11 ms·
The email they shouldn't have read
- OptionOfT 1y agoI hope one day we get to see real names in this story.
- stronglikedan 1y ago[flagged]
- vinceguidry 1y agoUtterly absurd. Names don't get called for fear of legal retaliation, it's that culture of fear that allows businesses to keep operating this way.
- dijit 1y agoWho's? The predatory bullshit in TFA is widespread, not just in Open Source. We should grant each other herd immunity by spreading knowledge of disreputable entities, ideally with receipts. You're basically complicit in abuse if you do nothing to help others. We're doing so with Oracle. Never knowingly do business with Oracle.
- bee_rider 1y agoThis company sounds like it is working (or at least did work, hard to say how long ago it was, pre-GDPR, so a while) in a really unethical manner. If we want the market and freedom-of-association to fix this sort of problem we need to learn who to avoid, right?
- reaperducer 1y agoI hope one day we get to see real names in this story. > to protect the privacy of the people and companies involved Companies get privacy rights now? Snark aside, I think I understand how this person feels. I once worked for a company that did something abhorrent during a natural disaster. I spoke up and was reprimanded, while my coworkers just sat there and accepted it. I came very close to losing my job, and ended up leaving the company at my first opportunity. It was 20 years ago, and I keep meaning to write an article about it, but never do. It's not that you want to protect the company, or that you're afraid of being sued. But there's something that weighs on you when you think about actually putting the words down. It's all a decade or more old, so what's the point? Nobody will be held to account. The company is no longer under the same leadership (or even the same name). My personal blog has a dead-man's switch that will reveal a number of ugly things about several of the companies for which I've worked. But who cares? That's part of the weight. What good will it do? If, by some remote chance, someone reads it, it will only make them mad. How does that help anything? But I'm also one of those people on HN who's always crying "name and shame." So, I'm a hypocrite. Such is life.
- deleted 1y ago[deleted]
- Lammy 1y agoApologies for trying to guess, but: PayPal freezing SomethingAwful's Katrina fundraiser?
- myko 1y agoI don't think PayPal's name changed
- thatguy0900 1y agoIt doesn't help that really everyone already understands that basically every company is completely devoid of morality and ethics. Noone who pays attention is surprised or shocked at companies taking advantage of disasters. They're not even above manufacturing the disaster themselves if they think they'll get away with it. Reporting on what they do feels like screaming into the void.
- lawlessone 1y agoI'm curious how you implement a deadmans switch for a blog?
- yason 1y agoSchedule a post to be published next month and bump it forward a sufficient period each time before it gets to trigger?
- gtirloni 1y agoThe author says the company is very litigious. He probably doesn't want them suing him on a personal basis, which makes a lot of sense. Keep in mind their own directors wouldn't pick a fight with this company themselves.
- Balgair 1y agoSo yeah, Oracle
- yadaeno 1y agoToo bad they are in EU which seems to not value free speech legally or culturally.
- 1oooqooq 1y agoi don't care much about the company names, they all "do" (as much as a inanimate object can do anything) that. i would love they mentioned the name of the people involved.
- megiddo 1y agoWhat's the point of this story? Bad actors win? Here's a hot take: Name and Shame. If this story is true, the author should be shouting their names from the rooftop. Instead, we get this nonsense.
- draga79 1y agoThe point is: always own your data
- jimmar 1y ago> What's the point of this story? Bad actors win? Know your contracts. Read the fine print. Be careful who you do business with. Not all companies selling services for open source software embrace the ethos that we assume they do. After reading the story, I can understand why somebody would not name and shame. The author could be inviting lawsuits from a company that clearly has no qualms playing dirty.
- draga79 1y agoExactly!
- lucianbr 1y agoSomething I read in the story is that the legal system fails to do its job: to make society fair. There are contracts and lawyers in the story, but they do not work toward ensuring fairness or justice, they work to help the company with more laywers and less scruples.
- bluGill 1y agoI know of no legal system that doesn't fail in some way. Some are much worse than others, but all have flaws. Often correcting the flaws is worse than living with them. Don't take the above as we should just accept the flaws. We should not. However what to do about them is a hard problem and we should not do something that makes things worse.
