Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

websiteplanet.com

Post reply on HN
Print view View original

181–190 of 193 posts

Re: 'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

#181

Post by collingreen »

potato3732842 wrote: post #137
B4CKlash wrote: post #117

Earlier quoted context omitted.

What's interesting is that broadly speaking, people acknowledge that negotiating with asymmetric information is immortal or wrong. Take the stock market for example, insider trading is illegal and you don't often hear calls to reverse these laws. But when it comes to private markets and semi-private negotiations that same sentiment doesn't easily transfer. Does society benefit in some unique way for allowing asymmetr…

Incentive wise you're probably a lot better off if your own broker is front running you than if a HFT desk at a liquidity provider firm is doing it since the broker is at least in a position to kick some of that back to you in the form of reduced fees or whatever.

Might as well get a pat on the head with your punch in the face if you're going to definitely get punched in the face either way.

I don't disagree with you, but wow that requires a bleak outlook.

Re: 'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

#182

Post by B4CKlash »

belter wrote: post #179
B4CKlash wrote: post #117

Earlier quoted context omitted.

What's interesting is that broadly speaking, people acknowledge that negotiating with asymmetric information is immortal or wrong. Take the stock market for example, insider trading is illegal and you don't often hear calls to reverse these laws. But when it comes to private markets and semi-private negotiations that same sentiment doesn't easily transfer. Does society benefit in some unique way for allowing asymmetr…

That is why it should be mandatory for companies to publish the salary range for a role.

I agree with you. I'd go further and suggest that candidates should get anonymized information about applicants in the pool. Nothing like negotiating with yourself for a job...

Re: 'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

#183

Post by CaffeineLD50 »

dragonwriter wrote: post #24
richwater wrote: post #21

Earlier quoted context omitted.

> shitty security architecture slapped on AWS It's literally, and I do mean this literally, 1 click to block all public traffic to an S3 bucket. It can be enabled at the account level, and is on _by default_ for any new bucket. What exactly more do you want?

> It's literally, and I do mean this literally, 1 click to block all public traffic to an S3 bucket. I'm reasonably certain that for quite a while blocking all public access has been the default, and it is multiple clicks through scary warnings (through the console; CLI or IaC are simpler) to enable public access.

Swimmers on a beach that had lifeguards were dying because the ocean was quite strong and even experienced swimmers would occasionally be drowned.

The city decided to remove the life guards and replace them with signs saying "swim here at your own risk, people die here."

Having a simple classification system like "public" and non public with a system that ensures non public data isn't published might prevent data leaks with automation that checks for publishing non-public data.

A system that let's you publish non public data "with warnings" is just a sign saying "swimmers die here". Its not safe, it just excuses the city from culpability

Re: 'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

#184

Post by game_the0ry »

zero_k wrote: post #147
game_the0ry wrote: post #144

Incredible. Healthcare is a busted industry through and through. Even the tech companies that serve it are incompetent. There are so many things wrong here: - the uber-fication of nursing, bc of cheap and corporate owned hospitals won't just hire them as w2 employees - cheapness probably led hospitals to this crappy app, which probably gave kick backs to the admins that approved it - this should totally bankrupt the…

Bankrupt only? It should also be criminal negligence. Until some exec goes to jail, this kind of stuff will keep happening. Someone was (likely is...) making good profit out of this business by not investing in IT security. They cheaped out, and other people paid the price, who didn't have anything to do with the profit of the company. Watch out for the execs going around in a few years giving talks about how to buil…

Do not disagree here. As long as it is on the CEO and head on eng. No some poor intern.

Re: 'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

#185

Post by codedokode »

ethagnawl wrote: post #6

I'll need to dig up a source but I recently heard about this company and, apparently, before offering gigs they do a credit report to determine how much debt the person is carrying (i.e. how desperate they are) and they use that information to _round down_ the hourly rate they offer them. In the unlikely event that there are any negative consequences for this breach, they deserve every bit of them and more.

In America you can get (buy) someone's credit report without their permission?

Re: 'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

#186

Post by codedokode »

DavidPeiffer wrote: post #100
refurb wrote: post #79

Earlier quoted context omitted.

That seems like a terrible way to estimate nurse wages. People have spouses. People’s parents pay credit cards. People with bad credit sometimes don’t care. People have family money. People with low debt can be desperate for work. Does it even work?

At scale, the corner cases don't really matter. In aggregate, if it's decently well correlated and readily available, it's probably going to be used. I can't find it now, but I believe LexisNexis or another large similar reporting/data agency had a product catalog of dozens of products that spit out values for ability to pay, disposable income monthly, annual income, etc. It makes you feel awful thinking about the di…

> Corporations approaching omniscient regarding all facts of our lives

People happily give away lot of info voluntarily, for example by paying with a card instead of cash.

Re: 'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

#189

Post by Tryk »

tyre wrote: post #143
B4CKlash wrote: post #117

Earlier quoted context omitted.

What's interesting is that broadly speaking, people acknowledge that negotiating with asymmetric information is immortal or wrong. Take the stock market for example, insider trading is illegal and you don't often hear calls to reverse these laws. But when it comes to private markets and semi-private negotiations that same sentiment doesn't easily transfer. Does society benefit in some unique way for allowing asymmetr…

> What's interesting is that broadly speaking, people acknowledge that negotiating with asymmetric information is immortal or wrong. Take the stock market for example, insider trading is illegal and you don't often hear calls to reverse these laws. Insider trading is not about fairness. It’s about theft. If you overhear someone in a public place talking about an upcoming merger, you can trade on it.

Yes... And why is theft bad?

Re: 'Uber for nurses' exposes 86K+ medical records, PII via open S3 bucket

#190

Post by _xtrimsky »

amelius wrote: post #129

It is really unfair, the way capitalism treats nurses (and police officers, school teachers). Without them, the entire system wouldn't even exist. Capitalism may sound like a great idea at first, but in the end you have a few rich bastards milking the rest.

it has nothing to do with capitalism. this company could have hired a cheap student, that would have known best AWS practices and would have kept it secure. at the same time a communist government with lots of funds, could have made this mistake.
Post reply on HN