21 ms·

Vercel employee used customer information to pursue a personal trademark matter

191 points by StanAngeloff 3y ago

jlund-molfese 3y ago
More context: https://twitter.com/nico_jeannen/status/1713139186474406206 https://twitter.com/nico_jeannen/status/1713139186474406206
throwaway290 3y ago
Tangentially, who else misses the time when React was just a side project by FB? Increasingly it seems to be led by Vercel who makes profit from React-based solutions.
- yieldcrv 3y ago
  what do you miss about that? prehooks world was horrible and Nextjs has no vendor lock
  - yawnr 3y ago
    lol pre hooks world was fine. Hooks are great but react took over the world because of the clarity of class component lifecycles. If hooks were there from the start it wouldn’t have been as popular. Also Vercel/NextJS is like if DHH was charging people to use Rails. We are in the “enshittification” part of react development.
    - whoknowsidont 3y ago
      >because of the clarity of class component lifecycles. is this satire?
      - throwaway290 3y ago
        Ah, the clarity of useEffect(() => { return () => { handleUnmount() } }, [])! How did they manage to live with the ugly componentWillUnmount() { handleUnmount() } for all those years? (By the way, don't forget that [] or it does a completely different thing that you never want.)
        yawnr 3y ago
        useEffect is the biggest source of bugs in any react codebase bar none
      - shmde 3y ago
        I started off with hooks and started learning about class components just to clear interviews and damn it provides clarity of when, how components are gonna re-render. If you can get past the HOC hell hole and the "this.add = this.add.bind(this)". I felt it made it very clear how and in what order things run. Its definitely true when OP said if things did not get so clear with class components we would never have gotten hooks.
        whoknowsidont 3y ago
        > I felt it made it very clear how and in what order things run. I'm sorry, the entire community rallied around hooks PRECISELY because the life cycle methods were not clear and were very problematic. It seems extremely strange to see such opinions. When you see a hook you know exactly when it's going to execute and why and because of what. You don't have to layer the methods with tons of checks making sure the life cycle method has been run in the right context, it literally just works.
        yawnr 3y ago
        Hooks gained momentum because of advantages in composability and removing a lot of pain with HOCs. Brevity also helped. The obfuscation about re-renders and memoization of variables is absolutely a downside that I see junior devs really struggle with all the time — something that “just works” with class components. Anyway, both are fine and usable haha. Just think there are arguments to be made on both sides.
        yawnr 3y ago
        For what it’s worth there is a babel plugin to auto bind arrow functions as methods so you never have to do this.
      - bornfreddy 3y ago
        No. Hooks have their advantages over classes, but readability is not one of them, by far.
  - the_mitsuhiko 3y ago
    > Nextjs has no vendor lock It's complicated. If you want the vercel like experience of deploying to a serverless environment it's not as trivial. There is a reason that open-next exists.
    - mstade 3y ago
      It's actually not that hard to be honest, their Docker examples are pretty good and well accessible from the documentation. Where have you gotten stuck?
- sophiebits 3y ago
  Despite a few shuffles in employment, it’s many of the same people.
  - throwaway290 3y ago
    If React powers your dev platform then you may not want React to be particularly powerful and easy to use. Otherwise some people will just use React directly and other people will build their platforms on top of React and undercut your platform. Financial incentives are a powerful thing
    - solardev 3y ago
      If Meta wanted to, they could've expanded it themselves. They didn't, hence all these other companies. Between MUI and Next and RTK-query, IMO, React is finally approaching something usable and complete. Not a React fanboy. I loved Angular v1, in fact. Just hate how minimalist and useless vanilla React was. Edit: And maybe this is a problem of scale too. At Meta's size or similar, React is just one component and one team that works alongside dozens of others to deliver a working product. But when they open source it, smaller companies and individuals also try to use it but without Meta's scale and resources. And they inevitably find it lacking because they don't have whole teams working on the rest of the problem (like basic routing, which Meta handles in their derivative of PHP, I think?) , so they have to hope someone else (like react router) solved that problem in a drop-in way. That's why Next is so magical for small and medium businesses; they do a lot of that curation and infra building for you, for a reasonable fee.
