[dead]
You can't leak users' data if you don't hold it
51–60 of 170 posts
Re: You can't leak users' data if you don't hold it
#52Except you can leak data even if you don't hold it. You are focusing on data at rest. Not storing the data obviously helps massively, but a bug or maliciously inserted code could lead to user data becoming compromised.
We shouldn’t let perfect be the enemy of good
Re: You can't leak users' data if you don't hold it
#53Earlier quoted context omitted.
Not sure about GP, but I did read the post. If they get acquired, I don't see anything stopping the acquirer from pushing an update that decrypts stuff and sends the plaintext to the servers.
I'm rather baffled at this level of nitpicking. Yes, if the software was being written by completely different people with completely different goals they might then start to acquire user data but what does that have to do with the point (that data this team and this management don't have cannot be leaked)?
Because their current solution doesn’t meet their own stated goals.
> even if we are competent enough to prevent a leak from ever happening, and even if our users trust us to do what we say, we must be resilient to being strong-armed by a future controlling power (e.g. if someone we don't trust buys us)
They could be strong armed into collecting data and then handing it over.
Re: You can't leak users' data if you don't hold it
#54> Our first product is an iOS app designed to help you capture the best moments in your life I have increasingly come to the belief that mediating our life experiences and social interactions through apps isn't good for us. Your website "Matter" [1], to be honest, seems completely dystopian to me and an indication of all that's wrong with the relationship between technology and society. [1] https://matter.xyz/
Their website is an epitome of idiocy of modern web product design. They want my email, because we are all "stardust". There is no clear explanation of what their product is or how it's different from a photo app and a notebook. Instead of a proper description of their business, they send to the Business Insider article about the founder who wants to prevent unhappiness.
I was reading your comments as a classic overly negative hn comment but then went straight to that website and wow, yep that's bad.
I can't tell if they're trying to sell me groundbreaking new brain scan technology or very dodgy supplements. Possibly one of the most vague product sites I've seen and there are a lot that come up on here.
I'm surprised this happens in tech so much. I feel I'm always very aware of people in the real world having no idea what I work on, so I always need to give background and context. I have noticed people in other industries haven't experienced that their whole life so often rattle off jargon that means nothing to me.
Looks like all the founders are US based, maybe it's a cultural thing.
Re: You can't leak users' data if you don't hold it
#55I agree with the core idea, avoid saving info so you can't ever leak it. I personally think our legal framework should be based on consequences to encourage this mentality more. If you are hacked I don't care even a little that you did everything right, I just care that my information got taken. You should be held liable even if you did what the industry thought was right.
> avoid saving info so you can't ever leak it
I think that this is a good idea. It's similar to the principle of least privilege: keep only what you need to offer the service you are providing. Less risk for the provider, less risk for the consumer.
However, at least in the USA, I've noticed an increasing number of companies who have determined that personal data is worth good money. This is why most stores have rewards programs, where they capture what you've bought and when you have bought it.
If it was just about repeat business, they'd still be using punch cards, like they did a decade ago.
I don't have any insight into how they use the data, but why would they offer free things (restaurants offer appetizers, grocery stores offer discounts, etc) unless the value they received was more than the cost of the incentive?
Re: You can't leak users' data if you don't hold it
#56For a SaaS app I built, I am using a third-party IDP/IDaaS, and thought about holding all user data as metadata in that directory so the only thing my app database stored was a foreign key for user, and I'd be able to really leverage the warrantied security of the provider. In the end I needed faster access to the user metadata so now am storing in database. Meh. Not sure if first idea was a good one or not - I know that depending on the type of breach, that user info stored in the directory could still be accessed, but was really attracted to the idea of not having a damn bit of it in my own db for purpose of getting just a bit closer to the idea of not leaking it if it's not there.
Re: You can't leak users' data if you don't hold it
#57I agree with the core idea, avoid saving info so you can't ever leak it. I personally think our legal framework should be based on consequences to encourage this mentality more. If you are hacked I don't care even a little that you did everything right, I just care that my information got taken. You should be held liable even if you did what the industry thought was right.
> avoid saving info so you can't ever leak it I think that this is a good idea. It's similar to the principle of least privilege: keep only what you need to offer the service you are providing. Less risk for the provider, less risk for the consumer. However, at least in the USA, I've noticed an increasing number of companies who have determined that personal data is worth good money. This is why most stores have rewa…
I am still waiting for digital identity.
Not sure why I can’t authenticate myself with these companies based on a private key and any details they want be disclosed to them for whatever reason don’t just come ephemerally from my server.
Obviously, you could also have a third party acting in this space for the non-tech savvy.
Right now all my data is held by corporate types who don’t give a shit.
Re: You can't leak users' data if you don't hold it
#58Earlier quoted context omitted.
I wish I could keep my updates off. Every time I turn on my computer dnfdragora is like "there are 35 new updates!" Oh yeah? But my computer is working. Those updates could fix problems that I don't have but could break stuff I have as well. I'm not updating until they release Fedora 40. (my nvidia driver stopped working when I upgraded to 39, again...) To begin with who thought these notifications were a good idea?…
I can do anecdata too. Photoshop added content-aware fill, and then generative fill. These have been useful additions for me, saving time that was previously tedious stamp-tool work.
You missed the point. It’s not about whether updates are good or bad, because yes anecdotally it could be either. It’s about whether they are consensual. And whether constant harassment that you can’t opt out of counts as consent when you give up or misclick
Re: You can't leak users' data if you don't hold it
#59I agree with the core idea, avoid saving info so you can't ever leak it. I personally think our legal framework should be based on consequences to encourage this mentality more. If you are hacked I don't care even a little that you did everything right, I just care that my information got taken. You should be held liable even if you did what the industry thought was right.
> avoid saving info so you can't ever leak it I think that this is a good idea. It's similar to the principle of least privilege: keep only what you need to offer the service you are providing. Less risk for the provider, less risk for the consumer. However, at least in the USA, I've noticed an increasing number of companies who have determined that personal data is worth good money. This is why most stores have rewa…
Even without reward programs, couldn't they just associate purchases with a given credit card or similar?
Re: You can't leak users' data if you don't hold it
#60I agree with the core idea, avoid saving info so you can't ever leak it. I personally think our legal framework should be based on consequences to encourage this mentality more. If you are hacked I don't care even a little that you did everything right, I just care that my information got taken. You should be held liable even if you did what the industry thought was right.
> avoid saving info so you can't ever leak it I think that this is a good idea. It's similar to the principle of least privilege: keep only what you need to offer the service you are providing. Less risk for the provider, less risk for the consumer. However, at least in the USA, I've noticed an increasing number of companies who have determined that personal data is worth good money. This is why most stores have rewa…
> personal data is worth good money
Then let's make the penalties substantially higher with the risk it incurs.