7 ms·

Sounds like Vlad did a pretty sane, human thing reaching out and offering to discuss. The authors replies seem pretty rude (or at least somewhat aggressive / d

Sounds like Vlad did a pretty sane, human thing reaching out and offering to discuss. The authors replies seem pretty rude (or at least somewhat aggressive / dismissive). Kagi is Vlads baby and I could imagine he would care and try to explain when he thinks someone has the wrong idea. However to the author - it’s just another service he doesn’t use anymore.

WA 3y ago
Vlad is not discussing, he is lecturing. The author of the blog post seems right. Vlad defends his position "lol email is not PII" repeatedly, despite being obviously and completely wrong. He has no understanding that it doesn't matter that a user could enter fake information. His business collects email addresses, which is a process. Under GDPR, this process must be documented, users must be given their data on request (even if it just contains an email address, but usually it also contains the signup date for example as a proof for their data processing consent) and users must be informed about their rights to correct or delete such data. He comes off totally as the "trust me bro" guy with zero respect for a different perspective and doesn't seem to be interested in changing his (objectively wrong) opinion. It is almost laughable, because "is email PII" has been discussed a million times since the introduction of the GDPR that you must've lived under a rock to dismiss it like Vlad did.
- eviks 3y ago
  he explicitly said in his email that "Personal emails are PII.", so how is that a defence of his previous position?
  - WA 3y ago
    I re-read again. You are right, he says "personal emails are PII" in this email. In the original post however he dismisses the whole GDPR data request process as "we don't need this, because you can provide fake data". Point is: if the business requests an email address, many people will provide their real email adress and your business needs to document this process under GDPR. I just checked. The signup form doesn't say "please give a FAKE email address", it just says "email address". If a user provides a real email address, Kagi must respond to GDPR Art. 15 requests by providing...that same email adress. Might sound silly, but usually, there is other data associated with this. Usually, at least the timestamp of the signup. If a business is really GDPR compliant, it will offer a download option for stuff like user settings and so on. Or, if the user signed up and later deleted the account, his email should explicitly NOT show up when asking for personal data. See, it is about documenting the process, whether the outcome is "here is your email address you just asked for" or "we don't have any data on you". And Vlad says that this process is irrelevant for Kagi, while it is not.
    - iamacyborg 3y ago
      >If a business is really GDPR compliant, it will offer a download option for stuff like user settings and so on. I've made a bunch of SAR's, including pre-GDPR and I've never received one that contained my user settings, so that seems pretty normal. The whole PII convo seems incredibly asinine though, "PII" is not a thing in the GDPR. Personal data is[1], but that's not the same thing. If Kagi keep a record of searches performed by a user, that's something that a SAR should be used for, but the whole convo just misses the mark entirely. [^1]: See article 4.1 https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/
      - nicce 3y ago
        > I've made a bunch of SAR's, including pre-GDPR and I've never received one that contained my user settings, so that seems pretty normal. That is odd because the user has right to get ALL the data they want that is stored about them in the service.
    - shadowgovt 3y ago
      It's ultimately not up to Vlad. If the law declares email addresses are PII, they're PII. If he's positioning his company to challenge that law when he runs afoul of it, that's a choice they can make but it's a business risk (and IANAL, but... Probably one they'll lose).
  - thisisjasononhn 3y ago
    Lori is a she, not a he.
    - eviks 3y ago
      Vlad is Vlad, not Lori.
  - nicce 3y ago
    It does not matter in this context, because it is still incorrect. > Personal emails are PII. But you can register to Kagi with a random email, and that is not PII. Company has no means to identify what is the difference between personal or random email. Everything can be and must be treated equally from privacy perspective.
HeatrayEnjoyer 3y ago
I don't care if it's someone's baby. I'm the paying customer paying in both money and sensitive information I expected to be well protected.
nebulous1 3y ago
You can make that argument for initial approach, but it falls flat on its face after the author told Vlad that they didn't want to communicate with them and Vlad responded with a lecture. Vlad comes off as fairly unhinged here.
- magistr4te 3y ago
  Tldr: you can't just spread a very negative opinion about someones hard work and then plug your ears shut for any kind of non-symathetic interaction. In my eyes this rationale would make sense if there was no backstory to this. If there was no preceeding blogpost, I'd consider Vlads messages pure spam. But the context here is different: The author wrote a very critical, and clearly opinionated blogpost. There was clear intention in engaging with this subject. Now the author seems to want to avoid responsibility, while Vlads attempt to react to a public hit piece with a respectful conversation was honestly the best way to handle this.
  - rsynnott 3y ago
    You can criticise something without obligating yourself to have a conversation with the subject. In fact, that is generally how most critical writing has worked, for centuries. If you're unhappy with the review of your restaurant in the paper, you _might_ be able to convince them to publish a short owner response, once, but they're certainly not going to engage in a dialogue about it.
    - PaulDavisThe1st 3y ago
      > You can criticise something without obligating yourself to have a conversation with the subject. That's the fundamental premise of telling people that they are sealioning. Not everyone agrees with it (I suspect age plays more a role than anything else). Your historical example doesn't really map very well to today, because control over the ability to put some text somewhere that others can read it is very, very different than it was historically. None of this excuses the Kagi CEO's failure to back off when asked/told to. They should just have used their own blog or equivalent to respond. Still, generalizing to a broad claim about raising an issue in public creating no future obligations seems somewhat wrong to me. You don't have to speak in public about anything at all. For me, your choice to do so creates some limited obligations towards future engagement (though I'm not sure quite where the limits lie).
danpalmer 3y ago
This post suggests the author has tried this already, has had these discussions and has reached the natural end of that process. I've also had a similar discussion with Vlad on comments here, he definitely doesn't try to view things from other people's perspectives.
ImPostingOnHN 3y ago
Vlad's message to "discuss" reads more like a sealion-ey 'let me explain to you why you are wrong, you just don't understand why you are wrong, I am very smart and not wrong' than an honest admission that Vlad was wrong and is interested in being humble and learning from someone else.