- solardev 3y ago
  I definitely don't. IMO Next/Vercel is a better steward of React than FB was, and turned it into an actual framework usable for a site, not just a UI lib that took ten thousand other libs to make a website out of. The React world is quickly standardizing around Next as most of its stack (maybe with a state manager thrown in if useContext isn't enough) and that makes life a hell lot easier. And being a Vercel customer has been wonderful. Their systems are so much nicer to work with than legacy web stacks/VMs/containers, or trying to hook something up in PHP or Java. The dev ex is awesome, being able to `create-next-app` and deploy to Vercel in like 3 minutes.
  - JUNGLEISMASSIVE 3y ago
    [dead]
  - yieldcrv 3y ago
    100% agreed
    - zoover2020 3y ago
      I dont disagree but isn't this the point of their strategy? I.e. lure everyone in to only vendor lock-in later on?
      - yieldcrv 3y ago
        yeah probably, even if the current team doesnt want that, a board member or future executive will push for it and do it currently, deploying on vercel is so easy and the project structure works on any other compute instance that migrating away will be easy too, and breaking versions of Next or NextAuth can just not be used
      - solardev 3y ago
        How is this much different from being locked in to AWS or Docker Desktop or Oracle's Java or MySQL or WordPress or Cloudflare or OpenAI? Vercel is a business with a very good value proposition. And Next is open source with a huge community. It's not perfect, and Vercel isn't perfect, but among its peers (the web industry) it stands out to me as one of the two companies I'd trust to steward the future of the web (the other being Cloudflare). Way way way more so than Meta or Google, because at the end of the day at least these companies are selling good web hosting, not shitty advertising, and aren't run by total dicks either. Do I wish they were nonprofits with shared governance? Yeah, maybe. But short of that, their track record has actually been incredible. The web is still immature enough (surprising, I know) that new companies and technologies rise and fall all the time. Today's vendor lock-in is tomorrow's opportunity for another young upstart, the same way Next was to React, the way React was to Angular, the way Angular was to the frameworks before it. I'm not too worried. It doesn't make sense to be afraid of Next when it's really just repackaged cloud hosting in a very shiny wrapper. They resell AWS and GCP and Cloudflare infra at a markup but make it much much easier to use. It's a win win for everyone as far as I can tell.
- quickthrower2 3y ago
  How does Remix fit into this?
  - solardev 3y ago
    Next saw it as a significant threat and copied some of their ideas, I believe.
hubraumhugo 3y ago
> Employees can easily access the user's data and impersonate any account At every decent sized company I've worked for, topics like production data privileges, data classification (public, sensitive, confidential, etc.), data masking, and data anonymization for testing have been top priorities. And these policies are sometimes a true pain in the ass for developers, but they exist for a good reason. I guess you shouldn't miss the timing to go from "move fast and break things" to "ok we're now a serious business".
- xmprt 3y ago
  And the secret they don't tell you is that at least some employees still need to have that access even at the largest companies. People working on the storage team probably can access the data whenever they like (although it's against company policies) and while there are probably access logs to ensure trace who accessed what, the employees still have and need the access to perform their job duties.
  - hubraumhugo 3y ago
    Absolutely, humans are still the weakest link
- jstummbillig 3y ago
