Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Senators Demand Google Hand Over Internal Memo Urging Google+ Cover-Up

zdnet.com

Post reply on HN
Print view View original

11–20 of 52 posts

Re: Senators Demand Google Hand Over Internal Memo Urging Google+ Cover-Up

#11

Post by toomuchtodo »

kodablah wrote: post #8
toomuchtodo wrote: post #5

Earlier quoted context omitted.

Would you be surprised by legislation or insurance regulations that required such disclosures?

Yes. E.g. did you find a whiteboard facing an open window? Did leave a confidential document sitting on their desk? Did someone forget to close the filing cabinet to sensitive documents? Has anyone ever been able to access confidential information at your company without permission? Of course we can pick and choose analogies (hint: we'll never get it right, but that's what happens when comparisons are asked for). But…

I appreciate the feedback.

Re: Senators Demand Google Hand Over Internal Memo Urging Google+ Cover-Up

#12

Post by imglorp »

cirenehc wrote: post #3

I have never worked at any company that publishes every security bug discovered internally. This is ridiculous.

Same.

But the users whose data was emitted should have been immediately notified. That's (a) law in some places, (b) common decency if one party holds another's PII and then fails to keep it private.

Re: Senators Demand Google Hand Over Internal Memo Urging Google+ Cover-Up

#13

Post by sololipsist »

recursive wrote: post #10
sololipsist wrote: post #7

Earlier quoted context omitted.

I have found over and over and over that when I read "memos" or "screeds" or whathaveyou coming from the tech industry I inevitably find that a huge portion of the media is pushing a narrative that is so uniform and so disjoint from the actual content I have a hard time imagining how it wasn't coordinated journo-pros-style.

James Damore?

That's an example, yes.

Re: Senators Demand Google Hand Over Internal Memo Urging Google+ Cover-Up

#14

Post by ccnafr »

kodablah wrote: post #4

> Three Republican senators have sent a letter to Google today demanding the company hand over an internal memo based on which Google decided to cover up a Google+ data leak instead of going public as most companies do. That's a loaded first sentence. Here's another way of writing it: "Three Republican senators have sent a letter to Google today asking the company to please provide internal memo based on which Google…

> out yourself as biased garbage?

Biased based on your opinion.

I personally think this is a very big deal and I don't see anything wrong in that sentence. If you think Google is innocent, just look at the facts.

1) They had an internal memo discouraging public disclosure. 2) They only came clean with the leak after WSJ reached out for comment before the publication of a story. 3) They buried the "leak" announcement in a gigantic blog post. The blog post was meant to announce a new project, but about halfway through the middle they disclosed a data-leaking bug. I'd say the tone of the article is in response to Google's observed and recorded actions.

Yeah, I'd say the article and letter's tone is just about right.

Re: Senators Demand Google Hand Over Internal Memo Urging Google+ Cover-Up

#15

Post by crunchlibrarian »

kodablah wrote: post #4

> Three Republican senators have sent a letter to Google today demanding the company hand over an internal memo based on which Google decided to cover up a Google+ data leak instead of going public as most companies do. That's a loaded first sentence. Here's another way of writing it: "Three Republican senators have sent a letter to Google today asking the company to please provide internal memo based on which Google…

It's funny how picky and particular HN gets over the wording or sources whenever the story is about Google. In nearly every article you see comments like this upvoted to the top within 10 minutes of posting.

Any other topic or company: the wording or journalistic techniques are an unimportant aside, if they get mentioned at all.

Re: Senators Demand Google Hand Over Internal Memo Urging Google+ Cover-Up

#16

Post by IX-103 »

Since the "memo" is part of a discussion between lawyers and execs wouldn't the memo be considered privileged? That doesn't mean that Senators can't ask, but if you set the expectation of handing out privileged information whenever you're asked it kinda makes "privileged" communication not mean anything.

Re: Senators Demand Google Hand Over Internal Memo Urging Google+ Cover-Up

#17

Post by klodolph »

imglorp wrote: post #12
cirenehc wrote: post #3

I have never worked at any company that publishes every security bug discovered internally. This is ridiculous.

Same. But the users whose data was emitted should have been immediately notified. That's (a) law in some places, (b) common decency if one party holds another's PII and then fails to keep it private.

> But the users whose data was emitted should have been immediately notified.

If we’re still talking about the same bug… I thought that there was no evidence that anybody’s data was exfiltrated through this vulnerability? Granted, absence of evidence is not evidence of absence, but who, exactly, are you saying should be notified?

I would say yes, if some person’s PII data was improperly disclosed, yes, disclose the breach to that person. But if there is not any evidence that some particular person’s data was exposed here, do you go around telling people that their data “could have” been accessed, “if”?

Physical security analogy—let’s say I found out that the window was unlocked. It’s been unlocked for three years, and I pull security tapes. Nobody is on tape coming in through the window, but the old tapes have been erased. I don’t have any evidence that anybody came in through the window, and yet I can’t disprove it either.

Re: Senators Demand Google Hand Over Internal Memo Urging Google+ Cover-Up

#18

Post by sz4kerto »

cirenehc wrote: post #3

I have never worked at any company that publishes every security bug discovered internally. This is ridiculous.

Depends on the industry. E.g. if you're working in defense or healthcare, then just the possibility of a data leak might be something you're obligated to report on. And a Google- or Facebook-size company might easily fall into the category where even "near miss" events should be disclosed.

Basically you have to conduct an internal risk evaluation and depending on the overall risk assessment, you need or don't need to publicly report on it. Of course the bar is much lower than 'certain data leak'.

Re: Senators Demand Google Hand Over Internal Memo Urging Google+ Cover-Up

#19

Post by Bhilai »

Google admitted that they don't keep any logs around. So in the absence of logs, I am not sure how they are making the claim that their API was not abused. So there is definitely more transparency required about their internal investigation and how they are so certain. Just because Google has a great security team, I would not put my blind faith on them.

Re: Senators Demand Google Hand Over Internal Memo Urging Google+ Cover-Up

#20

Post by kodablah »

crunchlibrarian wrote: post #15
kodablah wrote: post #4

> Three Republican senators have sent a letter to Google today demanding the company hand over an internal memo based on which Google decided to cover up a Google+ data leak instead of going public as most companies do. That's a loaded first sentence. Here's another way of writing it: "Three Republican senators have sent a letter to Google today asking the company to please provide internal memo based on which Google…

It's funny how picky and particular HN gets over the wording or sources whenever the story is about Google. In nearly every article you see comments like this upvoted to the top within 10 minutes of posting. Any other topic or company: the wording or journalistic techniques are an unimportant aside, if they get mentioned at all.

No, I have consistently been against media-driven fervor against tech companies for a while now without regard to the company. It's how they build terrorists, druggies, communists, etc. I think you're confusing my comment with HN in general, or attempting to derive too much sentiment out of comment votes.
Post reply on HN