4 ms·

> “The surprising part is that Valleywag knowingly outed their own source. Valleywag actually knew the screenshot had identifying information of the individual

by zavulon 13y ago

> “The surprising part is that Valleywag knowingly outed their own source. Valleywag actually knew the screenshot had identifying information of the individual leaker prior to them publishing this story,” Kalanick told TechCrunch in a statement. “We told Nitasha Tiku from Valleywag that we would protect her source from legal ramifications if they did not publish the document. Nitasha and Valleywag decided to publish anyways. I've said it here before, and I'll say it again: ValleyWag/Gawker Media are scum. This is just another entry in a long list of terrible things they do to get pageviews.

deleted 13y ago
[deleted]
untog 13y ago
You cut it off a little early: Editor John Cook told us that the screenshots did not, in fact, have any identifying information. “We didn't publish any identifying information about the source of the screengrab,” Cook says. “We don't know who sent us that shot, and neither does Uber. Now, I can't say which one of the two is telling the truth, but at least give both sides of the story. Looking at the shots, I'm not sure what is personally identifiable, though the bookmarks bar could give some clues. And Travis's threat of legal action might just be hot air from him (which isn't exactly unprecedented). After all, these numbers look very good for Uber. I wouldn't want to be one of their competitors trying to raise a round of funding right now.
- kmfrk 13y ago
  Privacy isn't exactly binary, though, so the point still stands that you should probably not leak to ValleyWag. Privacy is like a game of 20 Questions where the adversary intends to hone in on the full identity. Regardless of whether the source is identified, it is still unfathomably sloppy on ValleyWag's part in protecting their sources.
- zavulon 13y ago
  Look at the comment to the article: > It's a shame when tech journalists don't understand tech. Of course, they outed their source. With the time stamp Uber can check which employees looked at that page at a particular time. They can then ask these employees [likely just one] whose computer they were using at that time to figure out who grabbed the screenshot and sold it to ValleyWag. So it's either VW didn't realize this, or fully realized it and still outed their source because they don't give a shit. Given their history of outing their sources, even after specifically being asked not to, I think the latter is much more likely.
  - untog 13y ago
    With the time stamp Uber can check which employees looked at that page at a particular time. I think it's a bit of a leap to assume that the Uber admin system logs every user pageview. It may well do, but many home-grown systems (and it certainly looks homegrown) don't bother with that level of detail. Certainly, if they were that security conscious you'd think they'd also avoid allowing any employee to see overall revenue figures.
    - ars_technician 13y ago
      Apache access log by default has this. Doesn't matter how crappy the upper layers are.
      - untog 13y ago
        Page views, yes. User account used, no.
        jc4p 13y ago
        Assuming they're using Apache's basic logs wouldn't it be insanely easy to track down all URLs visited by that IP? After you login to Uber.com it instantly does a GET to /api/clients/[PERSUMABLY_USER_ID]?parameters which would be in the logs or they might have logs of user logins on their side (to show users a 'you've recently logged in from...' list somewhere)
- gojomo 13y ago
  The personally-identifiable bit could be a watermark: slight coloration changes. It could also be the last-updated time, or particular numbers in a column... which would have only been served to a single account in a logged transaction. A company that cares about its proprietary information can easily log and/or watermark everything served via internal tools.
- deleted 13y ago
  [deleted]
joelandren 13y ago
This is what news organizations do. They find newsworthy information and provide it to the public. TechCrunch or the Wall Street Journal would do the same thing. The press doesn't exist to cheerlead (in most cases). There's no arguing that Uber's numbers are newsworthy, so I don't see anything wrong with Valleywag's coverage in this instance.
benologist 13y ago
> I've said it here before, and I'll say it again: ValleyWag/Gawker Media are scum. This is just another entry in a long list of terrible things they do to get pageviews. Jokes on them cause AOL successfully hijacked their story anyway.

by zavulon 13y ago

deleted 13y ago

[deleted]

untog 13y ago

You cut it off a little early: Editor John Cook told us that the screenshots did not, in fact, have any identifying information. “We didn't publish any identifying information about the source of the screengrab,” Cook says. “We don't know who sent us that shot, and neither does Uber. Now, I can't say which one of the two is telling the truth, but at least give both sides of the story. Looking at the shots, I'm not sure what is personally identifiable, though the bookmarks bar could give some clues. And Travis's threat of legal action might just be hot air from him (which isn't exactly unprecedented). After all, these numbers look very good for Uber. I wouldn't want to be one of their competitors trying to raise a round of funding right now.

kmfrk 13y ago
Privacy isn't exactly binary, though, so the point still stands that you should probably not leak to ValleyWag. Privacy is like a game of 20 Questions where the adversary intends to hone in on the full identity. Regardless of whether the source is identified, it is still unfathomably sloppy on ValleyWag's part in protecting their sources.
zavulon 13y ago
Look at the comment to the article: > It's a shame when tech journalists don't understand tech. Of course, they outed their source. With the time stamp Uber can check which employees looked at that page at a particular time. They can then ask these employees [likely just one] whose computer they were using at that time to figure out who grabbed the screenshot and sold it to ValleyWag. So it's either VW didn't realize this, or fully realized it and still outed their source because they don't give a shit. Given their history of outing their sources, even after specifically being asked not to, I think the latter is much more likely.
- untog 13y ago
  With the time stamp Uber can check which employees looked at that page at a particular time. I think it's a bit of a leap to assume that the Uber admin system logs every user pageview. It may well do, but many home-grown systems (and it certainly looks homegrown) don't bother with that level of detail. Certainly, if they were that security conscious you'd think they'd also avoid allowing any employee to see overall revenue figures.
  - ars_technician 13y ago
    Apache access log by default has this. Doesn't matter how crappy the upper layers are.
    - untog 13y ago
      Page views, yes. User account used, no.
      - jc4p 13y ago
        Assuming they're using Apache's basic logs wouldn't it be insanely easy to track down all URLs visited by that IP? After you login to Uber.com it instantly does a GET to /api/clients/[PERSUMABLY_USER_ID]?parameters which would be in the logs or they might have logs of user logins on their side (to show users a 'you've recently logged in from...' list somewhere)
gojomo 13y ago
The personally-identifiable bit could be a watermark: slight coloration changes. It could also be the last-updated time, or particular numbers in a column... which would have only been served to a single account in a logged transaction. A company that cares about its proprietary information can easily log and/or watermark everything served via internal tools.
deleted 13y ago
[deleted]

joelandren 13y ago

This is what news organizations do. They find newsworthy information and provide it to the public. TechCrunch or the Wall Street Journal would do the same thing. The press doesn't exist to cheerlead (in most cases). There's no arguing that Uber's numbers are newsworthy, so I don't see anything wrong with Valleywag's coverage in this instance.

benologist 13y ago

> I've said it here before, and I'll say it again: ValleyWag/Gawker Media are scum. This is just another entry in a long list of terrible things they do to get pageviews. Jokes on them cause AOL successfully hijacked their story anyway.