20 ms·

Trust is Fragile

266 points by jaxonrice 15y ago

sunir 15y ago
I'm not really worried that 37signals are maliciously going through customer data, because I honestly believe they aren't. However, I'm disgusted by the number of people in this thread that justify the violation of customer privacy because it's what's normal. As an industry, we all face in our sales cycle the fear from customers that we will violate their privacy. Self-regulation by holding each other to account is the cheapest and best way to address the issue. While I would be stupid to believe software vendors don't look at my data because I know better, that isn't my expectation. It's not my expectation that my lawyer, my accountant, my doctor, my therapist, my social worker, or my librarian trade on or reveal or delve through my private information. That's why they as professionals are licensed and self-regulated by their professional colleges. As information professionals, we should act professionally with information as well. This is not crazy talk. We also see credit card numbers and personal information stolen every month. Last year over 100 million credit cards had to be reissued due to data theft. That's why the card industry created PCI compliance to self-regulate the industry, as imperfect as it may be.
- scrod 15y ago
  No, as information professionals, we should be building tools that enable users to store and manage their data privately, without asking them to trust some anonymous system administrator. Allowing them to become complacent and implicitly accepting of remotely-hosted services does users and society as a whole a great disservice.
flyosity 15y ago
If the 100,000,000th uploaded file was actually named Startup-Revenue-Forecast.ppt or 2011-Tax-Return.pdf I'm fairly certain that the name or contents wouldn't have been mentioned. I think the fact that it was cat.jpg spawned the idea of referencing it at all, and honestly if I were in their place I would have made the same joke. I think most people would have. But good on them for pulling a reverse Streisand Effect (http://en.wikipedia.org/wiki/Streisand_effect http://en.wikipedia.org/wiki/Streisand_effect) which frames the discussion in a positive light ("how can we change and do better?") instead of a negative one.
- deleted 15y ago
  [deleted]
  - zefhous 15y ago
    That's kind of the point of log files. As a contrived example, what if users suddenly couldn't upload files that ended in .jpeg instead of .jpg. How would they be able to diagnose the problem if they didn't store data about image filenames? Obviously they filter passwords and other sensitive data, but I think they should rightly have access to whatever they judge necessary to do their job. There will always be people who have the ability to access data they are not supposed to, but in the end it comes down to who you will trust with your data. To me, the transparency and contributions of 37signals qualifies them to have that trust. With that, I trust them to make good decisions about who they hire and what they store in their log files.
    - teaspoon 15y ago
      I wonder if parent was merely advocating obfuscating sensitive data so that engineers don't accidentally see things like "Downsizing-2012.xls". As long as the obfuscation is reversible, the data is still there for those who need it. Of course, encryption per se is overkill for that. Something like ROT13 would do the trick.
      - Silhouette 15y ago
        If you're going to obfuscate reversibly, it is much better practice to use strong obfuscation and log (irreversibly) any time the raw data is accessed so there is an audit trail.
    - foreverbanned 15y ago
      I would be happy if just the filename (not the extension) is at least obfuscated. I can trust someone and still not be comfortable if he accidentally see that I uploaded "how to file a divorce.pdf" for example.
dugmartin 15y ago
Well done. I wish more companies would own up to mistakes instead of weaseling out of them. To DHH if you are reading these comments: Since 37signals is such an industry leader why not take this opportunity to release a "trust manifesto" that other SAAS companies can learn from instead of just updating your privacy policy? Present it as a few straightforward bullet points instead of paragraphs of legalese.
- dhh 15y ago
  I'd be very happy if we come up with a good privacy policy that it could help others revisit theirs. Most policies, including ours, talk about shit people generally stopped caring about 5 years ago (what do you do with my COOKIES?!?!). These days people care much more about the privacy of the data that they actively share through uploads etc and much less about the tracking. At least on apps like ours.
untog 15y ago
While the tone of the post is fantastic, I can't quite believe that anyone would be as offended as they suggest. I would like to believe that people can apply common sense to this situation and realise that they disclosed 'cat.jpg' exactly because the name was entirely inoffensive and anonymous.
- jasonlotito 15y ago
  You miss the point. The point is with regards to privacy. If I'm paying them for their service, and I upload files, I can limit who sees them. If that can be circumvented, this is disconcerting. What if I had a file named "How to beat 37Signals.docx"? Or "Next iPad Specs - Official.pages" uploaded? And then someone reviewing the logs happens to see that. And they get curious. The idea isn't that cat.jpg is bad. It's that over at 37Signals, someone was browsing the logs, reviewing the file uploads, and did see "2011 Financing Report for X Public Company - Unreleased" or something akin to that. I understand your point of view. But the people offended by this are in the right. It's not what happened, but that it happened, and what it shows.
  - dhh 15y ago
    I agree, Jason. While it's unavoidable that we at times will see things through log files in order to ensure the performance and uptime of the system, it certainly shouldn't be for these causes and it double certainly shouldn't be in order to reveal anything publicly.
