4 ms·

> if this kind of issue can fly undetected for so long, what can organizations with drastically less resources than $GOOG do to ensure adequate velocity while n

> if this kind of issue can fly undetected for so long, what can organizations with drastically less resources than $GOOG do to ensure adequate velocity while not leaving the proverbial barn doors open? If $GOOG can't do it with practically infinite resources then I'm of the opinion that nobody can. Computing is broken.

danielheath 4y ago
It's not a question of having enough resources. $GOOG can't do it because anyone who isn't building a promo packet by launching new services is on the way out.
jszymborski 4y ago
Are we certain that they are motivated to do so? Google doesn't strike me as a company committed to user privacy.
- deleted 4y ago
  [deleted]
- metadat 4y ago
  There is no company on earth with a larger privacy organization than Google. Edit: @dogecoinbase: What you propose is a shallow and dismissive analysis of the oversimplicative variety. Please put in a little more effort before derailing an otherwise thoughtful conversation.
  - dogecoinbase 4y ago
    The lesson, then, appears to be that size of privacy organization does not have a correlated effect on effectiveness.
  - mikeho1999 4y ago
    @metadat -- can you provide the source for that? I'm genuinely curious how much Google spends on their privacy org, and esp. how that compares with the other big tech companies.
    - metadat 4y ago
      Privacy is bundled under Trust & Security. I don't have precise numbers or estimates, but basically every Google product area has a team of Technical Privacy Engineers, TPMs, TPgMs, and VPs. They are the arbiters who can block a production release if privacy and security issues are discovered and not remedied. No other company I can think of has invested in such a rigorous Privacy review and support structure in an attempt to reduce risk. Other BigCorps do take it seriously, but get by with much less investment. Despite this, FB et. al. are keen to poach Google Privacy employees, because there are very few Privacy Engineer in existence and Big-G pioneered modern day corporate privacy efforts. Google is a huge target for hacking and public criticism or even loss of human life due to product decisions, especially because the products are so ubiquitous and widespread (browser, mobile OS, search engine, Gmail, ad network, etc). See subjects such as Differential Privacy. Source: I have a few friends who've worked in the G-Privacy org.
      - kortilla 4y ago
        Differential privacy didn’t come out of Google. > They are the arbiters who can to block a production releases if privacy and security issues are discovered and not remedied. Every company I’ve worked at outside of tiny startups has had this level of gating by the security team. > No other company I can think of has invested in such a rigorous Privacy review and support structure in an attempt to reduce risk. Which companies have you worked at in the last 8 or so years? It sounds like you’ve just watched the industry mature a bit in PII from the perspective of the inside of Google.
      - dmitriid 4y ago
        > No other company I can think of has invested in such a rigorous Privacy review and support structure in an attempt to reduce risk. In recent court cases Google employees admitted they have no idea where user data is stored (specifically location data), which systems have access to it, and how to fully turn tracking off. 80-90% of Google's revenue comes from online ads. There's a huge conflict of interest between Google's business model and whatever "arbiters" pretend they want to block. And of course the number of privacy things that Google pioneered is minuscule to non-existent. Google has been dragged into caring about privacy against its will, kicking and screaming, by government actions like GDPR and CCPA. Facebook poaches Google's privacy people because Facebook is the only one of mega corps who are worse than Google, and wants to continue its practices as much as Google.
  - r_hoods_ghost 4y ago
    Yes, but what is the focus of google's privacy organisation? Is it protective user privacy or is it designing and implementing ways to circumvent user privacy controls and regulations? From the evidence I'd say the latter.
pcthrowaway 4y ago
I don't think Google's incentives are properly aligned with users for them to prioritize creation of a user-first extension package repository. APIs which would make it easy for extensions to exfiltrate user information might be the same APIs they would use to do the same. APIs that allow the user to enhance their web experience (think uBlock origin) are being kneecapped by manifest v3
londons_explore 4y ago
I agree - nobody can. You can't make a computing environment allowing anyone to write and distribute code that has the ability to do all the things users want it to do, without having a good chunk of bad actors trying to trick/persuade users into granting malicious code enough permissions to hurt the user. You have to either severely limit what code can do (the iOS model), or allow users to shoot themselves in the foot (the windows download a random .exe and run it model). Chrome falls in between.

