4 ms·

Why do companies still risk doing these kinds of things anymore? Externally we have some amazing security researchers who look out and dig these things out - a

by sherdil2022 1y ago

Why do companies still risk doing these kinds of things anymore? Externally we have some amazing security researchers who look out and dig these things out - and try to hold the companies responsible. And what is the internal process? Wouldn't these intrusive and privacy violating features (to track users for ex) be captured in design docs, emails, chats, code changes/PRs - and up for discovery? Aren't employees saying anything against these features? What culture are they building? What leadership are they demonstrating? It can't all be about money by any cost damn the users and their privacy/rights, right?

neepi 1y ago
It’s because they are assholes and think they can get away with it. There’s no other reason. Now imagine what would happen without any regulation at all…
- yua_mikami 1y ago
  Sadly they do get away with it.
- dylan604 1y ago
  There is no thinking. They do get away with it. Why are you trying to tap dance around this?
  - neepi 1y ago
    Well I have some hope in time that they stop getting away with it and are punished for getting away with it for a long time.
    - dylan604 1y ago
      either I'm a jaded summabitch or you must be new. there is no evidence your hope is warranted in the vast historical evidence of evilCorp getting away with it
      - neepi 1y ago
        [flagged]
- SoftTalker 1y ago
  Businesses move faster than regulation. Not that we give up on regulation, but the problem is deeper. As John Adams wrote: We have no Government armed with Power capable of contending with human Passions unbridled by morality and Religion. Avarice, Ambition, Revenge or Gallantry, would break the strongest Cords of our Constitution as a Whale goes through a Net. Our Constitution was made only for a moral and religious people. It is wholly inadequate to the government of any other.
  - yencabulator 1y ago
    Nah that's just poor regulation. Try telling a Nordic judge that what you did was technically not illegal, you'll find you're still liable. It's all about intent and spirit of the law vs letter of the law.
Hilift 1y ago
$70 billion per year net profit. Basically printing money at this point.
spencerflem 1y ago
"It can't all be about money by any cost damn the users and their privacy/rights, right?" As far as I can tell, that's the mandate.
amelius 1y ago
At this point I want to see some physical wrist slapping. Select some wronged user and invite them to slap Zuck's wrists with a wooden stick and put it on YouTube. This will be more satisfactory than the fines which are just the cost of doing business.
- neepi 1y ago
  I'd rather see him lose all his money and protection and be as vulnerable as his users are.
  - amelius 1y ago
    Force him to add a rotten tomato to his brand logos so users can see what they are dealing with. Or take away his trademarks altogether. Brands are about trust, so it makes sense.
i80and 1y ago
> Aren't employees saying anything against these features? Likely, but it's just demoralized workplace grousing. Tech employees are statistically sycophantic, and the exceptions get burned out or tossed out by executives who say things like "why don't they just shut up and work"
- SoftTalker 1y ago
  And people have done way worse than this, at the behest of their leaders, without pushback. Most people are followers.
  - djaychela 1y ago
    > Most people are followers. And the tech industry leaders are mostly spoiled, entitled mill/billionaires who eject anyone who crosses them. A team of moral imbeciles. Society is screwed until Zuckerberg, Bezos, Musk et al are stripped of their power and wealth. Which will never happen.
- burningChrome 1y ago
  Companies also have their executives do things like tell you that they only use data ethically and responsibly, then turn around and sell it to the highest bidder. A lot of times unless you're on a team or in a department that's doing this stuff for nefarious purposes, you wouldn't know. Anecdotal evidence: I worked in RPA (robotic process automation) for a large software company. We were tasked with automating a decision process. The decision process was completely benign. Something like a payments process. Pretty easy. We finished it in a few months start to finish. We hand it off, it goes into production. A lot of back slapping and high fives happen. I go on with my work, move out of the company a few months later. About a year later, a guy I worked with at the company emails me a news story about a company using the RPA program we built to auto deny insurance claims for their clients. Massive class action lawsuit. The insurance company had taken our script and just re-purposed it to auto deny a certain percentage of claims. I was shocked and dismayed that someone would use the stuff we built for their own shady business practices. It was a huge wakeup call that even when you're building something completely benign, a company can pay millions for it and reuse it to do bad things to people and you'll never know until its too late.
pengaru 1y ago
companies are composed of people people are usually motivated by more and faster this means whatever opportunities present themselves for short-term more and faster will have no shortage of takers TL;DR myopic greed
- spencerflem 1y ago
  I don't think people even are, in general. Most people I meet are very nice and feel a little weird about their employer. Companies are something else beyond people, which has a mind of its own. And leadership selects for sociopathy.
  - pengaru 1y ago
    When you get to a company the size of which we're speaking, there are always takers for the short-term enrich-myself options. It's really not that complicated, if I squint hard enough it looks like an obvious tragedy of the commons variant.
    - spencerflem 1y ago
      No totally, but I don't think most people are like that. 20% maybe? Enough to easily fill every slot but I hate blaming people in general, y'know?
add-sub-mul-div 1y ago
Can we not treat it as axiomatic by now that there is little to no risk of accountability from either the law or from undiscerning end users?
svachalek 1y ago
It's been clear for a long time what Meta is about. Anyone working there has long ago compromised any feelings they have for it in exchange for a paycheck. And it seems sucking up to whatever political powers are winning today has served to keep them out of governmental interference.
wyldberry 1y ago
The more well compensated someone is, the less likely they are going to be to speak out. The employees are more than comfortable. Also, the incentive structure for reward (stock price etc) is predicated by squeezing every last bit of monetization out. They already know ahead of time how much money a new feature could bring in, and the potential litigation cost before hand. If revenue > litigation/fine expense, they are going to do it.
altcognito 1y ago
Frankly because if we had real consequences, Mark Zuckerberg would have been in jail for "accidentally" letting Cambridge Analytica scrape their data "unknowingly". Or he would have faced consequences at Harvard for scraping user data. He's obviously not the only one, but absolutely one of the higher profile cases.
bobek 1y ago
Well, it is the same as all those examples of people "just doing their jobs" in concentration camps. Being compliant, focused on execution of their ~orders~ process. Interestingly, many people are being pre-emptively harsher, than required/requested. Checkout "Those Who Said No" (DOI 10.2307/1429971).
joshstrange 1y ago
> Why do companies still risk doing these kinds of things anymore? Money > Externally we have some amazing security researchers who look out and dig these things out - and try to hold the companies responsible. At worst they get some bad PR but most people aren't listening to security researchers (or don't care). Companies aren't being held "responsible" for anything, maybe a small fine but that's just the cost of doing business. > And what is the internal process? Wouldn't these intrusive and privacy violating features (to track users for ex) be captured in design docs, emails, chats, code changes/PRs - and up for discovery? Yes, probably all these things exist. See also Apple talking about how to make linking-out sound as scary as possible. There are chats with employees brainstorming how to make it scarier to end-users to drive them back into the IAP flow. > Aren't employees saying anything against these features? Some are afraid of losing their job or getting branded as a non-team-player. Some don't care. It can be easy to get lost in "implement the spec" instead of "is what I'm building morally ok?" > What culture are they building? A bad one. > What leadership are they demonstrating? That they only care about money and what they can get away with. Even if they get caught the profits outstrip the fine by a large margin. "It's just numbers/business". > It can't all be about money by any cost damn the users and their privacy/rights, right? It is.
sneak 1y ago
This might apply here: https://en.wikipedia.org/wiki/Obedience_to_Authority:_An_Experimental_View https://en.wikipedia.org/wiki/Obedience_to_Authority:_An_Exp... I recommend reading the book, it has a ton of useful stuff in it beyond what everyone knows about the Milgram experiment.

