Live data from Hacker News

'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

websiteplanet.com

131–140 of 193 posts

Re: 'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

#131

I'll need to dig up a source but I recently heard about this company and, apparently, before offering gigs they do a credit report to determine how much debt the person is carrying (i.e. how desperate they are) and they use that information to _round down_ the hourly rate they offer them. In the unlikely event that there are any negative consequences for this breach, they deserve every bit of them and more.

Proper data privacy laws would make this sort of thing nearly impossible

Re: 'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

#132
post #79

Earlier quoted context omitted.

That seems like a terrible way to estimate nurse wages. People have spouses. People’s parents pay credit cards. People with bad credit sometimes don’t care. People have family money. People with low debt can be desperate for work. Does it even work?

At scale, the corner cases don't really matter. In aggregate, if it's decently well correlated and readily available, it's probably going to be used. I can't find it now, but I believe LexisNexis or another large similar reporting/data agency had a product catalog of dozens of products that spit out values for ability to pay, disposable income monthly, annual income, etc. It makes you feel awful thinking about the di…

But I’d argue they aren’t corner cases.

Most people I know with bad credit aren’t desperate for money. At least not educated, highly paid ones like nurses.

Most just ignore their financial problems in the hope they go away.

Not to mention nurse demand outstrips supply, so they have options and can certainly turn down bad offers.

Re: 'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

#133

It is really unfair, the way capitalism treats nurses (and police officers, school teachers). Without them, the entire system wouldn't even exist. Capitalism may sound like a great idea at first, but in the end you have a few rich bastards milking the rest.

It has nothing to do with capitalism. You can have capitalism and society that is aware that having good public services pays-off, as overall spending on schools, security, etc. will be smaller if done at the whole country level.

In the USA it is not that easy to achieve, as, historically, it is not a single country but a union of "states" that is countries, so the main boss should not interfere too much with local bosses and force on them particular "federal" laws.

Re: 'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

#134
post #114

Earlier quoted context omitted.

Names. We need names.

We don't need names, we need legislature, and we need to vote for people who will write it, as opposed to grifters who only seek to pad the pockets of billionaires. These predators aren't scared of name and shame. Any publicity is good publicity (And if it actually gets bad, they'll sue the pants off you.). They are scared shitless of laws censuring their behavior. It's why they fight like mad to ensure that they are…

> These predators aren't scared of name and shame.

There are exceptions. See the ongoing kerfuffle over "DOGE" employee lists.

Re: 'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

#135

It is really unfair, the way capitalism treats nurses (and police officers, school teachers). Without them, the entire system wouldn't even exist. Capitalism may sound like a great idea at first, but in the end you have a few rich bastards milking the rest.

It has nothing to do with capitalism. You can have capitalism and society that is aware that having good public services pays-off, as overall spending on schools, security, etc. will be smaller if done at the whole country level. In the USA it is not that easy to achieve, as, historically, it is not a single country but a union of "states" that is countries, so the main boss should not interfere too much with local b…

That doesn't answer whether it is fair. Capitalism will always push for a smaller government and with all the power they have at their disposal. At the same time, why can capitalists have their rich-making business schemes while nurses and other (semi) public servants are stuck with whatever society decides is good for them? The system is rigged in favor of capitalists.

Re: 'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

#136
post #127

Earlier quoted context omitted.

I don't remember the source, but I believe I listened to a podcast on an "uber for nurses" (not sure if it was this place), but they do all sorts of nasty things that really shaft the nurses. ISTR that the nurses when they get called in, have to be running a phone app that tracks them, and if they get stuck in traffic or lose cell signal, they get demerits. They pretty much do anything they can to give the nurses a d…

Isn't this exactly what you'd expect from an Uber for (somethign)? Garbage company, garbage culture, garbage business model.

Well yes, but more so it's how I expect a shitty and perversely structured industry that makes boatloads of money perpetuating a variety of huge barriers to entry to treat the employees who have the least barriers to entry protecting them.

Re: 'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

#137

Earlier quoted context omitted.

This is abhorrent if true; truly evil behavior.

What's interesting is that broadly speaking, people acknowledge that negotiating with asymmetric information is immortal or wrong. Take the stock market for example, insider trading is illegal and you don't often hear calls to reverse these laws. But when it comes to private markets and semi-private negotiations that same sentiment doesn't easily transfer. Does society benefit in some unique way for allowing asymmetr…

Incentive wise you're probably a lot better off if your own broker is front running you than if a HFT desk at a liquidity provider firm is doing it since the broker is at least in a position to kick some of that back to you in the form of reduced fees or whatever.

Re: 'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

#138
post #112

Earlier quoted context omitted.

> Also just as a side note, HIPAA is not a ideal standard to begin with for security. Many large companies exchange bulk PHI via gmail since it is HIPAA compliant. You seem to imply using GMail is a bad thing? I think GMail, when appropriately configured to handle PHI, is probably a million times more secure than some crappy bespoke "enterprise" app.

It isn't that hard to setup a secure SFTP server to automate the exchange. But then again this is a post about configuring a S3 Bucket with public access for SSNs. The issue with Gmail is sending to the wrong email, sending to a broad email list, having people download it to their local machines. And the amount of PHI being transmitted in these files is larger than this s3 bucket.

>It isn't that hard to setup a secure SFTP server to automate the exchange

When you've got a trickle of information coming and going from hundreds or thousands of other individuals working at tens or hundreds of other entities it is.

You'd eventually wind up developing the kind of ridiculous "secure messaging and file drop" type service that every megabank builds on top of their SFTP and ticketing systems for that purpose. That stuff ain't cheap to run and keep running.

Better to just start with a solution that's 99% there.

Re: 'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

#139

Earlier quoted context omitted.

This is abhorrent if true; truly evil behavior.

What's interesting is that broadly speaking, people acknowledge that negotiating with asymmetric information is immortal or wrong. Take the stock market for example, insider trading is illegal and you don't often hear calls to reverse these laws. But when it comes to private markets and semi-private negotiations that same sentiment doesn't easily transfer. Does society benefit in some unique way for allowing asymmetr…

> broadly speaking, people acknowledge that negotiating with asymmetric information is immortal or wrong

I don't think that's true at all. Companies and individuals negotiate all the time with information the other party doesn't have. Insider trading is about fairness on public markets so every negotiating party of the same type has the same information, and is quite specific to that.

Re: 'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

#140

Why does this keep happening? It seems like every month there's a new leak from an open S3 bucket?

S3 (and most of AWS) is terribly designed, so you end up googling for access policies that likely work when you are trying to get a new project off the ground. That policy may not be right for prod in the future.

Not saying it is right, it's just what happens.

Post reply on HN