  - untog 15y ago
    The idea isn't that cat.jpg is bad. It's that over at 37Signals, someone was browsing the logs, reviewing the file uploads Rather, they did "SELECT filename WHERE row_num = 100000000". Honestly, if you're concerned about something like this then you should not be using a third party solution to store your files. Of course 37 Signals can look at the names of the files you are storing- they could probably hide that information from themselves, but then they'll get a support request saying "we can't open file-x.jpg" and they won't be able to do anything about it.
3pt14159 15y ago
Honestly, people are decisional if they don't think this happens everywhere. I've seen tens of thousands of pieces of private data across all the companies I've contracted for. Data guys need to explore, they need to learn what types of customers use what type of features and why. Heck, I talked to a guy online (didn't know his real identity, or I would call him out personally) that wrote a script that automatically checked his employer's database against outstanding warrants in the US (fuzzy matching first name, last name, city, age) and pulled in 2 to 3 times his salary just by the rewards. That is how bad some people are. What you can trust is that a company almost certainly won't intentionally leak your data to the public, but rest assured that they do flip through it. Some awesome companies will obfuscate the email addresses or company names so that it is much harder to back calculate who owns what, but honestly unless a company is promising full encryption on their side I would just assume they can see everything. If you want real privacy use encryption (or some other zero trust protocol) it really isn't that hard to use.
- dhh 15y ago
  I don't think it has to be this way. We often run internal reports on usage of certain features, but it's always aggregated, and never looks at the individual data. I feel bad enough looking at a customer's account when they've specifically asked me to do so from a support request. I would certainly terminate any account with a company that willfully was reading my private data and opening files for the mere sport of it.
- sunir 15y ago
  There's this small, harmless incident from 37signals and then there is this attitude. Some questions: * Should it happen everywhere? * As a data guy, do you have professional obligations to uphold the privacy policy and operate within the law? * What are the mechanisms available to the market and the industry to prevent the deterioration of customers' trust with us?
  - 3pt14159 15y ago
    > Should it happen everywhere? Yes. The market has spoken. People find terms of use acceptable, which includes looking at personal data. The alternative is to restrict your data team to the point where conversions would be half or a third of what they are. Are most people willing to pay triple just to remove the off chance that some random data guy comes across their info? Probably not. > As a data guy, do you have professional obligations to uphold the privacy policy and operate within the law? Any person, employee or not, professional or not, has obligations to uphold just laws; certainly including measures of privacy. Here is a typical privacy policy: "We use personal information in the file we maintain about you, and other information we obtain from your current and past activities on the Site, to provide to you the services offered by the Site; resolve service and billing disputes; troubleshoot problems; bill any amounts due from you; measure consumer interest in our products and services, inform you about online and offline offers, products, services, events and updates; deliver information to you that, in some cases, is relevant to your interests, such as product news; customize your experience; detect and protect us against error, fraud and other criminal activity; enforce our Terms of Use; provide you with system or administrative messages, and as otherwise described to you at the time of collection. On occasion we use email address or other contact information to contact our Users to ask them for their input on our services, and to forward to them media opportunities. We may also use personal information about you to improve our marketing and promotional efforts, to analyze Site usage, to improve our content and product offerings, and to customize the Site's content, layout, and services. These uses improve the Site and better tailor it to meet your needs, so as to provide you with a smooth, efficient, safe and customized experience while using the Site." That bottom paragraph is fully communicating the nature of the relationship. Outside any law that would render the above unlawful, it is well within the law for an employee to "SELECT * FROM users WHERE created_at > 2010-02-01" or to "SELECT * FROM todos JOIN users ON todos.user_id = users.id WHERE users.profession = 'developer'". There are perfectly valid reasons to do these types of things. Anti-fraud measures, site optimization, etc. > What are the mechanisms available to the market and the industry to prevent the deterioration of customers' trust with us? This is a problem of mismatched expectations and priorities. It's a lot like politics. In an ideal world a politician would be able to say something like 'I think the American people acted irresponsibly financing homes and that is a good part of the reason for the financial crisis' because it is the truth and it would help people in the long run to hear it, as well as help any policy formation in response to it. But practically they can blame others and get away with it. Unless the industry is willing to educate politicians, site users, etc. There is no reason to go out shouting that this happens. It's already in the terms of use and the privacy policy. Do you think people want to know what Air Miles does with their data? The only mechanism besides general silence (as well as inclusion