- 1y ago
- poszlem 1y agoThis is the kind of story that perfectly captures why “open source” != “freedom.” You can run 100% FOSS software and still be completely imprisoned if you give control to a middleman. The company in this story didn’t just sell “support”, they sold permission. They took something open, wrapped it in contracts, lock-ins, and managed-service handcuffs, and then claimed ownership of it. That’s the new vendor lock-in model: control the interface, not the code. The chilling part isn’t that they could read customer emails, it’s that they thought it was normal. Somewhere between “managed service” and “surveillance,” the moral line vanished, replaced by legalese. This story should be printed and taped above every government IT procurement desk. If you don’t own your servers, your keys, and your contracts, you don’t own your data, no matter how “open” the stack is.
- draga79 1y agoTotally agree (but I may be biased :-) )
- mr_toad 1y agoI disagree that you can’t own something that isn’t physically controlled by you. Almost all of us have money which is not kept on our persons or property, in banks and investments. I think people would be outraged if someone told them it belonged to the bank. What’s really important is the laws and regulations governing ownership. Ownership in a modern society is nearly entirely a legal construct. Ownership of data shouldn’t be any different.
- MYEUHD 1y ago> I disagree that you can’t own something that isn’t physically controlled by you. We're not talking about "something" in general, but about digital infrastructure. > Almost all of us have money which is not kept on our persons or property, in banks and investments. I think people would be outraged if someone told them it belonged to the bank. A better analogy is if you have a cryptocurrency wallet managed by Coinbase. You don't own. And they can in fact suspend your account (and probably take your crypto) if they don't like you.
- ACCount37 1y ago[flagged]
- draga79 1y agoIt's not...
- kstrauser 1y agoThere’s always that one jackass. Ignore them.
- draga79 1y agoNo problem. Given the amount of content generated by "AI" today, the doubt is more than legitimate.
- kstrauser 1y agoTrue, but every story — no matter the source — someone will want to feel clever by claiming it was written by AI. (Emdashes were included in the above to set off a siren in their brains.)
- DonHopkins 1y agoEmdashes are the new NI! https://www.youtube.com/watch?v=zIV4poUZAQo https://www.youtube.com/watch?v=zIV4poUZAQo
- OutOfHere 1y agoThat's what someone says when they're trying to suppress information.
- OutOfHere 1y ago(deleted)
- gipp 1y agoHow in the world did you read "hit piece on open source" into this article? There's nothing negative about open source at all, he's making exactly the same point as you.
- clownpenis_fart 1y agoSome companies are just incredibly naive sometimes. Case in point: i work at a game dev studio, and our main competitor on the segment we are on is a game published by Microsoft. The other day a coworker was talking about how that other game had a tendency to release similar content as us, sometimes right before us, with marketing material that looked eerily like stuff still in production from our marketing team, to the point that they suspected someone was leaking stuff. Dude, all we do is discussed on teams and it's all in documents stored in office 365. They dont need us to leak anything, they can simply read our team channels and our documents. They probably spend more time discussing plausible deniability with their legal team than researching what we do. We are also moving our analytics from Tableau to whatever Microsoft's equivalent, and nobody seems to see the issue with that either.
- chuckadams 1y agoI'm no lawyer, but I would think the purposes for which they read your email and the actions taken subsequently are blatantly illegal, and would invalidate the entire contract.
- Jolter 1y agoYes, but severing would end up in court versus a very belligerent party, who would do their utmost to cost you money. An organization that prioritizes safety over ethics will just suck up the extra cost, apparently. There are companies and organizations out there fighting for what’s right in courtrooms. Invalidating troll-owned patents, striking down unfair contracts etc. Agency A was obviously not one of those organizations.
- balderdash 1y agoI worked for a very successful multinational that I think was relatively moral (at least very moral vs average - e.g. we at least stood by our commitments and contracts and didn’t try and re-trade them if they went against us) and they took the approach that they were never going to be a “soft target”: nuisance law suits - litigate don’t settle, unethical behavior by vendors or customers - we’ll see you in court. It was probably more expensive for a decade or so, but over the long run it saved a ton of money and hassle.