danielheath 4y ago

It's not a question of having enough resources. $GOOG can't do it because anyone who isn't building a promo packet by launching new services is on the way out.

jszymborski 4y ago

Are we certain that they are motivated to do so? Google doesn't strike me as a company committed to user privacy.

deleted 4y ago
[deleted]
metadat 4y ago
There is no company on earth with a larger privacy organization than Google. Edit: @dogecoinbase: What you propose is a shallow and dismissive analysis of the oversimplicative variety. Please put in a little more effort before derailing an otherwise thoughtful conversation.
- dogecoinbase 4y ago
  The lesson, then, appears to be that size of privacy organization does not have a correlated effect on effectiveness.
- mikeho1999 4y ago
  @metadat -- can you provide the source for that? I'm genuinely curious how much Google spends on their privacy org, and esp. how that compares with the other big tech companies.
  - metadat 4y ago
    Privacy is bundled under Trust & Security. I don't have precise numbers or estimates, but basically every Google product area has a team of Technical Privacy Engineers, TPMs, TPgMs, and VPs. They are the arbiters who can block a production release if privacy and security issues are discovered and not remedied. No other company I can think of has invested in such a rigorous Privacy review and support structure in an attempt to reduce risk. Other BigCorps do take it seriously, but get by with much less investment. Despite this, FB et. al. are keen to poach Google Privacy employees, because there are very few Privacy Engineer in existence and Big-G pioneered modern day corporate privacy efforts. Google is a huge target for hacking and public criticism or even loss of human life due to product decisions, especially because the products are so ubiquitous and widespread (browser, mobile OS, search engine, Gmail, ad network, etc). See subjects such as Differential Privacy. Source: I have a few friends who've worked in the G-Privacy org.
    - kortilla 4y ago
      Differential privacy didn’t come out of Google. > They are the arbiters who can to block a production releases if privacy and security issues are discovered and not remedied. Every company I’ve worked at outside of tiny startups has had this level of gating by the security team. > No other company I can think of has invested in such a rigorous Privacy review and support structure in an attempt to reduce risk. Which companies have you worked at in the last 8 or so years? It sounds like you’ve just watched the industry mature a bit in PII from the perspective of the inside of Google.
    - dmitriid 4y ago
      > No other company I can think of has invested in such a rigorous Privacy review and support structure in an attempt to reduce risk. In recent court cases Google employees admitted they have no idea where user data is stored (specifically location data), which systems have access to it, and how to fully turn tracking off. 80-90% of Google's revenue comes from online ads. There's a huge conflict of interest between Google's business model and whatever "arbiters" pretend they want to block. And of course the number of privacy things that Google pioneered is minuscule to non-existent. Google has been dragged into caring about privacy against its will, kicking and screaming, by government actions like GDPR and CCPA. Facebook poaches Google's privacy people because Facebook is the only one of mega corps who are worse than Google, and wants to continue its practices as much as Google.
- r_hoods_ghost 4y ago
  Yes, but what is the focus of google's privacy organisation? Is it protective user privacy or is it designing and implementing ways to circumvent user privacy controls and regulations? From the evidence I'd say the latter.

pcthrowaway 4y ago

I don't think Google's incentives are properly aligned with users for them to prioritize creation of a user-first extension package repository. APIs which would make it easy for extensions to exfiltrate user information might be the same APIs they would use to do the same. APIs that allow the user to enhance their web experience (think uBlock origin) are being kneecapped by manifest v3

londons_explore 4y ago

I agree - nobody can. You can't make a computing environment allowing anyone to write and distribute code that has the ability to do all the things users want it to do, without having a good chunk of bad actors trying to trick/persuade users into granting malicious code enough permissions to hurt the user. You have to either severely limit what code can do (the iOS model), or allow users to shoot themselves in the foot (the windows download a random .exe and run it model). Chrome falls in between.