5 ms·

Hi, co-founder of Roam, Josh here. I don't recall your case ever being brought up to me, but as Baibhav said in his comment, we have strict no-access rule for e

Hi, co-founder of Roam, Josh here. I don't recall your case ever being brought up to me, but as Baibhav said in his comment, we have strict no-access rule for engineers. They (and me) are only allowed to open your graph if given explicit permission by you through support. We have always had this rule and it's in our terms and conditions. I think I found your account and I don't see any access logs to your graph from anyone other than your account. If you can provide any more info or screenshots of we would be able to dig deeper into exactly what you saw. It could have been a console log or a hard coded employee email in the code. We've always cared deeply about user's privacy and ownership over their notes. This is why we've had this policy from the start and focused heavily on local first features and data portability. We offer fully offline graphs, where the data never touches our server and is never able to be accessed by anyone on our team. We also offer fully encrypted graphs, which are stored on our servers but are not able to be read by anyone without the password (our team cannot read your data).

dzink 1y ago
You are in luck. I found a little video I took of the screen when it happened. It was from Aug 11 2020. Here is a screenshot with the log details: https://www.dropbox.com/scl/fi/g9jv8eh1ugi5qda0c6azx/08112020RoamScreenshot.PNG?rlkey=y90tpdoifxp8zd1bouj1mnkt5&st=lstp2y6f&dl=0 https://www.dropbox.com/scl/fi/g9jv8eh1ugi5qda0c6azx/0811202...
- dzink 1y ago
  Here is another screenshot and screenshots of the email exchange with the person in the logs. https://www.dropbox.com/scl/fi/v0x26d5jvou5k9gvx5tnd/IMG_2057.JPG?rlkey=w69w7972p6ahyehqe1bepqfon&dl=0 https://www.dropbox.com/scl/fi/v0x26d5jvou5k9gvx5tnd/IMG_205... Emails: https://www.dropbox.com/scl/fi/s6ed1brrcvc0hncig7nm0/IMG_2059.PNG?rlkey=6dawu5xxdfo894ofh3ozmljy4&dl=0 https://www.dropbox.com/scl/fi/s6ed1brrcvc0hncig7nm0/IMG_205... https://www.dropbox.com/scl/fi/ohafavhr9nlqfedlbfxrd/IMG_2060.PNG?rlkey=yx5e2hu995sal5fk9tw9xxz6o&dl=0 https://www.dropbox.com/scl/fi/ohafavhr9nlqfedlbfxrd/IMG_206...
  - kstrauser 1y ago
    What the hell. Thank you for keeping the receipts. That's astonishingly not-ok.
    - baibhavbista 1y ago
      Hey, clarifying Roam actually DID NOT READ THEIR DATA (we have always had the policy of never accessing user data without explicit user permission). She just misunderstood what she was looking at. More (verifiable) details in my comment here: https://news.ycombinator.com/item?id=44047945 https://news.ycombinator.com/item?id=44047945
      - kstrauser 1y ago
        Got it. Not being an expert on that, I’ll take you at your word. But in the spirit of constructive criticism, your user had been carrying that belief for 5 years now because no one explained it when they originally reported the finding.
        deleted 1y ago
        [deleted]
  - hashbrown490 1y ago