  Being a "serious business" is very, very hard, because the world is hellbent to assign blame. Even most big business are not serious businesses in this sense (look at the cases that, to this day, are being brought to and won against big tech). In most cases, the outfall is relatively manageable. If you are less lucky, it won't be. Having run a couple of businesses and feeling the pain I still don't see how to better the situation. It's good that businesses are put under pressure, because if they are not, bad actors would run wild. It is bad that running any business, at least to me, feels like navigating a minefield, and good actors are negatively impacted by that disproportionally. Personally, I have come to accept that, no matter how hard you can reasonably try, with any business and at any given moment, there is a number of things that if somebody looked very closely, that would probably raise some red flags, because the cost of safeguarding against all of them is infinite.
koopuluri 3y ago
This is really concerning. This combined with their marketing strategy of copying popular indie products and turning them into NextJS templates creates paranoia in the minds of builders who trust Vercel with their codebases, analytics, and often even their data (via Vercel's storage products). It seems that an enterprising Vercel employee has a goldmine of data to help inform their next "side project".
- shmde 3y ago
  If you self host a NextJS app and vercel copies your product can you sue them ?
  - koopuluri 3y ago
    They won't have access to your private project info (code, analytics, data etc.) if you don't host on their platform. NextJS itself is an open source framework. Suing for copying your product is tricky. In general I wouldn't rely on courts to protect your product IP. Execution is the only real moat. Any good product will have many copycats and competitors.
hipadev23 3y ago
Isn't this like the 5th or 6th time Vercel accessed private information from customers to launch a competitive service and/or shutdown the customer? Is there some tech incubator clause buried in their TOS and this is all okay?
- tipiirai 3y ago
  Outch. What services comes to your mind?
mdhb 3y ago
Add it to the long list of evidence that Vercel is a shady af company who shouldn’t be trusted.
- Jeannen 3y ago
  Curious, what are the other evidences?
  - mdhb 3y ago
    I mean it could be argued that a core part of their business model seems to be based on tricking people and locking them into terrible deals.
jatins 3y ago
In my experience at early stages of a company data ACLs are often the last priority for companies. People are rewarded for shipping things that can get a mention in company's next board deck, and "added ACLs to our Postgres" never got a mention in a board deck. I am sure a half motivated employee at your favorite cab service could see which addresses you frequently commuted to in first few years of that service's existence
- vxNsr 3y ago
  There were stories that at Uber events they had a big screen and shared that info publicly of various celebrities.
lloydatkinson 3y ago
Vercel is rapidly turning into a scourge in the open source world. Their strong coupling to React is also worrying, they are already trying to influence future React features for their NextJS framework.
- svedova 3y ago
  [flagged]
NicoJuicy 3y ago
This was only one part of the story? 1. Vercel shipping Indie hackers projects ( their customers) as "app templates" as a host, for marketing purpose https://twitter.com/nico_jeannen/status/1712749652133683632?t=oAcu_ZnC9Zqc_GBjibeb4g&s=19 https://twitter.com/nico_jeannen/status/1712749652133683632?... 2. The mentioned infringement of a Vercel employee, mentioned here ( he seems to be fired) https://twitter.com/nico_jeannen/status/1713139186474406206?t=4O_HTGKSkZY6pok46xcRdQ&s=19 https://twitter.com/nico_jeannen/status/1713139186474406206?... 3. Very broad ToS -> Vercel may delete your app for no reason at all https://twitter.com/bk_7312/status/1713197808264839479?t=h1TeEZlsjv3KbmAL0DVKSw&s=19 https://twitter.com/bk_7312/status/1713197808264839479?t=h1T...
osbulbul 3y ago
Well, I already don't like vercel and just sign up to test couple of things. But after I read this, I am going to delete my test account.
pc_edwin 3y ago
> The employee did not have access to any source code, secrets, or the ability to change settings or deployments. We are talking about an employee who has access to the customers personal information as part of their job doing something unethical. I would be extremely surprised if Vercel didn't have industry systems and practices in place for security. This is an edge case which can only be avoided by building Google-esque systems and practices. I don't think you guys really understand what your asking for here. This will cripple them in so many ways, it makes so much more sense delay it as long as possible. Not because they can save a bit of money, but because they UX will fall of a cliff, feature velocity will ground to a halt and the product will drift further away from stuff we really want.

191 points by StanAngeloff 3y ago

More context: https://twitter.com/nico_jeannen/status/1713139186474406206 https://twitter.com/nico_jeannen/status/1713139186474406206

throwaway290 3y ago

Tangentially, who else misses the time when React was just a side project by FB? Increasingly it seems to be led by Vercel who makes profit from React-based solutions.

yieldcrv 3y ago
what do you miss about that? prehooks world was horrible and Nextjs has no vendor lock
- yawnr 3y ago
  lol pre hooks world was fine. Hooks are great but react took over the world because of the clarity of class component lifecycles. If hooks were there from the start it wouldn’t have been as popular. Also Vercel/NextJS is like if DHH was charging people to use Rails. We are in the “enshittification” part of react development.
  - whoknowsidont 3y ago
    >because of the clarity of class component lifecycles. is this satire?
    - throwaway290 3y ago
      Ah, the clarity of useEffect(() => { return () => { handleUnmount() } }, [])! How did they manage to live with the ugly componentWillUnmount() { handleUnmount() } for all those years? (By the way, don't forget that [] or it does a completely different thing that you never want.)
      - yawnr 3y ago
        useEffect is the biggest source of bugs in any react codebase bar none
    - shmde 3y ago
      I started off with hooks and started learning about class components just to clear interviews and damn it provides clarity of when, how components are gonna re-render. If you can get past the HOC hell hole and the "this.add = this.add.bind(this)". I felt it made it very clear how and in what order things run. Its definitely true when OP said if things did not get so clear with class components we would never have gotten hooks.
      - whoknowsidont 3y ago
        > I felt it made it very clear how and in what order things run. I'm sorry, the entire community rallied around hooks PRECISELY because the life cycle methods were not clear and were very problematic. It seems extremely strange to see such opinions. When you see a hook you know exactly when it's going to execute and why and because of what. You don't have to layer the methods with tons of checks making sure the life cycle method has been run in the right context, it literally just works.
        yawnr 3y ago
        Hooks gained momentum because of advantages in composability and removing a lot of pain with HOCs. Brevity also helped. The obfuscation about re-renders and memoization of variables is absolutely a downside that I see junior devs really struggle with all the time — something that “just works” with class components. Anyway, both are fine and usable haha. Just think there are arguments to be made on both sides.
      - yawnr 3y ago
        For what it’s worth there is a babel plugin to auto bind arrow functions as methods so you never have to do this.
    - bornfreddy 3y ago
      No. Hooks have their advantages over classes, but readability is not one of them, by far.
- the_mitsuhiko 3y ago
  > Nextjs has no vendor lock It's complicated. If you want the vercel like experience of deploying to a serverless environment it's not as trivial. There is a reason that open-next exists.
  - mstade 3y ago
    It's actually not that hard to be honest, their Docker examples are pretty good and well accessible from the documentation. Where have you gotten stuck?
sophiebits 3y ago
Despite a few shuffles in employment, it’s many of the same people.
- throwaway290 3y ago
  If React powers your dev platform then you may not want React to be particularly powerful and easy to use. Otherwise some people will just use React directly and other people will build their platforms on top of React and undercut your platform. Financial incentives are a powerful thing
  - solardev 3y ago
    If Meta wanted to, they could've expanded it themselves. They didn't, hence all these other companies. Between MUI and Next and RTK-query, IMO, React is finally approaching something usable and complete. Not a React fanboy. I loved Angular v1, in fact. Just hate how minimalist and useless vanilla React was. Edit: And maybe this is a problem of scale too. At Meta's size or similar, React is just one component and one team that works alongside dozens of others to deliver a working product. But when they open source it, smaller companies and individuals also try to use it but without Meta's scale and resources. And they inevitably find it lacking because they don't have whole teams working on the rest of the problem (like basic routing, which Meta handles in their derivative of PHP, I think?) , so they have to hope someone else (like react router) solved that problem in a drop-in way. That's why Next is so magical for small and medium businesses; they do a lot of that curation and infra building for you, for a reasonable fee.
solardev 3y ago
I definitely don't. IMO Next/Vercel is a better steward of React than FB was, and turned it into an actual framework usable for a site, not just a UI lib that took ten thousand other libs to make a website out of. The React world is quickly standardizing around Next as most of its stack (maybe with a state manager thrown in if useContext isn't enough) and that makes life a hell lot easier. And being a Vercel customer has been wonderful. Their systems are so much nicer to work with than legacy web stacks/VMs/containers, or trying to hook something up in PHP or Java. The dev ex is awesome, being able to `create-next-app` and deploy to Vercel in like 3 minutes.
- JUNGLEISMASSIVE 3y ago
  [dead]
- yieldcrv 3y ago
  100% agreed
  - zoover2020 3y ago
    I dont disagree but isn't this the point of their strategy? I.e. lure everyone in to only vendor lock-in later on?
    - yieldcrv 3y ago
      yeah probably, even if the current team doesnt want that, a board member or future executive will push for it and do it currently, deploying on vercel is so easy and the project structure works on any other compute instance that migrating away will be easy too, and breaking versions of Next or NextAuth can just not be used
    - solardev 3y ago
      How is this much different from being locked in to AWS or Docker Desktop or Oracle's Java or MySQL or WordPress or Cloudflare or OpenAI? Vercel is a business with a very good value proposition. And Next is open source with a huge community. It's not perfect, and Vercel isn't perfect, but among its peers (the web industry) it stands out to me as one of the two companies I'd trust to steward the future of the web (the other being Cloudflare). Way way way more so than Meta or Google, because at the end of the day at least these companies are selling good web hosting, not shitty advertising, and aren't run by total dicks either. Do I wish they were nonprofits with shared governance? Yeah, maybe. But short of that, their track record has actually been incredible. The web is still immature enough (surprising, I know) that new companies and technologies rise and fall all the time. Today's vendor lock-in is tomorrow's opportunity for another young upstart, the same way Next was to React, the way React was to Angular, the way Angular was to the frameworks before it. I'm not too worried. It doesn't make sense to be afraid of Next when it's really just repackaged cloud hosting in a very shiny wrapper. They resell AWS and GCP and Cloudflare infra at a markup but make it much much easier to use. It's a win win for everyone as far as I can tell.
quickthrower2 3y ago
How does Remix fit into this?
- solardev 3y ago
  Next saw it as a significant threat and copied some of their ideas, I believe.

hubraumhugo 3y ago

> Employees can easily access the user's data and impersonate any account At every decent sized company I've worked for, topics like production data privileges, data classification (public, sensitive, confidential, etc.), data masking, and data anonymization for testing have been top priorities. And these policies are sometimes a true pain in the ass for developers, but they exist for a good reason. I guess you shouldn't miss the timing to go from "move fast and break things" to "ok we're now a serious business".

