3 ms·

A diff of the directory is abuse? That seems overly aggressive and I don’t see what that prevents.

jijijijij 3y ago
Are you trying to be pedantic? A diff by itself does not necessarily contain any information at all. However, it should be fairly obvious a complete diff in relation to a reference contains all the information of a prior state. So it's functionally similar to a copy. [LIVE]->[DIFF_N]->[DIFF_N-1]->...->[DIFF_1]=[LIVE_1] You know, that's kinda how Git works.
maximinus_thrax 3y ago
> A diff of the directory is abuse? Yes, if it contains employment information. A bunch of diffs can cross the threshold into event sourcing and if you have enough of them you might end up with a copy of the directory.
- handoflixue 3y ago
  I already have a copy of the entire source code for this application, including all of the secret database logins. Why would having a copy of the employee directory be a bigger problem? (To be clear: I'm trying to understand the issue, not dismiss it)
  - maximinus_thrax 3y ago
    > Why would having a copy of the employee directory be a bigger problem? In jurisdictions where people have the right to be forgotten, they could ask for all their information to be erased. How would that work if you keep a copy of the employee directory? That is one example. Another example would be a proposed bill in my jurisdiction which will force employers to disclose all information it stores about employees at the request of any employee. This will make you (someone who has a copy of the employee directory) some sort of data processor, which comes with new requirements about how you store that data and for how long. As someone else said somewhere in this thread, if you can see information, this does not automatically mean that you can store it.
  - jijijijij 3y ago
    First off, the article is about processing and metadata analysis, not just a mere "copy". Then, let's clarify: You legally stream a movie, you are also "copying" files to your computer, yet keeping "a copy" of the entirety would be considered illegal. Pedantic, naive technicalities are a ill-advised legal defense, and so is the expectation of object-oriented jurisprudence. Not everything is categorically same, because of a shared attribute. Intent matters. With your argument you are conflating intellectual property and business assets of your company, with privacy and informational self-determination of your colleagues. The latter isn't necessarily in the direct interest of your employer, but rather a right given by ethics, or governmental entities. Never mind metadata, a simple copy could mean transferring sensible information to a context where access control for unauthorized parties isn't implemented. Eg. you could have your take-home work laptop stolen, or compromised while watching porn. Legislative example: Under the GDPR, a doctor or therapist is not allowed to handle any patient data on private devices, which extends to contact information stored on their private phone. Context matters. Not everything is about money, or monetary damage. Privacy rights are about freedom and self-determination of the individual. Although, the organizational structure and history of a corporation certainly has implications for operational security as well. Try mapping and exfiltrating employment graphs and collected personal metadata at a defense contractor and see where that gets you. Mind you, OP's respective metadata analysis has little informational value in a ten peopled start-up, where you talk to everyone anyway. We're here considering corporations large enough for the individual employee to miss operational oversight by direct means. Corporations large enough, that meta-data would be valuable for third parties, too. Trust matters.

Are you trying to be pedantic? A diff by itself does not necessarily contain any information at all. However, it should be fairly obvious a complete diff in relation to a reference contains all the information of a prior state. So it's functionally similar to a copy. [LIVE]->[DIFF_N]->[DIFF_N-1]->...->[DIFF_1]=[LIVE_1] You know, that's kinda how Git works.

maximinus_thrax 3y ago

> A diff of the directory is abuse? Yes, if it contains employment information. A bunch of diffs can cross the threshold into event sourcing and if you have enough of them you might end up with a copy of the directory.

handoflixue 3y ago
I already have a copy of the entire source code for this application, including all of the secret database logins. Why would having a copy of the employee directory be a bigger problem? (To be clear: I'm trying to understand the issue, not dismiss it)
- maximinus_thrax 3y ago
  > Why would having a copy of the employee directory be a bigger problem? In jurisdictions where people have the right to be forgotten, they could ask for all their information to be erased. How would that work if you keep a copy of the employee directory? That is one example. Another example would be a proposed bill in my jurisdiction which will force employers to disclose all information it stores about employees at the request of any employee. This will make you (someone who has a copy of the employee directory) some sort of data processor, which comes with new requirements about how you store that data and for how long. As someone else said somewhere in this thread, if you can see information, this does not automatically mean that you can store it.
- jijijijij 3y ago
  First off, the article is about processing and metadata analysis, not just a mere "copy". Then, let's clarify: You legally stream a movie, you are also "copying" files to your computer, yet keeping "a copy" of the entirety would be considered illegal. Pedantic, naive technicalities are a ill-advised legal defense, and so is the expectation of object-oriented jurisprudence. Not everything is categorically same, because of a shared attribute. Intent matters. With your argument you are conflating intellectual property and business assets of your company, with privacy and informational self-determination of your colleagues. The latter isn't necessarily in the direct interest of your employer, but rather a right given by ethics, or governmental entities. Never mind metadata, a simple copy could mean transferring sensible information to a context where access control for unauthorized parties isn't implemented. Eg. you could have your take-home work laptop stolen, or compromised while watching porn. Legislative example: Under the GDPR, a doctor or therapist is not allowed to handle any patient data on private devices, which extends to contact information stored on their private phone. Context matters. Not everything is about money, or monetary damage. Privacy rights are about freedom and self-determination of the individual. Although, the organizational structure and history of a corporation certainly has implications for operational security as well. Try mapping and exfiltrating employment graphs and collected personal metadata at a defense contractor and see where that gets you. Mind you, OP's respective metadata analysis has little informational value in a ten peopled start-up, where you talk to everyone anyway. We're here considering corporations large enough for the individual employee to miss operational oversight by direct means. Corporations large enough, that meta-data would be valuable for third parties, too. Trust matters.