6 ms·

I vehemently disagree. 'Well, they didn't know what they were doing, so we shouldn't judge them too harshly' is a silly thing to say. They didn't know what they

by tmtvl 1y ago

I vehemently disagree. 'Well, they didn't know what they were doing, so we shouldn't judge them too harshly' is a silly thing to say. They didn't know what they were doing _and still went through with it_. That's an aggravating, not extenuating, factor in my book. Kind of like if a driver kills someone in an accident and then turns out not to have a license.

dmitrygr 1y ago
+1: if you cannot do security, you have no business making dating apps. The kind of data those collect can ruin lives overnight. This is not a theory, here is a recent example: https://www.bbc.com/news/articles/c74nlgyv7r4o https://www.bbc.com/news/articles/c74nlgyv7r4o
- satanfirst 1y ago
  The claim that it should have come up in a government vetting process seems to be proof that one should publish one's own dating information before entrusting it to a site that might have lost it or worse might provide it to a government specifically.
- burnt-resistor 1y ago
  If you cannot do security, you have no business making any app people use in significant numbers containing Personally Identifiable Information (PII). Perhaps, like GDPR, HIPAA, and similar, any (web|platform)apps that contain login details and/or PII must thoroughly distance themselves from haphazard, organic, unprofessional, and (bad) amateurish processes and technologies and conform to trusted, proven patterns, processes, and technologies that are tested, audited, and preferably formally proven for correctness. Without formalization and professional standards, there are no standards and these preventable, reinvent-the-wheel-badly hacks will continue doing the same thing and expecting a different result™. Massive hacks, circumvention, scary bugs, other attacks will continue. And, I think this means a proper amount of accreditation, routine auditing, and (the scary word, but smartly) regulation to drag the industry (kicking-and-screaming if need by by showing using appropriate leadership on the government/NGO-SGE side) from an under-structured wild west™ into professionalism.
- steeeeeve 1y ago
  I would agree with you. Dating app data might not be legally protected like some PII out there, but there are easily foreseeable bad consequences from compromised dating app data of any kind. Security should be accounted for from the very beginning.
- const_cast 1y ago
  When I was a student I was leading a project where we made a timeclock web software. I enforced a no-login policy, because I didn't want potential users to even think about entering a password into a form on the website. I didn't trust myself or my group to handle it correctly, so I decided it was best to just side-step the problem. Naturally this made the application a lot less useful - but it was a student project, who cares. Software engineering students have an obligation to ethics just like all other engineers. We need to think these things through, and decide if we even want to implement features. And we need to be thinking in terms of risk, not design. Storing sensitive data is risky, even if you're really talented. Companies will try to put processes in place to mitigate that risk. But students are almost certainly not doing that, so they should be questioning if they should even be doing what they're doing in the first place.
- nhannht 1y ago
  Your statement similar to : If you cannot cook an egg on the normal pan without sticking problem, you should not serve food in chicken. They are merely unconstructive statement, developer have free will, they spent time and money to make the app, customer spent time and money to use their app. If there are any mistakes, util you prove that they were intentional harm the customer - or - violating the contract of data safety between the app and the customer, they are free to keep their business. The free market will decide what will happen next. And the link you gave as an example was just made nonsense. The victim was being fired from the position which worked for security of government because he did not have honesty from the start, did not inform that he use a dating app. With his private data in a dating app, even if they were not leaked: the data can be exchanged illegally in the background, which can lead to social engineering, harm the government and nation he is working for. Actually, that firm and the nation was lucky that his data was being leaked - on purpose by someone. It was his vault.
LadyCailin 1y ago
This is exactly why I think software engineering should require a licensing requirement, much like civil engineering. I get that people will complain about that destroying all sorts of things, and it might, yes, but fight me. Crap like this is exactly why it should be a requirement, and why you won’t convince me that the idea is not in general a good one.
- Implicated 1y ago
  Agreed. My stance on this changed over the course of some years after a close family member married an actual engineer (structural) and I got a lot of insight into that world. It's astonishing to me the ease of which software developers can wreak _real_ measurable damage to billions of lives and have no real liability for it. Software developers shouldn't call themselves engineers unless they're licensed, insured and able to be held liable for their work in the same way a building engineer is.
  - Spooky23 1y ago
    Some engineers like to go on about this, but the reality is they offload the work to marginally qualified techs and unlicensed engineers and stamp the document, just like in software. There are all sorts of failures in the structural space. How many pumped reinforced concrete buildings are being built in Miami right now? How many of them will be sound in 50-75 years? How likely is the architect/PE’s ghost to get sued? PE’s are smart professionals and do a valuable service. But they aren’t magic, and they all have a boss.
  - tonyhart7 1y ago
    well software generally harmless until you integrate in your car (see: Tesla) I think there defo a line where bug in your puzzle app don't need a license vs AI that drive your 50k+ tesla
- motorest 1y ago
  > This is exactly why I think software engineering should require a licensing requirement, much like civil engineering. Civil engineering requires licensing because there are specific activities that are reserved for licensed engineers, namely things that can result in many people dying. If a major screwup doesn't even motivate victims to sue a company then a license is not justified.
mmanfrin 1y ago
> They didn't know what they were doing _and still went through with it_ You don't know what you don't know; sometimes people can think they do know what they're doing and they just haven't encountered situations otherwise. We were all new to programming once; no one would ever become a solid engineer if they prevented themselves from building anything out of fear of doing something wrong that they did not account for out of lack of experience.
- tmtvl 1y ago
  This is where the 'unknown unknowns' quote comes in useful. I don't know anything about blockchain technology, but I know that I don't know anything about it. When you make software which involves handling people's information your first thought should be 'do I know all I need to know about handling this information properly?', and your second thought should be 'do I really know all I need to know about handling this information properly?'.
michaelteter 1y ago
Still not excusing them, but these HN responses are very hypocritical. US tech is built on the "go fast, break things" mentality. Companies with huge backers routinely fail at security, and some of them actually spend money to suppress those who expose the companies' poor privacy/security practices. If anything, college kids could at least reasonably claim ignorance, whereas a lot of HN folks here work for companies who do far worse and get away with it. Some companies, some unicorns, knowingly and wilfully break laws to get ahead. But they're big, and people are getting rich working for them, so we don't crucify them.
- ruszki 1y ago
  “Go fast, break things” was invented at places where the best developers worked on the world. Applying the mentality without great developers is not how great startups were made.
- mianos 1y ago
  It’s also why other regulatory zones outside the US, with much stronger privacy laws like the EU, don’t seem to produce as much innovation, while the US and China keep churning out new stuff. It’s a trade-off between shipping fast and courting risk. I’m not judging one over the other; it comes down to what you’re willing to accept, not what you wish for.
  - tmcdos 1y ago
    I would definitely accept more privacy rather than more innovation.
    - fennecfoxy 1y ago
      But money!
- make3 1y ago
  I'm not sure hypocritical is the right word as you have no idea who parent is, maybe it's Pope Bob for all you know
johnfn 1y ago
But no one was killed here, so your comparison really falls flat to me - there’s a reason we have a sliding scale of punishments that scale to the crime, and security issues are nowhere near the same level of severity as murder. It feels more like fining kids for putting up a lemonade stand without a business license.
paulddraper 1y ago
The difference is…this isn’t an automobile and the accident isn’t fatal.
- Anthony-G 1y ago
  You never know with data leaks from dating apps. A homosexual user would have to clearly state their sexual preferences and this could be dangerous for them if their local community is homophobic. Unfortunately, it’s also not uncommon for victims of “sextortion” to be driven to suicide from the stress and anxiety of being blackmailed. See also, the fallout of the Ashley Madison data breach: https://en.wikipedia.org/wiki/Ashley_Madison_data_breach https://en.wikipedia.org/wiki/Ashley_Madison_data_breach