    Baibhav posted this screenshot down the thread, but I wanted to add some more context. We followed up with our ex-employee to get the final (cutoff) message in this email thread https://firebasestorage.googleapis.com/v0/b/firescript-577a2.appspot.com/o/imgs%2Fapp%2Fbaibhav-test-public%2FkXYdT2M7FK.png?alt=media&token=397af937-a176-47a2-8991-9504f9caace8 https://firebasestorage.googleapis.com/v0/b/firescript-577a2... In it he tries to explain that these are help graph transactions they are seeing. I do apologize if you didn't understand it at the time, but we did try to explain it to you. I Hope this clears up everything for anyone following along.
- baibhavbista 1y ago
  Hey thank you for replying! I understand what the screenshots are saying and this makes it clear that it was a misunderstanding and that NO ONE ACCESSED YOUR GRAPH(S). Please let me explain Lets start with your first screenshot: https://www.dropbox.com/scl/fi/g9jv8eh1ugi5qda0c6azx/08112020RoamScreenshot.PNG?rlkey=y90tpdoifxp8zd1bouj1mnkt5&e=1&st=lstp2y6f&dl=0 https://www.dropbox.com/scl/fi/g9jv8eh1ugi5qda0c6azx/0811202... If you take a look at this screenshot, it shows that the values you saw are in the indexeddb db "..._help-tx". The "help" bit denotes that those are the actions/txs taken in the "help" graph (which you can access via https://roamresearch.com/#/app/help https://roamresearch.com/#/app/help). The reason you're seeing Bardia and Conor's emails there is because they wrote in the help graph (maybe they were writing guides there or adding stuff to the changelog). The reason the help graph data is in your indexedDB is because you probably opened the help graph at some point. If someone had accessed your graphs, similar txs would have shown instead in the indexeddb dbs "..._DZ-tx" or "..._programming-with-categories-tx" Everything I've said above can be verified if you say go to any Roam graph, and see what dbs are stored in IndexedDB in the devtools. Hopefully this makes sense. Also, as Bardia replied in the email, we have never and will never edit user notes without explicit permission. tl;dr: You thought you were looking at the logs for your graph but you were looking at the logs for the "help" graph. This is easily verifiable from your screenshots itself if you know where to look (details above).
  - kstrauser 1y ago
    If I were the user, I would’ve been unsatisfied with that answer. They had logs showing that yes, someone did appear to access their notes. No one seems to have corrected the misunderstanding at the time, which might’ve turned them back into a happy Roam user. Don’t do that. Things like this are an opportunity to overcommunicate. Explain in detail to the user, who’s smart enough to use the tools to reveal the information in the first place. Write up a FAQ entry explaining this for the next person so you can point them right to it. Don’t just reply to say basically “you didn’t actually see that” and leave it at that.
    - baibhavbista5 1y ago
      Thank you Yes, definitely a communication misstep on our part, and we could've handled it much better I have a second comment there too, but got delayed in posting because HN rate-limited my account for too many comments
- hashbrown490 1y ago
  Thanks for sharing, see Baibhav's response for what happened here, these logs you are seeing are for the public help graph, not your personal graph.
deleted 1y ago
[deleted]