- a_e_k 1y agoI remember that being the Newegg philosophy w.r.t. patent trolls.
- deleted 1y ago[deleted]
- indoordin0saur 1y agoYes, especially since this sounds like a government agency. Some contractor snuck a backdoor into your email servers and is secretly reading them? Imagine what kind of corrupt practices, up to and including foreign espionage, that they could get up to. They could have been justified in sending in the FBI or CIA if this was the US. Probably would have put a stop to their vendor problems really quick.
- adrian17 1y agoMaybe I'm confused with the timeline but the actors involved, but: > The company offered a managed version with its own proprietary additions Doesn't sound like open source to me?
- charles_f 1y agoI think it's one of these "reading the letter of the law" instances. European laws (or rather, laws in European countries) often mandate public sector to use open source. The reasons vary, some of them are about promoting interoperability, and avoiding vendor lock-in, digital sovereignty, and the EU commission has a principle of "public money = public code". So using open source on someone else's computer technically fulfills that requirement, without completing some of the reasons why the requirement exist (vendor lock-in in this particular instance is particularly laughable).
- Meneth 1y agoThere are plenty of projects like that. Gitlab, for example, has an open-source "Community Edition" and then "Premium" and "Ultimate" editions which they charge for.
- emmelaich 1y agoAnd even if it's all open source, there can be branding issues like Moodle and SugarCRM.
- elijahcarrel 1y agoI'm sorry but this reads like AI slop. Or maybe it's not AI slop, it's just regular human-generated slop, but regardless: it's useless. For one: it's intentionally completely unverifiable. Sure, maybe the writer's not brave enough to break their NDA by sharing names. But it's also convenient: nobody can ever poke holes in the story, or add their own context to it. The story just gets to live on its own and earn internet karma regardless of whether it's at all true. For two: completely inconsistent. Let's take these two paragraphs: > A few years earlier, a major public institution - let’s call it Agency A - was still running an ancient Exchange mail server. It hadn’t received security updates for ages, the anti-spam was completely ineffective, and the new regulations were clear: embrace Open Source solutions whenever possible. > They had already received a proposal - expensive but seemingly reasonable - for a managed service, hosted by an external provider, built on an open source mail stack. The company offered a managed version with its own proprietary additions and enterprise support. The catch? The price was absurd, and Agency A already had solid infrastructure - reputable IP classes, redundant datacenters, everything working fine. We had built and maintained that environment for years, and it was still running perfectly. So we have just learned in paragraph 1 that the current system is dated and full of security holes and missing features. In paragraph 2 we have learned that the current system's infrastructure is "solid" and "working fine". Can you really say the infrastructure is solid and working fine if it's preventing you from upgrading your Exchange mail server? And let's take paragraph two: it says the proposal is "expensive but seemingly reasonable" and then one sentence later says "the catch? The price is absurd". How can the price be both "reasonable" and "absurd?" Overall an annoying read.
- MontyCarloHall 1y agoI agree it's not written in the clearest way, nor verifiable (though Stefano Marinelli does seem to be a semi-public figure in the online IT community, so it's not some anonymous blog). >So we have just learned in paragraph 1 that the current system is dated and full of security holes and missing features. In paragraph 2 we have learned that the current system's infrastructure is "solid" and "working fine". This confused me too, until I realized that he probably meant that his company set up the hardware infrastructure ("reputable IP classes, redundant datacenters"), but doesn't manage the software. Otherwise, why shred your own credibility from the first sentence by crapping on the "ancient," "insecure," and "ineffective" Exchange server? >How can the price be both "reasonable" and "absurd?" Agreed, this part makes no sense.
- Workaccount2 1y agoSo make sure you fully read the fine print before signing an agreement for something. You should do this for consumer stuff, but it's mandatory for business stuff.
- morkalork 1y agoI'm curious about about how the "unilateral amendment" works. If you didn't like the fine print in it, do you have to give your six month termination notice then and there?
