Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Instagram kept deleted photos and messages on its servers for more than a year

theverge.com

Post reply on HN
Print view View original

111–120 of 205 posts

Re: Instagram kept deleted photos and messages on its servers for more than a year

#111

Post by maxsilver »

davidhyde wrote: post #100
jacquesm wrote: post #58

Earlier quoted context omitted.

Because the goal is compliance, not to put companies out of business. When the laws were first enacted everybody was screaming that it was just to put companies out of business. Now they are wondering why the small initial fines. It's simple: change your ways and use the initial fines as a wake up call. If you then do not wake up and persist the fines will get heavier and heavier until you will pay attention. A Dutch…

Imagine if we lived in a society where you were given a small fine for the first time you commit murder and then life imprisonment for the second offence. This may lead people to believe that murder is a serious but forgivable offence when it is not. That’s my first argument: small fines play down the seriousness of the “crime”. My second argument is the efficiency of using capitalism to fight capitalism. Take money…

> Imagine if we lived in a society where you were given a small fine for the first time you commit (an offense) and then (a harsher punishment) for the second offence.

We do live in that society. For example, the first few time you get caught speeding, you get a warning or a ticket with a fine. Keep getting caught speeding, and you lose your license and/or go to jail.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#112

Post by kube-system »

wasmitnetzen wrote: post #72
rco8786 wrote: post #17

Earlier quoted context omitted.

A fine for what? Not fixing a minor bug in a timely fashion? That’s not a road we want to travel down.

If a car model has a defect, it has to be recalled and fixed in a timely fashion, otherwise, there will be a fine. Why should software be any different?

Software isn't any different.

Cars with defects don't have to be recalled.

Cars with defects that kill or maim people have to be recalled.

Software that does the same, also is recalled.

https://www.cpsc.gov/Recalls?combine=software

Re: Instagram kept deleted photos and messages on its servers for more than a year

#113

Post by xwdv »

jacquesm wrote: post #77
londons_explore wrote: post #64

Earlier quoted context omitted.

The vast majority of companies I've seen consider issuing "SQL DELETE" is sufficient for GDPR compliance. One day, they will be burned when some investigation finds out that those rows are still sitting in uncompacted tables, or on now-unallocated disk blocks, or on now-remapped SSD sectors. The only way to be sure the data is deleted is to copy all the data you want to keep to a new drive and burn the old one. Anyth…

All it takes is one dataleak[+] to blow that wide open. Secure erase is hard. But what is much less hard is to encrypt data and then to limit the problem to getting rid of the decryption key. This reduces the problem in scope to one single datum rather than a whole chain of possible plaintext copies. Secure erase is a contractual requirement for many relationships, it is interesting that none of the major db vendors…

God help you if your decryption key is destroyed somehow and you no longer have access to your own data. Fuck that.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#114

Post by jacquesm »

xwdv wrote: post #113
jacquesm wrote: post #77

Earlier quoted context omitted.

All it takes is one dataleak[+] to blow that wide open. Secure erase is hard. But what is much less hard is to encrypt data and then to limit the problem to getting rid of the decryption key. This reduces the problem in scope to one single datum rather than a whole chain of possible plaintext copies. Secure erase is a contractual requirement for many relationships, it is interesting that none of the major db vendors…

God help you if your decryption key is destroyed somehow and you no longer have access to your own data. Fuck that.

If you can't keep your keys around in a safe way you shouldn't be in this business to begin with.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#115

Post by hansvm »

imgabe wrote: post #48

I don't know how many times this is going to have to happen before people understand this: when you put something online, assume it is essentially public. Forever. If you don't want it to be public forever, don't put it online.

This seems like a reasonable enough perspective, especially for something like a photo. An average person still doesn't have a lot of power though in a world where the de facto standard is that goods and services are provided at a cost of all your data and usually some cash on top.

Opting out of the camera mesh being built in SF is impossible without moving. ISPs monetize our browsing habits, and a typical individual has no recourse -- common suggestions like a VPN just kick the can of trust down the road, and logless VPNs are usually proven to actually track you. Even if you didn't use any Google services, the adwords network is on the bulk of websites, and even with an ad blocker is a typical user expected to know that being logged in to Facebook means opting in to being similarly spied on nearly anywhere you visit on the web?

