What happens if I create an account at both foo@gmail.com and foo1000@gmail.com (or even foo+@gmail.com and foo+1000@gmail.com), and then delete the first one?
1001
/s
Instead of deleting account, NYT appends ‘1000’ to username and email address
141–150 of 167 posts
Re: Instead of deleting account, NYT appends ‘1000’ to username and email address
#142Earlier quoted context omitted.
From the twitter comments: https://twitter.com/bicycult/status/1255122953798328320 They were still logged in and refreshed the page; they found out by going to their user settings.
I've seen this same method used on multiples apps I've requested an account deletion on. It's super frustrating. Most companies either don't respond back, say they deleted it when they merely disabled it, or they updated the account name to something else.
Disabling is understandable, because as a company you need a record of transactions or interactions such as TOS agreements for legal purposes. This requires keeping the records.
Changing object name data though is a terrible practice to implement this.
Re: Instead of deleting account, NYT appends ‘1000’ to username and email address
#143Earlier quoted context omitted.
I've seen this same method used on multiples apps I've requested an account deletion on. It's super frustrating. Most companies either don't respond back, say they deleted it when they merely disabled it, or they updated the account name to something else.
Disabling is understandable, because as a company you need a record of transactions or interactions such as TOS agreements for legal purposes. This requires keeping the records. Changing object name data though is a terrible practice to implement this.
[deleted]
Re: Instead of deleting account, NYT appends ‘1000’ to username and email address
#144Earlier quoted context omitted.
You can use row level security so that forgetting the filter isn't an issue.
as far as I understand this would only work for users who don't have access to "deleted" rows. Are access rules a good way to handle this? Serious question. My solution would be to have views as "guards" for every table.
Views also work.
I don't understand what you mean re "access". RLS is what removes access to those rows, that's the point of RLS.
In postgresql, anyways, superusers aren't subject to RLS and the table owner, by default, isn't either. But RLS can be enforced for the table owner by a single alter statement.
Re: Instead of deleting account, NYT appends ‘1000’ to username and email address
#145Earlier quoted context omitted.
I used to work where (not a service for the general public) there was an "is deleted" flag for everything, but every now and then a client would insist that data be really deleted, and depending on who it was and how they asked, we might go and do it, which was a huge hassle and would cause no end of problems down the line. On the other hand, "is deleted" flags end up causing issues when you forget to put "where not…
The discard gem for rails has put a lot of thought into this and works pretty well, all things considered. It's not perfect, but I find using a library (either directly for inspiration) is often a shortcut to learning about a lot of edge cases from doing your own things. https://github.com/jhawthorn/discard
a library ? You literally just need a boolean variable in your datastore of choice.
Re: Instead of deleting account, NYT appends ‘1000’ to username and email address
#146Doing real deletes on user accounts is a surprisingly challenging problem and I'd be willing to bet very few companies do real deletes where all of your data is wiped permanently from the company. For legal and financial reasons, companies often need to keep track of historical user activity. If a company states in their investor quarterly report that they had 1M active users, they better be able to prove it in an au…
I used to work where (not a service for the general public) there was an "is deleted" flag for everything, but every now and then a client would insist that data be really deleted, and depending on who it was and how they asked, we might go and do it, which was a huge hassle and would cause no end of problems down the line. On the other hand, "is deleted" flags end up causing issues when you forget to put "where not…
I've been on both sides of this insisting, if a company annoyed me too much (e.g. headhunters mailing too frequently) I'd drop the "data privacy laws" (nowadays GDPR) bomb and ask for my data to be deleted.
On the other side, a customer got really pissed off by an online shop we maintained for a client, and asked for his data to be annihilated, we thought "What a douche.".
Re: Instead of deleting account, NYT appends ‘1000’ to username and email address
#147Doing real deletes on user accounts is a surprisingly challenging problem and I'd be willing to bet very few companies do real deletes where all of your data is wiped permanently from the company. For legal and financial reasons, companies often need to keep track of historical user activity. If a company states in their investor quarterly report that they had 1M active users, they better be able to prove it in an au…
There is also a user-valuable reason to not do hard deletes. Doing a soft delete prevents another malicious user from immediately reclaiming your now-available ID and pretending to be you.
Renaming your username to username-1000 has the exact same side effect though.
Re: Instead of deleting account, NYT appends ‘1000’ to username and email address
#148Earlier quoted context omitted.
There is also a user-valuable reason to not do hard deletes. Doing a soft delete prevents another malicious user from immediately reclaiming your now-available ID and pretending to be you.
Renaming your username to username-1000 has the exact same side effect though.
Yeah, that is about the worst possible way to do it. If you can't do a hard delete for whatever reason, the right way to do it is to set a flag that prevents any activity on that account. They can keep the name in order to prevent anyone else from stealing it, but still delete all the profile data attached to the account.
Re: Instead of deleting account, NYT appends ‘1000’ to username and email address
#149Earlier quoted context omitted.
The email address doesn’t really need to be valid though. I have an old client that appended ‘|disabled’ after the email address (and torched the password) when “deleting” accounts because they needed them in the DB for audit logging. Unless someone figures out how to register a domain ending in ‘.com|disabled’ I’m not sure how someone would be able to access those accounts.
Every week we see multiple articles about security researchers who abuses some part of the tech stack to do something weird that shows the danger in this sort of thinking. I believe it's easy to spoof emails from the .com|disabled domain. Receiving messages, I agree, seems harder. Maybe spoof an unencrypted DNS response at the right moment? No need to actually register a domain when DNS is spoofable.[1] If you really…
My guess would be that they don't want to have that email accidentally used, but they would have a check in the codepath anyway, because no-one wants to see its logs spammed with myriads DNS errors when this can be avoided. And in fact, if a DNS error shows up in the logs, devs would know that somehow their code path is not completely safe, so that change on the email is perhaps a way for them to ensure that the disabled account is indeed seen as disabled by their code in every situation.
A lot of people are complaining about NYT approach, but perhaps their only fault - if one consider that not deleting for good an account is not an issue, and it seems to be a common practice in the industry - is to not use a transaction when disabling user accounts (disable email -> disable account), which is perhaps difficult with NoSQL setups?
Re: Instead of deleting account, NYT appends ‘1000’ to username and email address
#150Earlier quoted context omitted.
The real issue is with the local (European) company when they claim the expense against profits and the tax inspector turns their nose up at the invoice/receipt. Being in the UK, we tend to work on a system where things are taken in context and you can defend such decisions. Maybe other tax regimes are more restrictive, but the British way is always that you can have a debate with authorities and usually they will se…
Just to make this kind of confusing story less confusing—the Pinboard guy prints valid invoices (in order to be legally compliant, and because he's "not a totally evil guy"). Someone (from Germany) asked him to add Company Name to the invoice, and he replied by saying "just edit the HTML to add whatever you need". https://twitter.com/i/status/1192182812121583617 The actual tweets probably explain it better than I (an…
Ha, the tweets I remember are from years and years ago. Maybe 2015? Really funny that the invoice thing has been such a consistent part of the Pinboard Experience for so long.
Since this predates threads, I can’t find all the tweets but this is one of them: