name in a log is unethical behavior and/or a security breach) is the one and only correct definition. Many many web developers disagree with your definition. Secondly, security is marketing. You yourself have said, and I quote: "Even if you do casually trawl the data of your users, for the love of all things unholy don't talk about it." So not only do you recognize the importance of data security itself, but you recognize that even the appearance of data security (or lack thereof) can affect a company's bottom-line. From there, it should be easy to understand how companies use the appearance of security as a marketing technique. >> 37signals knows that it was a foolish oversight to casually comment on content trawling It seems to me that they've repeatedly defended their decision on both their blog and in this thread, and haven't removed the reference from their post. You're on your own, here.
SomeOtherGuy 15y ago
>considering that many of us look to 37signals as essentially the poster boy of leading behaviors Hopefully you guys learn from your mistake.

Someone 15y ago

"to claim otherwise is as ridiculous as claiming your dentist has no right to see your dental records, or your bank shouldn't know how much money is in your account." The issue is not that they looked at things, the issue is that they chose to tell the world about it.

csallen 15y ago
Are you serious? They merely stated that one of their MILLIONS of customers uploaded a picture of a cat. There was zero identifying information there. How can you call that an issue? Really: What is it here that makes you so upset? Would you be concerned if your dentist told you, "I filled a cavity last year"?
- JeremyBanks 15y ago
  The debate is not over them posting the filename, it is over the fact that it is exposed to them.
  - bad_user 15y ago
    Uploaded data is always exposed, unless the user encrypts it before sending and doesn't give the decryption key to the company. Which of course is impractical for most people. If you think that doesn't happen, then you are naive - so yes, if you talk about your sex life on your GMail account, there's a chance some Google employee will see it. We can go back and forth on this all day long, but these are the facts: (1) your online data is not safe, unless you encrypt it yourself and (2) in this instance, no user identifiable information was given. At least 37signals never said that they don't have access to those files, like other companies would make you believe: http://www.businessinsider.com/dropbox-updates-security-terms-of-service-to-say-it-can-decrpyt-files-if-the-government-asks-it-to-2011-4?op=1 http://www.businessinsider.com/dropbox-updates-security-term...
    - csallen 15y ago
      > Uploaded data is always exposed, unless the user encrypts it before sending and doesn't give the decryption key to the company. Fucking BINGO. I'm always shocked how many people on HN don't understand this, considering the high percentage of techies and programmers.