in the privacy policy and/or terms of use) would be full, 100% truth when asked. But why make an issue of it? The netizens don't really care. If they did there would be competition around this angle of the market. dhh hides behind: "I don't think it has to be this way. We often run internal reports on usage of certain features, but it's always aggregated, and never looks at the individual data. I feel bad enough looking at a customer's account when they've specifically asked me to do so from a support request. I would certainly terminate any account with a company that willfully was reading my private data and opening files for the mere sport of it." That carefully worded bullshit. Internal reports are not exploring. Internal reports are what you show at the monthly marketing or board meeting. C_Os get internal reports. Data guys test recommendation models. Data guys find out the interesting patterns to include in custom reports. Also, His last paragraph is ridiculous. Obviously we don't read data for sport. In fact it is boring. You go through data for trends.
billpatrianakos 15y ago
People really got that upset over them knowing the name of the 100 millionth file? They're not going to look at the log anymore? I don't know how they operate on the server side of things but if no one is going to look at logs anymore then why have the log at all? I look up to 37Signals a lot but I think they were a little too apologetic this time. Why not apologize but explain that the log files tell you basically nothing about the contents of your files? How does anyone not make the connection between the cat joke and the file named cat.jpg? I mean, they even spelled it out in the original post! I'm not trying to be critical, I'm just kind of left wondering how something like this offended a single person. Weird.
- tangus 15y ago
  Keep in mind that the original post said "it was the picture of a cat". It implied they looked at the content of the file.
  - billswift 15y ago
    No they didn't. They talked about how sharing pictures of cats was a running internet joke. All they said about that particular file was that it was named cat.jpg.
    - scott_s 15y ago
      From http://37signals.com/svn/posts/3076-i-heard-you-like-numbers http://37signals.com/svn/posts/3076-i-heard-you-like-numbers: And a Basecamp user uploaded the 100,000,000th file (It was a picture of a cat!) In the comments, they clarify that it was called cat.jpg, and that's how they knew it was a picture of a cat.
  - billpatrianakos 15y ago
    Yeah, I remember that. But they also mentioned the file name too so it wasn't really a secret as to how they assumed what was in it. I very rarely go into conspiracy land but now I'm wondering where the uproar came from? Does anyone know who started this backlash? Was it a group or an individual? I ask because for a fleeting moment I wondered if a competitor took their original post and used it as an opportunity to knock 37Signals down a couple of notches. I may be totally off in the deep end with that thought, however.
sscheper 15y ago
Sometimes I feel like 37signals should change the name of their blog to "Much Ado About Nothing"
torontos 15y ago
HN Discussion of the incident a few days ago: http://news.ycombinator.com/item?id=3456819 http://news.ycombinator.com/item?id=3456819
davidw 15y ago
FWIW, there's an Italian startup called Iubenda trying to do something around privacy policies, so that it's easy to have a good one: http://www.iubenda.com/en http://www.iubenda.com/en
lukev 15y ago
The real lesson here is that if you really want your data to be private, you have to take responsibility for encrypting it or not uploading it anywhere. Even in the best-case scenario, at least some employees can access data as part of their jobs. This has been true of every job I've ever worked at.
tomkin 15y ago
37signals really doesn't want to be the bad guy. They're not. And this whole thing is ridiculous. If you were to evaluate 37signals on a 0-to-9 scale, based on how "evil" they are, you might give them a 0 or a 1. What if the scale went the other way as well? There isn't just evil, there's apologist. And it too can lay the groundwork for unfruitful results. 37signals' target demo is smart, well-to-do, logical. They shouldn't have to apologize. As their logical demo, we should know better. We know that if the filename was MyBossIsAnAsshole.docx or even MyWeddingPhoto.jpg that 37signals wouldn't have had to think for a second on the appropriate thing to do. As logical thinkers, we know why cat.jpg is funny as it pertains to our demographic. We know that MyWeddingPhoto.jpg wouldn't be funny. The whole burn 'em at the stake routine is asinine.
dpritchett 15y ago
I'm impressed that this mea culpa ended with a reasonably tasteful plug for the next 37s product release.
tghw 15y ago
This is why our policy at Fog Creek is to explicitly get permission from users before accessing their data. It's enforced by the sys admins (which we screen more extensively during the hiring process), who give temporary access to the person who needs it once the user has given their permission. When we're done, the sys admins remove access to that account again. It's a pretty painless process (we have snippets to ask permission from the user and shortcuts to request access from the sys admins) and it helps prevent both willful and accidental leakage or modification of our users' data.
- jonknee 15y ago
  Is there anything stopping the sys admin from doing the snooping?
  - tghw 15y ago
    Ultimately, someone needs to have the keys, and they do, which is why they go through additional screening. Since there's a whole team, they would either have to collude or cover their tracks very well. Considering a major part of their job is keeping our data and our users' data safe, a breach like that would not be taken lightly. So ultimately, it may be possible for one to snoop on our users, but it's much easier to trust (and keep tabs on) a small, well screened team than the entire company. Speaking personally, I can say that I would (and do) absolutely trust my own data to our sys admins.
    - sunchild 15y ago
      It doesn't really matter if you put someone through extensive interviews and then hire them, or if you use a third party who can't afford to lose its reputation, it all comes back to trust, which is why David's post is so on-point.
    - dhh 15y ago
      What additional screening do you put your system administrators through? Are we talking security clearances and background checks? Definitely curious to hear the specifics.
aangjie 15y ago
Reminds me of my somethin' my ex-colleague came up with in a discussion over lunch.. Trust is a complex variable. it has some real part/value that both the parties involved can be secure about, and an(two??) imaginary part where both the parties have a guess about what else they will/can trust the other about.. In this case, i think the filenames would count as imaginary part. Not to imply, it's not private, but would be surprised if it had been in the terms of service..
nopal 15y ago
I think this post highlights a missing component of the IT ecosystem -- a professional code of ethics. Many companies, especially large ones with lots of lawyers, have developed policies and procedures relating to what's acceptable and what's not. But most smaller companies and startups don't seem to have time to formulate these policies. A professional code of ethics, specially with regard to privacy and user data, would be very useful. Right now, most developers operate on a "do unto others" philosophy. While this may be good intentioned and work well a lot of the time, it's highly subjective -- as evidenced by the comments on this thread.
shasta 15y ago
Seems reasonable, but can adults stop boasting that they're behaving like adults? Unless 37 signals is being run by children, in which case: good job kids.
screwt 15y ago
There is a strong case to be made that 37signals should have access to this data for debugging purposes or similar. And as others have suggested, customers trusting 37signals with data should expect this at some level, unless the customers are encrypting everything at their end first. But should everyone in the company have that level of access, or should access be restricted to the minimum necessary? What I don't see in others comments here (except tghw's [1]) is any recognition of that. It's all very well saying you want to give your devs access, and that you can be trusted, but over time and as your company grows you're exposing yourself to the risk of a rogue operator. And it only takes one person to do something bad to severely damage the trust your customers hold in you. It's a balance, to be sure, but I'm inclined to think a blanket "we trust our devs, so they have the access they need" could be exposing yourself to a large risk you don't need. [1] http://news.ycombinator.org/item?id=3471338 http://news.ycombinator.org/item?id=3471338
sunchild 15y ago
I was one of the people who was vocal about this being a serious gaffe when the post went up. This is the absolutely the best response conceivable. Bravo!
scrozier 15y ago
This post and comments has made me reconsider the word "trust" entirely. "Trust" is an emotion-laden, rhetorical word used by a someone who wants you to do something. "Just trust us." Trust is not fragile, trust is an illusion. Replace the verb "trust" with the word "assume" or "take a calculated risk" and you're closer to reality. Instead of "trust us," how about, "Look at our record. Note that we have had not a single incident of data disclosure in 6 years. Decide for yourself if it is likely that we'll have one now, with your data." Instead of "trust us," how about, "Think about our business: imagine the consequences if we were found to have looked at our customers' data, and see if that disincentive allays your concerns sufficiently." Instead of "trust us," how about, "Here are the ways we are protecting your data. Consider whether they meet your requirements or not." I'm voting "trust" off the island.
dennisgorelik 15y ago
I routinely look into my customers' data and didn't really have second thoughts about it. I even automated process of looking into customer's data. The main goal is to catch spam and scam and delete such accounts. May be it's specific of my business (job board), but isn't scam and spam is risk in any business to at least a certain extent?
- BadassFractal 15y ago
  You can do whatever you want as long as it's explicitly stated in the EULA, hopefully that's the case in your situation.
BadassFractal 15y ago
At any large organization with million of customers and public opinion affecting stocks, even mentioning to the that random people on the dev team have access to customer data can be pretty career altering. The fact that you're even looking at confidential information is generally highly frowned upon. What if Mint.com celebrated their 1 "billionth" processed transaction by posting what it was? Wouldn't that cause outrage?
8ig8 15y ago
I'm not too troubled by employees reading file names in the logs, but for some reason it bugs me that the apology post included a promotion (a link) for "Basecamp Next." In this context it didn't seem necessary.
joshontheweb 15y ago
When I was in college and working for a bootstrapped startup I was handed an unprotected thumb drive with an excel spreadsheet containing all the credit card numbers, expiration dates, address, social security numbers, etc of all the clients (thousands) and told to take it home for when I was working out of the office. I was too ignorant to realize how terrible, and I'm sure illegal this was. Of course I never abused it but it definitely makes me wary of my data these days. I imagine this happens much more than people think. Don't worry, the company I speak of was localized and failed now I think. It's prudent to cancel your cards once or twice a year and be careful who you trust. Some companies value convenience over security and put way too much trust in the employees.