WA 3y ago

Vlad is not discussing, he is lecturing. The author of the blog post seems right. Vlad defends his position "lol email is not PII" repeatedly, despite being obviously and completely wrong. He has no understanding that it doesn't matter that a user could enter fake information. His business collects email addresses, which is a process. Under GDPR, this process must be documented, users must be given their data on request (even if it just contains an email address, but usually it also contains the signup date for example as a proof for their data processing consent) and users must be informed about their rights to correct or delete such data. He comes off totally as the "trust me bro" guy with zero respect for a different perspective and doesn't seem to be interested in changing his (objectively wrong) opinion. It is almost laughable, because "is email PII" has been discussed a million times since the introduction of the GDPR that you must've lived under a rock to dismiss it like Vlad did.

eviks 3y ago
he explicitly said in his email that "Personal emails are PII.", so how is that a defence of his previous position?
- WA 3y ago
  I re-read again. You are right, he says "personal emails are PII" in this email. In the original post however he dismisses the whole GDPR data request process as "we don't need this, because you can provide fake data". Point is: if the business requests an email address, many people will provide their real email adress and your business needs to document this process under GDPR. I just checked. The signup form doesn't say "please give a FAKE email address", it just says "email address". If a user provides a real email address, Kagi must respond to GDPR Art. 15 requests by providing...that same email adress. Might sound silly, but usually, there is other data associated with this. Usually, at least the timestamp of the signup. If a business is really GDPR compliant, it will offer a download option for stuff like user settings and so on. Or, if the user signed up and later deleted the account, his email should explicitly NOT show up when asking for personal data. See, it is about documenting the process, whether the outcome is "here is your email address you just asked for" or "we don't have any data on you". And Vlad says that this process is irrelevant for Kagi, while it is not.
  - iamacyborg 3y ago
    >If a business is really GDPR compliant, it will offer a download option for stuff like user settings and so on. I've made a bunch of SAR's, including pre-GDPR and I've never received one that contained my user settings, so that seems pretty normal. The whole PII convo seems incredibly asinine though, "PII" is not a thing in the GDPR. Personal data is[1], but that's not the same thing. If Kagi keep a record of searches performed by a user, that's something that a SAR should be used for, but the whole convo just misses the mark entirely. [^1]: See article 4.1 https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/
    - nicce 3y ago
      > I've made a bunch of SAR's, including pre-GDPR and I've never received one that contained my user settings, so that seems pretty normal. That is odd because the user has right to get ALL the data they want that is stored about them in the service.
  - shadowgovt 3y ago
    It's ultimately not up to Vlad. If the law declares email addresses are PII, they're PII. If he's positioning his company to challenge that law when he runs afoul of it, that's a choice they can make but it's a business risk (and IANAL, but... Probably one they'll lose).
- thisisjasononhn 3y ago
  Lori is a she, not a he.
  - eviks 3y ago
    Vlad is Vlad, not Lori.
- nicce 3y ago
  It does not matter in this context, because it is still incorrect. > Personal emails are PII. But you can register to Kagi with a random email, and that is not PII. Company has no means to identify what is the difference between personal or random email. Everything can be and must be treated equally from privacy perspective.

HeatrayEnjoyer 3y ago

I don't care if it's someone's baby. I'm the paying customer paying in both money and sensitive information I expected to be well protected.

nebulous1 3y ago

You can make that argument for initial approach, but it falls flat on its face after the author told Vlad that they didn't want to communicate with them and Vlad responded with a lecture. Vlad comes off as fairly unhinged here.

magistr4te 3y ago
Tldr: you can't just spread a very negative opinion about someones hard work and then plug your ears shut for any kind of non-symathetic interaction. In my eyes this rationale would make sense if there was no backstory to this. If there was no preceeding blogpost, I'd consider Vlads messages pure spam. But the context here is different: The author wrote a very critical, and clearly opinionated blogpost. There was clear intention in engaging with this subject. Now the author seems to want to avoid responsibility, while Vlads attempt to react to a public hit piece with a respectful conversation was honestly the best way to handle this.
- rsynnott 3y ago
  You can criticise something without obligating yourself to have a conversation with the subject. In fact, that is generally how most critical writing has worked, for centuries. If you're unhappy with the review of your restaurant in the paper, you _might_ be able to convince them to publish a short owner response, once, but they're certainly not going to engage in a dialogue about it.
  - PaulDavisThe1st 3y ago
    > You can criticise something without obligating yourself to have a conversation with the subject. That's the fundamental premise of telling people that they are sealioning. Not everyone agrees with it (I suspect age plays more a role than anything else). Your historical example doesn't really map very well to today, because control over the ability to put some text somewhere that others can read it is very, very different than it was historically. None of this excuses the Kagi CEO's failure to back off when asked/told to. They should just have used their own blog or equivalent to respond. Still, generalizing to a broad claim about raising an issue in public creating no future obligations seems somewhat wrong to me. You don't have to speak in public about anything at all. For me, your choice to do so creates some limited obligations towards future engagement (though I'm not sure quite where the limits lie).

danpalmer 3y ago

This post suggests the author has tried this already, has had these discussions and has reached the natural end of that process. I've also had a similar discussion with Vlad on comments here, he definitely doesn't try to view things from other people's perspectives.

ImPostingOnHN 3y ago

Vlad's message to "discuss" reads more like a sealion-ey 'let me explain to you why you are wrong, you just don't understand why you are wrong, I am very smart and not wrong' than an honest admission that Vlad was wrong and is interested in being humble and learning from someone else.