xmprt 3y ago
And the secret they don't tell you is that at least some employees still need to have that access even at the largest companies. People working on the storage team probably can access the data whenever they like (although it's against company policies) and while there are probably access logs to ensure trace who accessed what, the employees still have and need the access to perform their job duties.
- hubraumhugo 3y ago
  Absolutely, humans are still the weakest link
jstummbillig 3y ago
Being a "serious business" is very, very hard, because the world is hellbent to assign blame. Even most big business are not serious businesses in this sense (look at the cases that, to this day, are being brought to and won against big tech). In most cases, the outfall is relatively manageable. If you are less lucky, it won't be. Having run a couple of businesses and feeling the pain I still don't see how to better the situation. It's good that businesses are put under pressure, because if they are not, bad actors would run wild. It is bad that running any business, at least to me, feels like navigating a minefield, and good actors are negatively impacted by that disproportionally. Personally, I have come to accept that, no matter how hard you can reasonably try, with any business and at any given moment, there is a number of things that if somebody looked very closely, that would probably raise some red flags, because the cost of safeguarding against all of them is infinite.

koopuluri 3y ago

This is really concerning. This combined with their marketing strategy of copying popular indie products and turning them into NextJS templates creates paranoia in the minds of builders who trust Vercel with their codebases, analytics, and often even their data (via Vercel's storage products). It seems that an enterprising Vercel employee has a goldmine of data to help inform their next "side project".

shmde 3y ago
If you self host a NextJS app and vercel copies your product can you sue them ?
- koopuluri 3y ago
  They won't have access to your private project info (code, analytics, data etc.) if you don't host on their platform. NextJS itself is an open source framework. Suing for copying your product is tricky. In general I wouldn't rely on courts to protect your product IP. Execution is the only real moat. Any good product will have many copycats and competitors.

hipadev23 3y ago

Isn't this like the 5th or 6th time Vercel accessed private information from customers to launch a competitive service and/or shutdown the customer? Is there some tech incubator clause buried in their TOS and this is all okay?

tipiirai 3y ago
Outch. What services comes to your mind?

mdhb 3y ago

Add it to the long list of evidence that Vercel is a shady af company who shouldn’t be trusted.

Jeannen 3y ago
Curious, what are the other evidences?
- mdhb 3y ago
  I mean it could be argued that a core part of their business model seems to be based on tricking people and locking them into terrible deals.

jatins 3y ago

In my experience at early stages of a company data ACLs are often the last priority for companies. People are rewarded for shipping things that can get a mention in company's next board deck, and "added ACLs to our Postgres" never got a mention in a board deck. I am sure a half motivated employee at your favorite cab service could see which addresses you frequently commuted to in first few years of that service's existence

vxNsr 3y ago
There were stories that at Uber events they had a big screen and shared that info publicly of various celebrities.

lloydatkinson 3y ago

Vercel is rapidly turning into a scourge in the open source world. Their strong coupling to React is also worrying, they are already trying to influence future React features for their NextJS framework.

svedova 3y ago
[flagged]

NicoJuicy 3y ago

This was only one part of the story? 1. Vercel shipping Indie hackers projects ( their customers) as "app templates" as a host, for marketing purpose https://twitter.com/nico_jeannen/status/1712749652133683632?t=oAcu_ZnC9Zqc_GBjibeb4g&s=19 https://twitter.com/nico_jeannen/status/1712749652133683632?... 2. The mentioned infringement of a Vercel employee, mentioned here ( he seems to be fired) https://twitter.com/nico_jeannen/status/1713139186474406206?t=4O_HTGKSkZY6pok46xcRdQ&s=19 https://twitter.com/nico_jeannen/status/1713139186474406206?... 3. Very broad ToS -> Vercel may delete your app for no reason at all https://twitter.com/bk_7312/status/1713197808264839479?t=h1TeEZlsjv3KbmAL0DVKSw&s=19 https://twitter.com/bk_7312/status/1713197808264839479?t=h1T...

osbulbul 3y ago

Well, I already don't like vercel and just sign up to test couple of things. But after I read this, I am going to delete my test account.

pc_edwin 3y ago

> The employee did not have access to any source code, secrets, or the ability to change settings or deployments. We are talking about an employee who has access to the customers personal information as part of their job doing something unethical. I would be extremely surprised if Vercel didn't have industry systems and practices in place for security. This is an edge case which can only be avoided by building Google-esque systems and practices. I don't think you guys really understand what your asking for here. This will cripple them in so many ways, it makes so much more sense delay it as long as possible. Not because they can save a bit of money, but because they UX will fall of a cliff, feature velocity will ground to a halt and the product will drift further away from stuff we really want.