266 points by jaxonrice 15y ago

sunir 15y ago

I'm not really worried that 37signals are maliciously going through customer data, because I honestly believe they aren't. However, I'm disgusted by the number of people in this thread that justify the violation of customer privacy because it's what's normal. As an industry, we all face in our sales cycle the fear from customers that we will violate their privacy. Self-regulation by holding each other to account is the cheapest and best way to address the issue. While I would be stupid to believe software vendors don't look at my data because I know better, that isn't my expectation. It's not my expectation that my lawyer, my accountant, my doctor, my therapist, my social worker, or my librarian trade on or reveal or delve through my private information. That's why they as professionals are licensed and self-regulated by their professional colleges. As information professionals, we should act professionally with information as well. This is not crazy talk. We also see credit card numbers and personal information stolen every month. Last year over 100 million credit cards had to be reissued due to data theft. That's why the card industry created PCI compliance to self-regulate the industry, as imperfect as it may be.

scrod 15y ago
No, as information professionals, we should be building tools that enable users to store and manage their data privately, without asking them to trust some anonymous system administrator. Allowing them to become complacent and implicitly accepting of remotely-hosted services does users and society as a whole a great disservice.

flyosity 15y ago

If the 100,000,000th uploaded file was actually named Startup-Revenue-Forecast.ppt or 2011-Tax-Return.pdf I'm fairly certain that the name or contents wouldn't have been mentioned. I think the fact that it was cat.jpg spawned the idea of referencing it at all, and honestly if I were in their place I would have made the same joke. I think most people would have. But good on them for pulling a reverse Streisand Effect (http://en.wikipedia.org/wiki/Streisand_effect http://en.wikipedia.org/wiki/Streisand_effect) which frames the discussion in a positive light ("how can we change and do better?") instead of a negative one.

deleted 15y ago
[deleted]
- zefhous 15y ago
  That's kind of the point of log files. As a contrived example, what if users suddenly couldn't upload files that ended in .jpeg instead of .jpg. How would they be able to diagnose the problem if they didn't store data about image filenames? Obviously they filter passwords and other sensitive data, but I think they should rightly have access to whatever they judge necessary to do their job. There will always be people who have the ability to access data they are not supposed to, but in the end it comes down to who you will trust with your data. To me, the transparency and contributions of 37signals qualifies them to have that trust. With that, I trust them to make good decisions about who they hire and what they store in their log files.
  - teaspoon 15y ago
    I wonder if parent was merely advocating obfuscating sensitive data so that engineers don't accidentally see things like "Downsizing-2012.xls". As long as the obfuscation is reversible, the data is still there for those who need it. Of course, encryption per se is overkill for that. Something like ROT13 would do the trick.
    - Silhouette 15y ago
      If you're going to obfuscate reversibly, it is much better practice to use strong obfuscation and log (irreversibly) any time the raw data is accessed so there is an audit trail.
  - foreverbanned 15y ago
    I would be happy if just the filename (not the extension) is at least obfuscated. I can trust someone and still not be comfortable if he accidentally see that I uploaded "how to file a divorce.pdf" for example.

dugmartin 15y ago

Well done. I wish more companies would own up to mistakes instead of weaseling out of them. To DHH if you are reading these comments: Since 37signals is such an industry leader why not take this opportunity to release a "trust manifesto" that other SAAS companies can learn from instead of just updating your privacy policy? Present it as a few straightforward bullet points instead of paragraphs of legalese.

dhh 15y ago
I'd be very happy if we come up with a good privacy policy that it could help others revisit theirs. Most policies, including ours, talk about shit people generally stopped caring about 5 years ago (what do you do with my COOKIES?!?!). These days people care much more about the privacy of the data that they actively share through uploads etc and much less about the tracking. At least on apps like ours.

untog 15y ago

While the tone of the post is fantastic, I can't quite believe that anyone would be as offended as they suggest. I would like to believe that people can apply common sense to this situation and realise that they disclosed 'cat.jpg' exactly because the name was entirely inoffensive and anonymous.

jasonlotito 15y ago
You miss the point. The point is with regards to privacy. If I'm paying them for their service, and I upload files, I can limit who sees them. If that can be circumvented, this is disconcerting. What if I had a file named "How to beat 37Signals.docx"? Or "Next iPad Specs - Official.pages" uploaded? And then someone reviewing the logs happens to see that. And they get curious. The idea isn't that cat.jpg is bad. It's that over at 37Signals, someone was browsing the logs, reviewing the file uploads, and did see "2011 Financing Report for X Public Company - Unreleased" or something akin to that. I understand your point of view. But the people offended by this are in the right. It's not what happened, but that it happened, and what it shows.
- dhh 15y ago
  I agree, Jason. While it's unavoidable that we at times will see things through log files in order to ensure the performance and uptime of the system, it certainly shouldn't be for these causes and it double certainly shouldn't be in order to reveal anything publicly.
- untog 15y ago
  The idea isn't that cat.jpg is bad. It's that over at 37Signals, someone was browsing the logs, reviewing the file uploads Rather, they did "SELECT filename WHERE row_num = 100000000". Honestly, if you're concerned about something like this then you should not be using a third party solution to store your files. Of course 37 Signals can look at the names of the files you are storing- they could probably hide that information from themselves, but then they'll get a support request saying "we can't open file-x.jpg" and they won't be able to do anything about it.

