Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Instagram kept deleted photos and messages on its servers for more than a year

theverge.com

Post reply on HN
Print view View original

171–180 of 205 posts

Re: Instagram kept deleted photos and messages on its servers for more than a year

#171

Post by soamv »

holidayacct wrote: post #116

Whenever someone publishes an article like this, I want them to find out what its like when you reach the threshold of 100000 individual delete requests per second which ends up being five million actual deletes when you factor in all of the associated references to the item being deleted and its metadata. Then I want them to find out what happens when you have to propagate those deletes across geographically distrib…

I don't think people understand the vastness of resources that FB and Instagram have at their disposal. This is not a particularly hard problem. Yes it's not a simple SQL query. But they do solve it -- in fact this was a bug that they have already fixed.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#173

Post by toast0 »

AnonHP wrote: post #55

And here I am dreaming of a world where companies do real deletions of data when a user requests (and also deleting older transactional data that has outlived its utility, including regulatory requirements) and storage prices being lower with a slightly smaller (steady) market for it from the major companies. On the other hand, storage prices seem to be low enough for all these companies with bulk, long term contract…

> storage prices being lower with a slightly smaller (steady) market for it from the major companies.

I suspect that big companies in the market help justify manufacturer R&D into larger and faster and helps justify production capacity. I think we'd have smaller, slower, and slightly more expensive drives without their demand. But, speculation only.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#174

Post by vageli »

holidayacct wrote: post #129
kuschku wrote: post #125

Earlier quoted context omitted.

They've got 30 days to delete data, there's no excuse not to manage it within 30 days. Also, you're saying they intentionally built a software stack without even thinking about how to obey the law (the 30-day deletion requirement existed even before the GDPR, since 1996 even, just with lower fines) I hope in a few years this case will be taught in school just like the Therac case is being taught right now.

It's not that simple, some of these companies have tech stacks that are run-a-way trains written by people who had good intentions but wrote their code and built their infrastructure in a way that was meant for 1/50th of the traffic they currently have. I don't know anything about instagram's infrastructure but what I can tell you for certain is that every one of these companies has legacy infrastructure and code tha…

These companies are shipping new features every day. If they have the bandwidth to work on those projects then the failure to meet legal requirements is an issue of prioritization, leaving no excuse.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#175

Post by nthj »

jeffbee wrote: post #163
endtime wrote: post #144

Earlier quoted context omitted.

Google has an internal standard for how long it takes to wipe out user data after a deletion request, and compliance with it is taken very seriously. It's a lot less than 1 year.

I think this points to (one of) the significant flaws in the cult of the "minimal viable product". By eliding up-front design tasks, you may implement something in which complying with the law is impossible. Data retention compliance has to be designed in from the beginning, or it might be technically infeasible to add it later.

I think this is why you need a very senior engineer overseeing your MVP.

Before MVPs were championed, companies would create a full-fledged project management suite with 50 database models and release it to crickets.

An MBA and a junior engineer define an MVP as “You can log in, and add todo lists and check them off.”

A senior engineer defines that same MVP as “You can log in, add todo lists, check them off, delete your account, and if the server crashes or we’re hacked, we have backups for 30 days.”

Or in other words with an MVP you still need to complete the 80% of the iceberg the MBA and junior engineer can’t see, but you don’t build the whole iceberg at once.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#176

Post by superficialnerd »

ctvo wrote: post #136
holidayacct wrote: post #116

Whenever someone publishes an article like this, I want them to find out what its like when you reach the threshold of 100000 individual delete requests per second which ends up being five million actual deletes when you factor in all of the associated references to the item being deleted and its metadata. Then I want them to find out what happens when you have to propagate those deletes across geographically distrib…

Hi. I also work at this scale. It doesn't take a year to delete the data. Be upfront with your users: 'Your delete request is being processed. No one will be able to see this item though it may take up to three days for the data to be completely removed from our servers' This is not a technical challenge, it's an issue of priorities and Facebook doesn't prioritize privacy. They were able to release a TikTok clone in…

That's what, being upfront about something makes users to trust them but it's Facebook we're talking about.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#177

Post by parliament32 »

slg wrote: post #169
parliament32 wrote: post #158

Earlier quoted context omitted.

>It doesn't take a year to delete the data It does if you have cold backups that take a year to cycle out. They're often offsite, compressed, and incrementally hashed so finding individual items and removing them is really hard -- you're much better off just waiting for them to expire, and a year isn't an unreasonable amount of time.

The article specifically states this data was downloaded using the "Download Your Information tool on Instagram". The undeleted data wasn't from a cold backup or any backup, it was still on production systems.

If this is a GDPR "right to access" request, which most "download your information" tools are, then backups are included. See https://law.stackexchange.com/questions/27625/gdpr-complianc...

Re: Instagram kept deleted photos and messages on its servers for more than a year

#178

Post by slg »

parliament32 wrote: post #177
slg wrote: post #169

Earlier quoted context omitted.

The article specifically states this data was downloaded using the "Download Your Information tool on Instagram". The undeleted data wasn't from a cold backup or any backup, it was still on production systems.

If this is a GDPR "right to access" request, which most "download your information" tools are, then backups are included. See https://law.stackexchange.com/questions/27625/gdpr-complianc...

Doesn't that link show that the how backups related to GDPR is still up for debate? The accepted answer that says they are included has 3 upvotes and there is an answer that says no they aren't included that has 2 upvotes. Either way, the legal requirement is a separate issue from what Instagram is actually doing. If that download tool is automated, I am rather confident in saying that it isn't combing through year old backups to get data.

Re: Instagram kept deleted photos and messages on its servers for more than a year

#179

Post by bryan_w »

lozf wrote: post #122
j45 wrote: post #103

Earlier quoted context omitted.

If it takes deleting one's account to truly wipe your data, it should be made clear.

What makes you think even deleting one's account will truly wipe data? These companies profit from personal info whether one is a customer or not. I would imagine everything exists with a "user de-activated since $DATE" entry or similar in their database. Perhaps I'm too cynical?

Actually I think the incentives are aligned here.

If they can't show the pictures that they have claimed to have deleted then they can't use it to bring in eyes for advertisers, which means that the data is a net loss for them, causing them to have to buy more storage sooner.

They should want to delete data as soon as possible

Re: Instagram kept deleted photos and messages on its servers for more than a year

#180

Post by pirocks »

rco8786 wrote: post #82
jacquesm wrote: post #43

Earlier quoted context omitted.

Pulling linguistic tricks typically does not amuse regulators.

I'm curious what regulatory issue you think is in play here?

Gdpr has a right to deletion within 30 days. Companies have been fined for failing to do so.
Post reply on HN