IMO it's reasonable to expect uploaded photos to live forever somewhere (even if GDPR obligates companies to do otherwise), but even learning how to opt out of the rest of what's collected where it's even possible would be a daunting task when undertaken from scratch that inevitably missed some key component and still resulted in being spied on and tracked. With that in mind, and given the scale of the problem, regulation preventing the most egregious of data-related offenses seems prudent.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#116

Post by holidayacct »

Whenever someone publishes an article like this, I want them to find out what its like when you reach the threshold of 100000 individual delete requests per second which ends up being five million actual deletes when you factor in all of the associated references to the item being deleted and its metadata. Then I want them to find out what happens when you have to propagate those deletes across geographically distributed data centers, clear a geographically distribute cache and do it in a way that minimizes user facing errors and guarantees consistency. Finally you have to also ensure that deletions don't effect any business facing applications since ad revenue and metrics are all generated from certain types of data.

These people imagine you just rm -rf a file and run a few SQL queries, you literally can't just delete data. I've worked at the scale of Instagram before. Literally nothing works like that at that scale, the person who wrote that article should have called up someone from Instagram and had them explain at a really high level how complicated deleting data is at large scale.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#117

Post by davidhyde »

jacquesm wrote: post #101
davidhyde wrote: post #100

Earlier quoted context omitted.

Imagine if we lived in a society where you were given a small fine for the first time you commit murder and then life imprisonment for the second offence. This may lead people to believe that murder is a serious but forgivable offence when it is not. That’s my first argument: small fines play down the seriousness of the “crime”. My second argument is the efficiency of using capitalism to fight capitalism. Take money…

(1) this isn't murder, so that's a false equivalent. Murder is in a different book of law than privacy laws. (2) small fines do not play down the seriousness of the transgression (which is the word I think you should be using for instances like this). They merely indicate that you should clean up your act assuming no real harm has been done. In some cases the regulators have immediately resorted to fines, and quite l…

You’ve made some good points there. I guess it’s a balancing act and if the regulators go too far too quickly then we may never get to that long term goal.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#118

Post by justwalt »

holidayacct wrote: post #116

Whenever someone publishes an article like this, I want them to find out what its like when you reach the threshold of 100000 individual delete requests per second which ends up being five million actual deletes when you factor in all of the associated references to the item being deleted and its metadata. Then I want them to find out what happens when you have to propagate those deletes across geographically distrib…

I’m hesitant to think they just couldn’t figure out how to make it work. Giving that company the benefit if the doubt seems like a bad idea.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#119

Post by GoodJokes »

holidayacct wrote: post #116

Whenever someone publishes an article like this, I want them to find out what its like when you reach the threshold of 100000 individual delete requests per second which ends up being five million actual deletes when you factor in all of the associated references to the item being deleted and its metadata. Then I want them to find out what happens when you have to propagate those deletes across geographically distrib…

Whenever someone writes a comment like this complaining that something is too hard I always want to remind them that that isn’t an excuse.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#120

Post by icedchai »

londons_explore wrote: post #64
jacquesm wrote: post #50

Earlier quoted context omitted.

Yes, especially backups and log files are hard. The databases are relatively easy if they allow for in place overwrites or compaction of tables. Even then you have to be careful. Data is funny that way. It is easy to acquire, easy to lose if you want to keep it and devilishly hard to get rid of for real if that is what you want to do.

The vast majority of companies I've seen consider issuing "SQL DELETE" is sufficient for GDPR compliance. One day, they will be burned when some investigation finds out that those rows are still sitting in uncompacted tables, or on now-unallocated disk blocks, or on now-remapped SSD sectors. The only way to be sure the data is deleted is to copy all the data you want to keep to a new drive and burn the old one. Anyth…

They probably know the odds of an "investigation" actually occurring is very low. The odds of one occurring with that level, or probably any level, of technical sophistication is near zero.
Post reply on HN