4 ms·
And they're not fined for storing in plaintext, nor for storing in plaintext by mistake, they're fined because the law give a time limit for you to notify the r
by nolok 2y ago
And they're not fined for storing in plaintext, nor for storing in plaintext by mistake, they're fined because the law give a time limit for you to notify the regulator after you notice it and they waited too long.
And in this specific case just to be clear it's not about taking too long to notify the public / customer, but about taking too long to notify regulator (the delay is much shorter). And they're not supposed to have perfect facts when they notify it, there is no sanction for notifying and saying "but we're not sure yet" if you're being honest, or coming back later with correction, there is a sanction for not telling them in time.
We often see "companies should be responsible / should have to inform me" and that's part of that regulation, and it only works if there are clear defined delay and sanction when they're not respected.
- jart 2y agoHow long has that even been a regulation and in which countries does it apply? Software engineers are trained to view these kinds of things as bugs. Legal isn't trained to monitor bug trackers.
- JCharante 2y agoit's GDPR from the subheader > The Irish Data Protection Commission found that the company violated several GDPR rules. this is why lots of websites block the EU from accessing. You basically need to consult with lawyers to make sure you're not accidentally breaking the law when writing a codebase.
- omnimus 2y ago“lots” not really as most companies want accesss to european market. Also no you dont need to consult lawyers when writing code. You just dont track and save data and do questionable stuff with it. Saving passwords in logs is surely security issue first before its GDPR issue.
- JCharante 2y agoyes it's a security issue but you wouldn't "expect" to get fined millions of dollars. Do I think we should punish companies for storing passwords in plaintext? Yes. Would I expect that a bug and devs untrained in GDPR best practices could lead to fines? No. Usually in software engineering you don't get your company fined for making terrible mistakes unless you're in a field like finance. This was just passwords which most sites have, not something like PCI DSS stuff
- gm3dmo 2y ago>yes it's a security issue but you wouldn't "expect" to get fined millions of dollars. The penalties are based on percentage of turnover.
- nolok 2y ago> yes it's a security issue but you wouldn't "expect" to get fined millions of dollars. Which is exactly why companies don't care, which is why this regulation was made and those fines decided. > Usually in software engineering you don't get your company fined for making terrible mistakes unless you're in a field like finance. You're not fined for a mistake, you're fined for a mistake AND that mistake huer the customer more than you AND you don't disclose it swiflty to him.
- JCharante 2y ago> “lots” not really as most companies want accesss to european market. Plenty of foreign newspapers block the EU from accessing their sites. The EU is not that a big market.
- mdhb 2y agoI probably encounter this like 5 times a year, your statement is wrong.
- maeil 2y agoI see this comment pop up here often in these threads about EU fines and regulations. "Apple/company should just call the EUs bluff and stop selling in the EU!". Apple's a good example because they're such an incredibly global brand, who should be less reliant on EU customers. Yet Europe is responsible for >20% of their revenue. Shareholders would eat you alive for just "nope"ing away from that. Yes, US GDP/capita is far above the EU average, but the EU still represents 450 million, on average fairly wealthy people. So companies simply play ball. And that excludes the UK, whose data protection laws are similarly strict.
- gm3dmo 2y agosee Apple's 14 billion tax troubles in Ireland. For years these companies have been using the European operations as part of the tax avoidance schemes. Don't mess with the Flemish has been good advice for 600 of the last thousand years.
- JCharante 2y ago20% of revenue isn't that much. Would you rather focus on your core product and double your revenue, or focus on getting that 20%? Yes giant companies have the resources and experience less YoY growth so they will work with the EU market, but most companies would do better to ignore the EU.
- philistine 2y agoExplain to me how not selling in the EU could double a company's revenue? How removing yourself from your third largest market would enlarge the others? How millions of people in the US don't buy an iPhone because you can buy iPhones in Germany?
- nolok 2y ago> 20% of revenue isn't that much It is in reality gigantic, especially at that scale. And in this specific example, Apple net profit is 24% of their revenue. > Would you rather focus on your core product and double your revenue Saying you no longer sell to people with blue eyes or wearing short is not in any way increasing your sales to other people. I'm sorry to you your messages sound like you're not very knowledge about the subject matter.
- alexmorley 2y agoIt’s part of GDPR. I’ve been given training on it at all (3) companies I’ve worked for and training has always included what constitutes a breach and what to do. I would hope any company would treat it as an incident rather than just a bug where senior enough folks would be involved to know what their responsibilities are.
- gm3dmo 2y agoCan't blame a rogue junior engineer if that happens.
- oliwarner 2y ago> Software engineers are trained to view these kinds of things as bugs Competent engineers —software or other— must have an education in safety standards and legal regulations. I had a pretty formal education in data protection at both A-Level and undergrad. I know real engineers get tetchy about us programmers edging in, so if you want any claim to an engineering title, ignoring the ramifications of your code in the real world is unacceptable. But that doesn't seem to be the problem here. Somebody did know it was bad, did fix it urgently, did report it internally and did an impact assessment. The problem was they needed to notify the regulator earlier so they knew it could have been a problem. If these passwords were in the wild, delaying notification by however many days means attackers have more time to use stolen credentials. $100m sounds like a lot but a lot of these regulatory rules scale with the company so that punishments like this have impact. They need to improve how they handle security notification.
- bcrl 2y agoI think the big difference is that engineers have had to care about people dying for the past 100 years. Today there are software developers that throw code out into the world that kills people without any repercussions. At some point this needs to change.
- bigtimesink 2y agoAn education in legal regulations teaches you the best solution is to make the fix and don't say anything.
- dotps1 2y agoTo be clear, they are absolutely being fined for storing passwords in plaintext. They chose not to mitigate the fine by following proper procedure.