3pt14159 15y ago

Honestly, people are decisional if they don't think this happens everywhere. I've seen tens of thousands of pieces of private data across all the companies I've contracted for. Data guys need to explore, they need to learn what types of customers use what type of features and why. Heck, I talked to a guy online (didn't know his real identity, or I would call him out personally) that wrote a script that automatically checked his employer's database against outstanding warrants in the US (fuzzy matching first name, last name, city, age) and pulled in 2 to 3 times his salary just by the rewards. That is how bad some people are. What you can trust is that a company almost certainly won't intentionally leak your data to the public, but rest assured that they do flip through it. Some awesome companies will obfuscate the email addresses or company names so that it is much harder to back calculate who owns what, but honestly unless a company is promising full encryption on their side I would just assume they can see everything. If you want real privacy use encryption (or some other zero trust protocol) it really isn't that hard to use.

dhh 15y ago
I don't think it has to be this way. We often run internal reports on usage of certain features, but it's always aggregated, and never looks at the individual data. I feel bad enough looking at a customer's account when they've specifically asked me to do so from a support request. I would certainly terminate any account with a company that willfully was reading my private data and opening files for the mere sport of it.
sunir 15y ago
There's this small, harmless incident from 37signals and then there is this attitude. Some questions: * Should it happen everywhere? * As a data guy, do you have professional obligations to uphold the privacy policy and operate within the law? * What are the mechanisms available to the market and the industry to prevent the deterioration of customers' trust with us?
- 3pt14159 15y ago
  > Should it happen everywhere? Yes. The market has spoken. People find terms of use acceptable, which includes looking at personal data. The alternative is to restrict your data team to the point where conversions would be half or a third of what they are. Are most people willing to pay triple just to remove the off chance that some random data guy comes across their info? Probably not. > As a data guy, do you have professional obligations to uphold the privacy policy and operate within the law? Any person, employee or not, professional or not, has obligations to uphold just laws; certainly including measures of privacy. Here is a typical privacy policy: "We use personal information in the file we maintain about you, and other information we obtain from your current and past activities on the Site, to provide to you the services offered by the Site; resolve service and billing disputes; troubleshoot problems; bill any amounts due from you; measure consumer interest in our products and services, inform you about online and offline offers, products, services, events and updates; deliver information to you that, in some cases, is relevant to your interests, such as product news; customize your experience; detect and protect us against error, fraud and other criminal activity; enforce our Terms of Use; provide you with system or administrative messages, and as otherwise described to you at the time of collection. On occasion we use email address or other contact information to contact our Users to ask them for their input on our services, and to forward to them media opportunities. We may also use personal information about you to improve our marketing and promotional efforts, to analyze Site usage, to improve our content and product offerings, and to customize the Site's content, layout, and services. These uses improve the Site and better tailor it to meet your needs, so as to provide you with a smooth, efficient, safe and customized experience while using the Site." That bottom paragraph is fully communicating the nature of the relationship. Outside any law that would render the above unlawful, it is well within the law for an employee to "SELECT * FROM users WHERE created_at > 2010-02-01" or to "SELECT * FROM todos JOIN users ON todos.user_id = users.id WHERE users.profession = 'developer'". There are perfectly valid reasons to do these types of things. Anti-fraud measures, site optimization, etc. > What are the mechanisms available to the market and the industry to prevent the deterioration of customers' trust with us? This is a problem of mismatched expectations and priorities. It's a lot like politics. In an ideal world a politician would be able to say something like 'I think the American people acted irresponsibly financing homes and that is a good part of the reason for the financial crisis' because it is the truth and it would help people in the long run to hear it, as well as help any policy formation in response to it. But practically they can blame others and get away with it. Unless the industry is willing to educate politicians, site users, etc. There is no reason to go out shouting that this happens. It's already in the terms of use and the privacy policy. Do you think people want to know what Air Miles does with their data? The only mechanism besides general silence (as well as inclusion in the privacy policy and/or terms of use) would be full, 100% truth when asked. But why make an issue of it? The netizens don't really care. If they did there would be competition around this angle of the market. dhh hides behind: "I don't think it has to be this way. We often run internal reports on usage of certain features, but it's always aggregated, and never looks at the individual data. I feel bad enough looking at a customer's account when they've specifically asked me to do so from a support request. I would certainly terminate any account with a company that willfully was reading my private data and opening files for the mere sport of it." That carefully worded bullshit. Internal reports are not exploring. Internal reports are what you show at the monthly marketing or board meeting. C_Os get internal reports. Data guys test recommendation models. Data guys find out the interesting patterns to include in custom reports. Also, His last paragraph is ridiculous. Obviously we don't read data for sport. In fact it is boring. You go through data for trends.