neepi 1y ago

It’s because they are assholes and think they can get away with it. There’s no other reason. Now imagine what would happen without any regulation at all…

yua_mikami 1y ago
Sadly they do get away with it.
dylan604 1y ago
There is no thinking. They do get away with it. Why are you trying to tap dance around this?
- neepi 1y ago
  Well I have some hope in time that they stop getting away with it and are punished for getting away with it for a long time.
  - dylan604 1y ago
    either I'm a jaded summabitch or you must be new. there is no evidence your hope is warranted in the vast historical evidence of evilCorp getting away with it
    - neepi 1y ago
      [flagged]
SoftTalker 1y ago
Businesses move faster than regulation. Not that we give up on regulation, but the problem is deeper. As John Adams wrote: We have no Government armed with Power capable of contending with human Passions unbridled by morality and Religion. Avarice, Ambition, Revenge or Gallantry, would break the strongest Cords of our Constitution as a Whale goes through a Net. Our Constitution was made only for a moral and religious people. It is wholly inadequate to the government of any other.
- yencabulator 1y ago
  Nah that's just poor regulation. Try telling a Nordic judge that what you did was technically not illegal, you'll find you're still liable. It's all about intent and spirit of the law vs letter of the law.

Hilift 1y ago

$70 billion per year net profit. Basically printing money at this point.

spencerflem 1y ago

"It can't all be about money by any cost damn the users and their privacy/rights, right?" As far as I can tell, that's the mandate.

amelius 1y ago

At this point I want to see some physical wrist slapping. Select some wronged user and invite them to slap Zuck's wrists with a wooden stick and put it on YouTube. This will be more satisfactory than the fines which are just the cost of doing business.

neepi 1y ago
I'd rather see him lose all his money and protection and be as vulnerable as his users are.
- amelius 1y ago
  Force him to add a rotten tomato to his brand logos so users can see what they are dealing with. Or take away his trademarks altogether. Brands are about trust, so it makes sense.

i80and 1y ago

> Aren't employees saying anything against these features? Likely, but it's just demoralized workplace grousing. Tech employees are statistically sycophantic, and the exceptions get burned out or tossed out by executives who say things like "why don't they just shut up and work"

