Instead of deleting account, NYT appends ‘1000’ to username and email address

Post by dmux » Tue, Apr 28, 2020, 8:49 PM UTC

sopooneo wrote: post #63

unicornfinder wrote: post #43

Earlier quoted context omitted.

That and why not allow null for the foreign key constraint and set it to nullify upon deletion? Or indeed, anonymise data.

I have used that pattern in my apps and found it works well. But then I've watched video from respected DB experts, that I learn a great deal from, where they practically beg you to stop using nullable columns. So I'm torn, because I think there may just be a major problem I've not yet grown my apps big enough to suffer. Anyone have thoughts either way?

Post by ericd » Tue, Apr 28, 2020, 9:05 PM UTC

Dahoon wrote: post #114

tomwojcik wrote: post #94

Earlier quoted context omitted.

Yes and no. PII needs to be removed. The rest of the data needs to be anonymized. Right?

But an email is PII so clearly this would breach GDPR.

Post by nikisweeting » Tue, Apr 28, 2020, 9:07 PM UTC

hinkley wrote: post #90

DevX101 wrote: post #64

Doing real deletes on user accounts is a surprisingly challenging problem and I'd be willing to bet very few companies do real deletes where all of your data is wiped permanently from the company. For legal and financial reasons, companies often need to keep track of historical user activity. If a company states in their investor quarterly report that they had 1M active users, they better be able to prove it in an au…

And something I had to learn the hard way and then teach quite a few people is that hard deletes don’t just turn your tables into Swiss cheese, they also can cause table scans. When you delete a row, every inbound foreign key constraint has to be checked to look for any rows that refer to the deleted row, and most likely you didn’t set up an index for the foreign key, so now you have a table scan. Possibly several. I…

Post by DonHopkins » Tue, Apr 28, 2020, 9:18 PM UTC

thewebcount wrote: post #96

ornornor wrote: post #35

Netflix does that too. You can’t delete your account so they just append a string like “csr_morgan” in the domain so that your account is “deleted” (you can’t login anymore, because your email address technically doesn’t have an account anymore) and you can re-register with your email later if you wish. But I’d you use the altered email and the same password, everything is still there. Pretty sure this goes against G…

What happens when you re-register with the same email address and then later cancel again?

Post by ashtonkem » Tue, Apr 28, 2020, 9:24 PM UTC

KeepFlying wrote: post #116

samthecoy wrote: post #39

Earlier quoted context omitted.

From the twitter comments: https://twitter.com/bicycult/status/1255122953798328320 They were still logged in and refreshed the page; they found out by going to their user settings.

I noticed a similar thing being done for Bird scooters a while back. I forget the suffix but they did the same and I noticed because I was still authed on my phone after requesting deletion. My token has expired since then though so for all I know they have fully deleted the account since.