- danaris 1y agoIf they unilaterally amend the contract to go from 6 months' notice to 12 months' notice, then presumably you'd have to give your 12 month termination notice then and there... ...and hope they don't unilaterally amend the contract in the interim to allow them to retroactively extend the termination period. AFAIK, "unilateral amendment" should be considered at least very suspect by most courts?
- m-s-y 1y agoWhat’s the point of not naming names? This could easily be just a creative writing exercise.
- bluGill 1y agoThe truth is not a defense against libel laws in all countries. Depending on where this is the poster could be out a lot of money just for naming names. As such not naming names is the safe answer. Even in the US where the truth is a defense, you still can be out a lot of lawyer fees because you can be sued for things you say and it can cost a lot of hours in court.
- IncreasePosts 1y agoThe author is located in Italy, where "it's the truth" is not an absolute defense against defamation like you say - basically, here, causing "reputational harm" is actually against the law, even if you are telling the truth. There are a few exceptions like social interest which may apply, but it is a dangerous game to play because you need to prove that to the courts, as opposed to just proving what you wrote is what actually happened.
- gtirloni 1y agoIt's a curse we also inherited in Brazil. Companies can't have any marketing mentioning their competitors or they face lawsuits.
- SoftTalker 1y agoIn the USA it used to be very rare for companies to directly mention competitors in ads. Products would be compared to "Brand X" or some other genericized name instead. I think it still is somwhat rare. Why even let a potential customer know that a competitor exists?
- gtirloni 1y ago
- justin66 1y ago> However, to protect the privacy of the people and companies involved, I have deliberately mixed things up: technologies, contexts, and specific details have been modified or merged with other experiences. Why wouldn’t a person stop reading there, unless they were the author’s mom or roommate or something and were reading out of politeness?
- citizenpaul 1y agoI feel like many HN'ers have been in this situation. I was once in a confedential "back out" of a system. There was some shared code base with the other company. One of our devs made a comment that was something like "Reversing Migration Script" in the code. In less than an hour from that commit(I didn't know at the time) I was in stuck in a firestorm WTF DID YOU DO battle between the two CEO's of the companies. It turns out that the other company was ACTIVELY spying for such terms in the code so they could react if we tried to leave. It was going to be an honest non renewal at the end of the contract so not even anything shady. I didn't find out till later about how they were spying out so there was this huge witch hunt about who was the rat and such. It was awful. It seems this level of sociopathy is just the norm these days and I'm just an old fuddy duddy doing regular honest work without having a Machiavellian scheme running in parallel no wonder places only want to hire 20yo's /s /sorta.
- rossdavidh 1y agoWhile the story is infuriating, it is also: 1) completely from one person's version of events 2) absolutely unverifiable I can't help shaking the feeling that it could be ragebait? Which ended up on HN as a result? Sure, companies act like bullies sometimes, but I don't know that I think this story is more likely than "person I've never heard of makes up outrageous story for attention". Both seem equally plausible.
- indoordin0saur 1y agoThe thing that doesn't make sense to me is if there was pretty clear evidence that some vendor had put in a backdoor into the email servers of multiple government agencies and there were directors and managers at all of these agencies that had good reason to believe they were being spied on, then this would have warranted a criminal investigation of the contractor. At that point, voiding the contract, migrating to whatever other email service you have and getting out of the bill would have been easy. It wouldn't have mattered what sneaky language got slipped into the contract by the vendor, you do not ever get to spy on internal government emails.
- rcxdude 1y agoThe issue is the will to fight it, basically. Even if you're wronged, if the other party is belligerant you need to be willing to push for the criminal investigation, push for the transfer, defend yourself against lawsuits even if they're frivilous, etc. Many people in these organisations just want a quiet life and will bend over to such behaviour because the demands are not bad enough to make them want to fight it.
- swores 1y agoPerhaps you're right that it's government agencies (I may have even skimmed over a mention confirming that?) but my assumption, especially after the author mentioned one of the "agencies" being about 500 people total, is that he's more likely talking about something like a marketing or design agency, or a talent agency, or... something.
- 1y ago
- indoordin0saur 1y agoSounds like Oracle. Of course, they're much more clever about how they do it but always recommend people stay as far away from any of their products as possible.
