Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Instagram kept deleted photos and messages on its servers for more than a year

theverge.com

Post reply on HN
Print view View original

121–130 of 205 posts

Re: Instagram kept deleted photos and messages on its servers for more than a year

#121

Post by jacquesm »

davidhyde wrote: post #117
jacquesm wrote: post #101

Earlier quoted context omitted.

(1) this isn't murder, so that's a false equivalent. Murder is in a different book of law than privacy laws. (2) small fines do not play down the seriousness of the transgression (which is the word I think you should be using for instances like this). They merely indicate that you should clean up your act assuming no real harm has been done. In some cases the regulators have immediately resorted to fines, and quite l…

You’ve made some good points there. I guess it’s a balancing act and if the regulators go too far too quickly then we may never get to that long term goal.

Exactly. I keep a close watch on the fines via the enforcement tracker. I think some of them are too strict, some too lenient but overall the picture is actually quite ok.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#122

Post by lozf »

j45 wrote: post #103
tgsovlerkhgsel wrote: post #4

> "The researcher reported an issue where someone’s deleted Instagram images and messages would be included in a copy of their information (...) We’ve fixed the issue" This makes it sound like they consider "you could see it" the issue, not "we were still keeping it". In other words, the fix was to hide it, not to delete it. If I were the Irish DPA (and actually wanted to do my job and had the resources to, instead o…

If it takes deleting one's account to truly wipe your data, it should be made clear.

What makes you think even deleting one's account will truly wipe data?

These companies profit from personal info whether one is a customer or not. I would imagine everything exists with a "user de-activated since $DATE" entry or similar in their database.

Perhaps I'm too cynical?

Re: Instagram kept deleted photos and messages on its servers for more than a year

#123

Post by jacquesm »

icedchai wrote: post #120
londons_explore wrote: post #64

Earlier quoted context omitted.

The vast majority of companies I've seen consider issuing "SQL DELETE" is sufficient for GDPR compliance. One day, they will be burned when some investigation finds out that those rows are still sitting in uncompacted tables, or on now-unallocated disk blocks, or on now-remapped SSD sectors. The only way to be sure the data is deleted is to copy all the data you want to keep to a new drive and burn the old one. Anyth…

They probably know the odds of an "investigation" actually occurring is very low. The odds of one occurring with that level, or probably any level, of technical sophistication is near zero.

From regulators: yes, they typically work reactive, until there is some kind of breach you'll never hear from them. From investors, customers and potential acquirers audits are pretty common and becoming more so every day.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#124

Post by yalogin »

I assume all companies except may be Apple and google never delete the data even if they provide the delete option. For example, I still keep getting emails from mint saying that my credit score has changed even though I deleted all my info from my account.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#125

Post by kuschku »

holidayacct wrote: post #116

Whenever someone publishes an article like this, I want them to find out what its like when you reach the threshold of 100000 individual delete requests per second which ends up being five million actual deletes when you factor in all of the associated references to the item being deleted and its metadata. Then I want them to find out what happens when you have to propagate those deletes across geographically distrib…

They've got 30 days to delete data, there's no excuse not to manage it within 30 days.

Also, you're saying they intentionally built a software stack without even thinking about how to obey the law (the 30-day deletion requirement existed even before the GDPR, since 1996 even, just with lower fines)

I hope in a few years this case will be taught in school just like the Therac case is being taught right now.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#126

Post by stevievee »

holidayacct wrote: post #116

Whenever someone publishes an article like this, I want them to find out what its like when you reach the threshold of 100000 individual delete requests per second which ends up being five million actual deletes when you factor in all of the associated references to the item being deleted and its metadata. Then I want them to find out what happens when you have to propagate those deletes across geographically distrib…

This rationalization isn't acceptable to me. They have gladly set up the infrastructure to handle a high volume of new information and it should go both ways.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#127

Post by loriverkutya »

holidayacct wrote: post #116

Whenever someone publishes an article like this, I want them to find out what its like when you reach the threshold of 100000 individual delete requests per second which ends up being five million actual deletes when you factor in all of the associated references to the item being deleted and its metadata. Then I want them to find out what happens when you have to propagate those deletes across geographically distrib…

Whenever I see someone write a comment like this, I want him to understand, that don't say deleted, if it's not deleted.

Also, if it not works at scale, don't tell your users that it works and pretend it works as you communicated.

I find really bothering, when engineers trying to hide behind the "it's a very complicated process in the background, so we just say we have done something, when the truth is, it is in progress. It's not a user error, when you see the word "deleted" you assume, your picture is gone, it's your error, if you state it's gone, while it is not.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#129

Post by holidayacct »

kuschku wrote: post #125
holidayacct wrote: post #116

Whenever someone publishes an article like this, I want them to find out what its like when you reach the threshold of 100000 individual delete requests per second which ends up being five million actual deletes when you factor in all of the associated references to the item being deleted and its metadata. Then I want them to find out what happens when you have to propagate those deletes across geographically distrib…

They've got 30 days to delete data, there's no excuse not to manage it within 30 days. Also, you're saying they intentionally built a software stack without even thinking about how to obey the law (the 30-day deletion requirement existed even before the GDPR, since 1996 even, just with lower fines) I hope in a few years this case will be taught in school just like the Therac case is being taught right now.

It's not that simple, some of these companies have tech stacks that are run-a-way trains written by people who had good intentions but wrote their code and built their infrastructure in a way that was meant for 1/50th of the traffic they currently have. I don't know anything about instagram's infrastructure but what I can tell you for certain is that every one of these companies has legacy infrastructure and code that keeps them from being able to meet all legal requirements. You can't just make a blanket statement that they don't have an excuse.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#130

Post by anon73044 »

stevievee wrote: post #126
holidayacct wrote: post #116

Whenever someone publishes an article like this, I want them to find out what its like when you reach the threshold of 100000 individual delete requests per second which ends up being five million actual deletes when you factor in all of the associated references to the item being deleted and its metadata. Then I want them to find out what happens when you have to propagate those deletes across geographically distrib…

This rationalization isn't acceptable to me. They have gladly set up the infrastructure to handle a high volume of new information and it should go both ways.

should See RFC 2119, "should" usually denotes something as "optional" But really, almost zero companies build software around data in such a way that the data could and will disappear at any moment.
Post reply on HN