billpatrianakos 15y ago

People really got that upset over them knowing the name of the 100 millionth file? They're not going to look at the log anymore? I don't know how they operate on the server side of things but if no one is going to look at logs anymore then why have the log at all? I look up to 37Signals a lot but I think they were a little too apologetic this time. Why not apologize but explain that the log files tell you basically nothing about the contents of your files? How does anyone not make the connection between the cat joke and the file named cat.jpg? I mean, they even spelled it out in the original post! I'm not trying to be critical, I'm just kind of left wondering how something like this offended a single person. Weird.

tangus 15y ago
Keep in mind that the original post said "it was the picture of a cat". It implied they looked at the content of the file.
- billswift 15y ago
  No they didn't. They talked about how sharing pictures of cats was a running internet joke. All they said about that particular file was that it was named cat.jpg.
  - scott_s 15y ago
    From http://37signals.com/svn/posts/3076-i-heard-you-like-numbers http://37signals.com/svn/posts/3076-i-heard-you-like-numbers: And a Basecamp user uploaded the 100,000,000th file (It was a picture of a cat!) In the comments, they clarify that it was called cat.jpg, and that's how they knew it was a picture of a cat.
- billpatrianakos 15y ago
  Yeah, I remember that. But they also mentioned the file name too so it wasn't really a secret as to how they assumed what was in it. I very rarely go into conspiracy land but now I'm wondering where the uproar came from? Does anyone know who started this backlash? Was it a group or an individual? I ask because for a fleeting moment I wondered if a competitor took their original post and used it as an opportunity to knock 37Signals down a couple of notches. I may be totally off in the deep end with that thought, however.

sscheper 15y ago

Sometimes I feel like 37signals should change the name of their blog to "Much Ado About Nothing"

torontos 15y ago

HN Discussion of the incident a few days ago: http://news.ycombinator.com/item?id=3456819 http://news.ycombinator.com/item?id=3456819

davidw 15y ago

FWIW, there's an Italian startup called Iubenda trying to do something around privacy policies, so that it's easy to have a good one: http://www.iubenda.com/en http://www.iubenda.com/en

lukev 15y ago

The real lesson here is that if you really want your data to be private, you have to take responsibility for encrypting it or not uploading it anywhere. Even in the best-case scenario, at least some employees can access data as part of their jobs. This has been true of every job I've ever worked at.

tomkin 15y ago

37signals really doesn't want to be the bad guy. They're not. And this whole thing is ridiculous. If you were to evaluate 37signals on a 0-to-9 scale, based on how "evil" they are, you might give them a 0 or a 1. What if the scale went the other way as well? There isn't just evil, there's apologist. And it too can lay the groundwork for unfruitful results. 37signals' target demo is smart, well-to-do, logical. They shouldn't have to apologize. As their logical demo, we should know better. We know that if the filename was MyBossIsAnAsshole.docx or even MyWeddingPhoto.jpg that 37signals wouldn't have had to think for a second on the appropriate thing to do. As logical thinkers, we know why cat.jpg is funny as it pertains to our demographic. We know that MyWeddingPhoto.jpg wouldn't be funny. The whole burn 'em at the stake routine is asinine.

dpritchett 15y ago

I'm impressed that this mea culpa ended with a reasonably tasteful plug for the next 37s product release.

tghw 15y ago

This is why our policy at Fog Creek is to explicitly get permission from users before accessing their data. It's enforced by the sys admins (which we screen more extensively during the hiring process), who give temporary access to the person who needs it once the user has given their permission. When we're done, the sys admins remove access to that account again. It's a pretty painless process (we have snippets to ask permission from the user and shortcuts to request access from the sys admins) and it helps prevent both willful and accidental leakage or modification of our users' data.

jonknee 15y ago
Is there anything stopping the sys admin from doing the snooping?
- tghw 15y ago
  Ultimately, someone needs to have the keys, and they do, which is why they go through additional screening. Since there's a whole team, they would either have to collude or cover their tracks very well. Considering a major part of their job is keeping our data and our users' data safe, a breach like that would not be taken lightly. So ultimately, it may be possible for one to snoop on our users, but it's much easier to trust (and keep tabs on) a small, well screened team than the entire company. Speaking personally, I can say that I would (and do) absolutely trust my own data to our sys admins.
  - sunchild 15y ago
    It doesn't really matter if you put someone through extensive interviews and then hire them, or if you use a third party who can't afford to lose its reputation, it all comes back to trust, which is why David's post is so on-point.
  - dhh 15y ago
    What additional screening do you put your system administrators through? Are we talking security clearances and background checks? Definitely curious to hear the specifics.