dzink 1y ago

You are in luck. I found a little video I took of the screen when it happened. It was from Aug 11 2020. Here is a screenshot with the log details: https://www.dropbox.com/scl/fi/g9jv8eh1ugi5qda0c6azx/08112020RoamScreenshot.PNG?rlkey=y90tpdoifxp8zd1bouj1mnkt5&st=lstp2y6f&dl=0 https://www.dropbox.com/scl/fi/g9jv8eh1ugi5qda0c6azx/0811202...

dzink 1y ago
Here is another screenshot and screenshots of the email exchange with the person in the logs. https://www.dropbox.com/scl/fi/v0x26d5jvou5k9gvx5tnd/IMG_2057.JPG?rlkey=w69w7972p6ahyehqe1bepqfon&dl=0 https://www.dropbox.com/scl/fi/v0x26d5jvou5k9gvx5tnd/IMG_205... Emails: https://www.dropbox.com/scl/fi/s6ed1brrcvc0hncig7nm0/IMG_2059.PNG?rlkey=6dawu5xxdfo894ofh3ozmljy4&dl=0 https://www.dropbox.com/scl/fi/s6ed1brrcvc0hncig7nm0/IMG_205... https://www.dropbox.com/scl/fi/ohafavhr9nlqfedlbfxrd/IMG_2060.PNG?rlkey=yx5e2hu995sal5fk9tw9xxz6o&dl=0 https://www.dropbox.com/scl/fi/ohafavhr9nlqfedlbfxrd/IMG_206...
- kstrauser 1y ago
  What the hell. Thank you for keeping the receipts. That's astonishingly not-ok.
  - baibhavbista 1y ago
    Hey, clarifying Roam actually DID NOT READ THEIR DATA (we have always had the policy of never accessing user data without explicit user permission). She just misunderstood what she was looking at. More (verifiable) details in my comment here: https://news.ycombinator.com/item?id=44047945 https://news.ycombinator.com/item?id=44047945
    - kstrauser 1y ago
      Got it. Not being an expert on that, I’ll take you at your word. But in the spirit of constructive criticism, your user had been carrying that belief for 5 years now because no one explained it when they originally reported the finding.
      - deleted 1y ago
        [deleted]
- hashbrown490 1y ago
  Baibhav posted this screenshot down the thread, but I wanted to add some more context. We followed up with our ex-employee to get the final (cutoff) message in this email thread https://firebasestorage.googleapis.com/v0/b/firescript-577a2.appspot.com/o/imgs%2Fapp%2Fbaibhav-test-public%2FkXYdT2M7FK.png?alt=media&token=397af937-a176-47a2-8991-9504f9caace8 https://firebasestorage.googleapis.com/v0/b/firescript-577a2... In it he tries to explain that these are help graph transactions they are seeing. I do apologize if you didn't understand it at the time, but we did try to explain it to you. I Hope this clears up everything for anyone following along.
baibhavbista 1y ago
Hey thank you for replying! I understand what the screenshots are saying and this makes it clear that it was a misunderstanding and that NO ONE ACCESSED YOUR GRAPH(S). Please let me explain Lets start with your first screenshot: https://www.dropbox.com/scl/fi/g9jv8eh1ugi5qda0c6azx/08112020RoamScreenshot.PNG?rlkey=y90tpdoifxp8zd1bouj1mnkt5&e=1&st=lstp2y6f&dl=0 https://www.dropbox.com/scl/fi/g9jv8eh1ugi5qda0c6azx/0811202... If you take a look at this screenshot, it shows that the values you saw are in the indexeddb db "..._help-tx". The "help" bit denotes that those are the actions/txs taken in the "help" graph (which you can access via https://roamresearch.com/#/app/help https://roamresearch.com/#/app/help). The reason you're seeing Bardia and Conor's emails there is because they wrote in the help graph (maybe they were writing guides there or adding stuff to the changelog). The reason the help graph data is in your indexedDB is because you probably opened the help graph at some point. If someone had accessed your graphs, similar txs would have shown instead in the indexeddb dbs "..._DZ-tx" or "..._programming-with-categories-tx" Everything I've said above can be verified if you say go to any Roam graph, and see what dbs are stored in IndexedDB in the devtools. Hopefully this makes sense. Also, as Bardia replied in the email, we have never and will never edit user notes without explicit permission. tl;dr: You thought you were looking at the logs for your graph but you were looking at the logs for the "help" graph. This is easily verifiable from your screenshots itself if you know where to look (details above).
- kstrauser 1y ago
  If I were the user, I would’ve been unsatisfied with that answer. They had logs showing that yes, someone did appear to access their notes. No one seems to have corrected the misunderstanding at the time, which might’ve turned them back into a happy Roam user. Don’t do that. Things like this are an opportunity to overcommunicate. Explain in detail to the user, who’s smart enough to use the tools to reveal the information in the first place. Write up a FAQ entry explaining this for the next person so you can point them right to it. Don’t just reply to say basically “you didn’t actually see that” and leave it at that.
  - baibhavbista5 1y ago
    Thank you Yes, definitely a communication misstep on our part, and we could've handled it much better I have a second comment there too, but got delayed in posting because HN rate-limited my account for too many comments
hashbrown490 1y ago
Thanks for sharing, see Baibhav's response for what happened here, these logs you are seeing are for the public help graph, not your personal graph.

deleted 1y ago

[deleted]