SoftTalker 1y ago
And people have done way worse than this, at the behest of their leaders, without pushback. Most people are followers.
- djaychela 1y ago
  > Most people are followers. And the tech industry leaders are mostly spoiled, entitled mill/billionaires who eject anyone who crosses them. A team of moral imbeciles. Society is screwed until Zuckerberg, Bezos, Musk et al are stripped of their power and wealth. Which will never happen.
burningChrome 1y ago
Companies also have their executives do things like tell you that they only use data ethically and responsibly, then turn around and sell it to the highest bidder. A lot of times unless you're on a team or in a department that's doing this stuff for nefarious purposes, you wouldn't know. Anecdotal evidence: I worked in RPA (robotic process automation) for a large software company. We were tasked with automating a decision process. The decision process was completely benign. Something like a payments process. Pretty easy. We finished it in a few months start to finish. We hand it off, it goes into production. A lot of back slapping and high fives happen. I go on with my work, move out of the company a few months later. About a year later, a guy I worked with at the company emails me a news story about a company using the RPA program we built to auto deny insurance claims for their clients. Massive class action lawsuit. The insurance company had taken our script and just re-purposed it to auto deny a certain percentage of claims. I was shocked and dismayed that someone would use the stuff we built for their own shady business practices. It was a huge wakeup call that even when you're building something completely benign, a company can pay millions for it and reuse it to do bad things to people and you'll never know until its too late.

pengaru 1y ago

companies are composed of people people are usually motivated by more and faster this means whatever opportunities present themselves for short-term more and faster will have no shortage of takers TL;DR myopic greed

spencerflem 1y ago
I don't think people even are, in general. Most people I meet are very nice and feel a little weird about their employer. Companies are something else beyond people, which has a mind of its own. And leadership selects for sociopathy.
- pengaru 1y ago
  When you get to a company the size of which we're speaking, there are always takers for the short-term enrich-myself options. It's really not that complicated, if I squint hard enough it looks like an obvious tragedy of the commons variant.
  - spencerflem 1y ago
    No totally, but I don't think most people are like that. 20% maybe? Enough to easily fill every slot but I hate blaming people in general, y'know?

add-sub-mul-div 1y ago

Can we not treat it as axiomatic by now that there is little to no risk of accountability from either the law or from undiscerning end users?

svachalek 1y ago

It's been clear for a long time what Meta is about. Anyone working there has long ago compromised any feelings they have for it in exchange for a paycheck. And it seems sucking up to whatever political powers are winning today has served to keep them out of governmental interference.

wyldberry 1y ago

The more well compensated someone is, the less likely they are going to be to speak out. The employees are more than comfortable. Also, the incentive structure for reward (stock price etc) is predicated by squeezing every last bit of monetization out. They already know ahead of time how much money a new feature could bring in, and the potential litigation cost before hand. If revenue > litigation/fine expense, they are going to do it.

altcognito 1y ago

Frankly because if we had real consequences, Mark Zuckerberg would have been in jail for "accidentally" letting Cambridge Analytica scrape their data "unknowingly". Or he would have faced consequences at Harvard for scraping user data. He's obviously not the only one, but absolutely one of the higher profile cases.

bobek 1y ago

Well, it is the same as all those examples of people "just doing their jobs" in concentration camps. Being compliant, focused on execution of their ~orders~ process. Interestingly, many people are being pre-emptively harsher, than required/requested. Checkout "Those Who Said No" (DOI 10.2307/1429971).

joshstrange 1y ago

> Why do companies still risk doing these kinds of things anymore? Money > Externally we have some amazing security researchers who look out and dig these things out - and try to hold the companies responsible. At worst they get some bad PR but most people aren't listening to security researchers (or don't care). Companies aren't being held "responsible" for anything, maybe a small fine but that's just the cost of doing business. > And what is the internal process? Wouldn't these intrusive and privacy violating features (to track users for ex) be captured in design docs, emails, chats, code changes/PRs - and up for discovery? Yes, probably all these things exist. See also Apple talking about how to make linking-out sound as scary as possible. There are chats with employees brainstorming how to make it scarier to end-users to drive them back into the IAP flow. > Aren't employees saying anything against these features? Some are afraid of losing their job or getting branded as a non-team-player. Some don't care. It can be easy to get lost in "implement the spec" instead of "is what I'm building morally ok?" > What culture are they building? A bad one. > What leadership are they demonstrating? That they only care about money and what they can get away with. Even if they get caught the profits outstrip the fine by a large margin. "It's just numbers/business". > It can't all be about money by any cost damn the users and their privacy/rights, right? It is.

sneak 1y ago

This might apply here: https://en.wikipedia.org/wiki/Obedience_to_Authority:_An_Experimental_View https://en.wikipedia.org/wiki/Obedience_to_Authority:_An_Exp... I recommend reading the book, it has a ton of useful stuff in it beyond what everyone knows about the Milgram experiment.