- myko 1y agoExactly how I read it
- hluska 1y agoThere’s something odd about this story. Not naming companies is weird - this happened before GDPR which means it happened a minimum of nine years ago. There were no lawyers involved at any point, not even before signing amendments with a company known for punishing vendors on their way out. Nobody even seemed to mind that this shady company with such a bad reputation was reading client emails. There was no attempt to warn anybody or to even solve the problem. I don’t believe that this ever happened. I don’t know why someone would make up a story like this but this one is very odd.
- draga79 1y agoOf course, you're free to think that. Sometimes dynamics aren't very linear and people are more inclined to avoid problems rather than create more. The concern about this company was obviously well-founded and valid, and the people involved didn't like it. Some of the choices they made were undoubtedly questionable, and I admit I was disappointed. Of course, I couldn't tell the whole story or all the details, but in the end, the company didn't get away with it completely. This event gained some traction through word-of-mouth among colleagues, and their user base plummeted in a short time.
- hamilyon2 1y ago>a horror story based on real events So is it fiction? Details matter. If any of the details are not true, this makes story is waaay less interesting.
- ceejayoz 1y ago"However, to protect the privacy of the people and companies involved, I have deliberately mixed things up: technologies, contexts, and specific details have been modified or merged with other experiences." Enough changes to avoid a libel suit, I'd imagine. Like when media outlets use and disclose a fake name for someone's story out of fear for retaliation.
- buran77 1y agoThis guy really works in a "minefield", with trouble and powerful enemies at every step. https://news.ycombinator.com/item?id=43985971 https://news.ycombinator.com/item?id=43985971
- toyg 1y agoThe minefield is just the reality of the Italian business landscape. In a country dominated by small companies run by families and friends, this sort of thing happens every other day. In that particular story, if true, I bet the writer is a relative of someone in the branch of police dedicated to tax checks (the much-feared Guardia di Finanza, who effectively wields power of life and death over most small businesses).
- thisisit 1y ago> a former interim IT manager still had an email client connected via token authentication - with access to all messages. And that person had signed the original contract with the provider years before. Informally questioned, he admitted contacting them "to warn them" but claimed it was harmless. This kind of behavior rubs me the wrong way. People leaking stuff, breaking compliance and then say - It was just harmless. I work with a Director who has done something similar multiple times. The chain of events often is - She attends an industry conferences, there she learns about a piece of software, she goes ahead and schedules product demos and solicits a contract. She then contacts the only outsourcing agency she is aware of and promises to give them the implementation contract. Then reaches out as she doesn't have the authority to sign those contracts. Since the time I have been responsible for product selection this has happened twice. Both times I have been under different managers. Both managers have insisted it was harmless. Last time this happened the Director was told by promising work and soliciting contracts she was in gross non compliance of the company policies. Her response showed how little she cared. As per her, this was an internal matter and no one could punish her. Later when we evaluated the product and it promised to "get better with time". All the company's data was being ingested into an AI without regard for enterprise data security rules. Even then her response was - What is the big deal? Everyone reads everyone's data. Legal got involved and shut it down - they asked the product to turn off AI features for our instances. It is really hard to contend against a malicious or dumb team mate. In a corporate setting if they are higher than you then it is even more difficult. They can chalk it up to a harmless mistake and no one can do a thing.
- dec0dedab0de 1y agoI worked for two very large fortune 100 companies. Both of them had people in management quite obviously taking personal kickbacks from vendors. Sometimes right out in the open. I would loudly point it out in meetings, which got me uninvited from a bunch of meetings.
- D-Coder 1y ago> which got me uninvited from a bunch of meetings. So, not a total loss.
- Dylan16807 1y ago> The request was simple: “Evaluate this solution, and if it’s suitable, we’ll migrate.”. This took me a few tries to figure out. "This solution" is the open source stack without the vendor from the previous paragraph. I thought it was including the vendor and got very confused when more comparisons started to happen.
- kazinator 1y ago> That strongly suggested it: it looked as if they might have been reading the emails. That sounds like it might be grounds for criminal charges, if evidenced properly, the threat of which could be used to get that company to back down.
- deleted 1y ago[deleted]