by tmtvl 1y ago

dmitrygr 1y ago

+1: if you cannot do security, you have no business making dating apps. The kind of data those collect can ruin lives overnight. This is not a theory, here is a recent example: https://www.bbc.com/news/articles/c74nlgyv7r4o https://www.bbc.com/news/articles/c74nlgyv7r4o

satanfirst 1y ago
The claim that it should have come up in a government vetting process seems to be proof that one should publish one's own dating information before entrusting it to a site that might have lost it or worse might provide it to a government specifically.
burnt-resistor 1y ago
If you cannot do security, you have no business making any app people use in significant numbers containing Personally Identifiable Information (PII). Perhaps, like GDPR, HIPAA, and similar, any (web|platform)apps that contain login details and/or PII must thoroughly distance themselves from haphazard, organic, unprofessional, and (bad) amateurish processes and technologies and conform to trusted, proven patterns, processes, and technologies that are tested, audited, and preferably formally proven for correctness. Without formalization and professional standards, there are no standards and these preventable, reinvent-the-wheel-badly hacks will continue doing the same thing and expecting a different result™. Massive hacks, circumvention, scary bugs, other attacks will continue. And, I think this means a proper amount of accreditation, routine auditing, and (the scary word, but smartly) regulation to drag the industry (kicking-and-screaming if need by by showing using appropriate leadership on the government/NGO-SGE side) from an under-structured wild west™ into professionalism.
steeeeeve 1y ago
I would agree with you. Dating app data might not be legally protected like some PII out there, but there are easily foreseeable bad consequences from compromised dating app data of any kind. Security should be accounted for from the very beginning.
const_cast 1y ago
When I was a student I was leading a project where we made a timeclock web software. I enforced a no-login policy, because I didn't want potential users to even think about entering a password into a form on the website. I didn't trust myself or my group to handle it correctly, so I decided it was best to just side-step the problem. Naturally this made the application a lot less useful - but it was a student project, who cares. Software engineering students have an obligation to ethics just like all other engineers. We need to think these things through, and decide if we even want to implement features. And we need to be thinking in terms of risk, not design. Storing sensitive data is risky, even if you're really talented. Companies will try to put processes in place to mitigate that risk. But students are almost certainly not doing that, so they should be questioning if they should even be doing what they're doing in the first place.
nhannht 1y ago
Your statement similar to : If you cannot cook an egg on the normal pan without sticking problem, you should not serve food in chicken. They are merely unconstructive statement, developer have free will, they spent time and money to make the app, customer spent time and money to use their app. If there are any mistakes, util you prove that they were intentional harm the customer - or - violating the contract of data safety between the app and the customer, they are free to keep their business. The free market will decide what will happen next. And the link you gave as an example was just made nonsense. The victim was being fired from the position which worked for security of government because he did not have honesty from the start, did not inform that he use a dating app. With his private data in a dating app, even if they were not leaked: the data can be exchanged illegally in the background, which can lead to social engineering, harm the government and nation he is working for. Actually, that firm and the nation was lucky that his data was being leaked - on purpose by someone. It was his vault.