aangjie 15y ago

Reminds me of my somethin' my ex-colleague came up with in a discussion over lunch.. Trust is a complex variable. it has some real part/value that both the parties involved can be secure about, and an(two??) imaginary part where both the parties have a guess about what else they will/can trust the other about.. In this case, i think the filenames would count as imaginary part. Not to imply, it's not private, but would be surprised if it had been in the terms of service..

nopal 15y ago

I think this post highlights a missing component of the IT ecosystem -- a professional code of ethics. Many companies, especially large ones with lots of lawyers, have developed policies and procedures relating to what's acceptable and what's not. But most smaller companies and startups don't seem to have time to formulate these policies. A professional code of ethics, specially with regard to privacy and user data, would be very useful. Right now, most developers operate on a "do unto others" philosophy. While this may be good intentioned and work well a lot of the time, it's highly subjective -- as evidenced by the comments on this thread.

shasta 15y ago

Seems reasonable, but can adults stop boasting that they're behaving like adults? Unless 37 signals is being run by children, in which case: good job kids.

screwt 15y ago

There is a strong case to be made that 37signals should have access to this data for debugging purposes or similar. And as others have suggested, customers trusting 37signals with data should expect this at some level, unless the customers are encrypting everything at their end first. But should everyone in the company have that level of access, or should access be restricted to the minimum necessary? What I don't see in others comments here (except tghw's [1]) is any recognition of that. It's all very well saying you want to give your devs access, and that you can be trusted, but over time and as your company grows you're exposing yourself to the risk of a rogue operator. And it only takes one person to do something bad to severely damage the trust your customers hold in you. It's a balance, to be sure, but I'm inclined to think a blanket "we trust our devs, so they have the access they need" could be exposing yourself to a large risk you don't need. [1] http://news.ycombinator.org/item?id=3471338 http://news.ycombinator.org/item?id=3471338

sunchild 15y ago

I was one of the people who was vocal about this being a serious gaffe when the post went up. This is the absolutely the best response conceivable. Bravo!

scrozier 15y ago

This post and comments has made me reconsider the word "trust" entirely. "Trust" is an emotion-laden, rhetorical word used by a someone who wants you to do something. "Just trust us." Trust is not fragile, trust is an illusion. Replace the verb "trust" with the word "assume" or "take a calculated risk" and you're closer to reality. Instead of "trust us," how about, "Look at our record. Note that we have had not a single incident of data disclosure in 6 years. Decide for yourself if it is likely that we'll have one now, with your data." Instead of "trust us," how about, "Think about our business: imagine the consequences if we were found to have looked at our customers' data, and see if that disincentive allays your concerns sufficiently." Instead of "trust us," how about, "Here are the ways we are protecting your data. Consider whether they meet your requirements or not." I'm voting "trust" off the island.

dennisgorelik 15y ago

I routinely look into my customers' data and didn't really have second thoughts about it. I even automated process of looking into customer's data. The main goal is to catch spam and scam and delete such accounts. May be it's specific of my business (job board), but isn't scam and spam is risk in any business to at least a certain extent?

BadassFractal 15y ago
You can do whatever you want as long as it's explicitly stated in the EULA, hopefully that's the case in your situation.

BadassFractal 15y ago

At any large organization with million of customers and public opinion affecting stocks, even mentioning to the that random people on the dev team have access to customer data can be pretty career altering. The fact that you're even looking at confidential information is generally highly frowned upon. What if Mint.com celebrated their 1 "billionth" processed transaction by posting what it was? Wouldn't that cause outrage?

8ig8 15y ago

I'm not too troubled by employees reading file names in the logs, but for some reason it bugs me that the apology post included a promotion (a link) for "Basecamp Next." In this context it didn't seem necessary.

joshontheweb 15y ago

When I was in college and working for a bootstrapped startup I was handed an unprotected thumb drive with an excel spreadsheet containing all the credit card numbers, expiration dates, address, social security numbers, etc of all the clients (thousands) and told to take it home for when I was working out of the office. I was too ignorant to realize how terrible, and I'm sure illegal this was. Of course I never abused it but it definitely makes me wary of my data these days. I imagine this happens much more than people think. Don't worry, the company I speak of was localized and failed now I think. It's prudent to cancel your cards once or twice a year and be careful who you trust. Some companies value convenience over security and put way too much trust in the employees.