LadyCailin 1y ago

This is exactly why I think software engineering should require a licensing requirement, much like civil engineering. I get that people will complain about that destroying all sorts of things, and it might, yes, but fight me. Crap like this is exactly why it should be a requirement, and why you won’t convince me that the idea is not in general a good one.

Implicated 1y ago
Agreed. My stance on this changed over the course of some years after a close family member married an actual engineer (structural) and I got a lot of insight into that world. It's astonishing to me the ease of which software developers can wreak _real_ measurable damage to billions of lives and have no real liability for it. Software developers shouldn't call themselves engineers unless they're licensed, insured and able to be held liable for their work in the same way a building engineer is.
- Spooky23 1y ago
  Some engineers like to go on about this, but the reality is they offload the work to marginally qualified techs and unlicensed engineers and stamp the document, just like in software. There are all sorts of failures in the structural space. How many pumped reinforced concrete buildings are being built in Miami right now? How many of them will be sound in 50-75 years? How likely is the architect/PE’s ghost to get sued? PE’s are smart professionals and do a valuable service. But they aren’t magic, and they all have a boss.
- tonyhart7 1y ago
  well software generally harmless until you integrate in your car (see: Tesla) I think there defo a line where bug in your puzzle app don't need a license vs AI that drive your 50k+ tesla
motorest 1y ago
> This is exactly why I think software engineering should require a licensing requirement, much like civil engineering. Civil engineering requires licensing because there are specific activities that are reserved for licensed engineers, namely things that can result in many people dying. If a major screwup doesn't even motivate victims to sue a company then a license is not justified.

mmanfrin 1y ago

> They didn't know what they were doing _and still went through with it_ You don't know what you don't know; sometimes people can think they do know what they're doing and they just haven't encountered situations otherwise. We were all new to programming once; no one would ever become a solid engineer if they prevented themselves from building anything out of fear of doing something wrong that they did not account for out of lack of experience.

tmtvl 1y ago
This is where the 'unknown unknowns' quote comes in useful. I don't know anything about blockchain technology, but I know that I don't know anything about it. When you make software which involves handling people's information your first thought should be 'do I know all I need to know about handling this information properly?', and your second thought should be 'do I really know all I need to know about handling this information properly?'.

michaelteter 1y ago

Still not excusing them, but these HN responses are very hypocritical. US tech is built on the "go fast, break things" mentality. Companies with huge backers routinely fail at security, and some of them actually spend money to suppress those who expose the companies' poor privacy/security practices. If anything, college kids could at least reasonably claim ignorance, whereas a lot of HN folks here work for companies who do far worse and get away with it. Some companies, some unicorns, knowingly and wilfully break laws to get ahead. But they're big, and people are getting rich working for them, so we don't crucify them.

ruszki 1y ago
“Go fast, break things” was invented at places where the best developers worked on the world. Applying the mentality without great developers is not how great startups were made.
mianos 1y ago
It’s also why other regulatory zones outside the US, with much stronger privacy laws like the EU, don’t seem to produce as much innovation, while the US and China keep churning out new stuff. It’s a trade-off between shipping fast and courting risk. I’m not judging one over the other; it comes down to what you’re willing to accept, not what you wish for.
- tmcdos 1y ago
  I would definitely accept more privacy rather than more innovation.
  - fennecfoxy 1y ago
    But money!
make3 1y ago
I'm not sure hypocritical is the right word as you have no idea who parent is, maybe it's Pope Bob for all you know

johnfn 1y ago

But no one was killed here, so your comparison really falls flat to me - there’s a reason we have a sliding scale of punishments that scale to the crime, and security issues are nowhere near the same level of severity as murder. It feels more like fining kids for putting up a lemonade stand without a business license.

paulddraper 1y ago

The difference is…this isn’t an automobile and the accident isn’t fatal.

Anthony-G 1y ago
You never know with data leaks from dating apps. A homosexual user would have to clearly state their sexual preferences and this could be dangerous for them if their local community is homophobic. Unfortunately, it’s also not uncommon for victims of “sextortion” to be driven to suicide from the stress and anxiety of being blackmailed. See also, the fallout of the Ashley Madison data breach: https://en.wikipedia.org/wiki/Ashley_Madison_data_breach https://en.wikipedia.org/wiki/Ashley_Madison_data_breach