Trust is Fragile

http://37signals.com/svn/posts/3078-trust-is-fragile

by jaxonrice • 15 years ago

266 98 15 years ago

flyosity• 15 years ago

If the 100,000,000th uploaded file was actually named Startup-Revenue-Forecast.ppt or 2011-Tax-Return.pdf I'm fairly certain that the name or contents wouldn't have been mentioned. I think the fact that it was cat.jpg spawned the idea of referencing it at all, and honestly if I were in their place I would have made the same joke. I think most people would have. But good on them for pulling a reverse Streisand Effect (http://en.wikipedia.org/wiki/Streisand_effect) which frames the discussion in a positive light ("how can we change and do better?") instead of a negative one.

mike-cardwell3• 15 years ago

I wonder what they would have done had it been named "Basecamp Competitor Business Plan.pdf". Would have been awfully tempting to take a peak. Exactly why they shouldn't even be looking at filenames.

corin_3• 15 years ago

Ultimately a company storing files is almost certainly going to require its staff to look through directories, log files, database tables. And it is certainly going to require staff to have the ability, even if they never have to use it.

By giving them your files you are trusting them not to screw you over.

wlll• 15 years ago

If (in the course of essential sysadmin duties) I saw a file named "Basecamp Competitor Business Plan.pdf", or in fact any name, I wouldn't look at it because that would be wrong, no temptation.

felipemnoa2• 15 years ago

All the data should be encrypted and only the user's password should be able to decrypt the data. That way you eliminate the problem of someone peaking into your files.

billpatrianakos6• 15 years ago

It's funny you mention that because I actually do have such a file! I also went ahead and used Basecamp too to get a sense of what could be improved or simplified. But of course I didn't even consider uploading that file and this was long before this whole debacle started. We need to trust services like Basecamp, Google Docs and the others... A lot. But we also need to be smart about that trust. A healthy distrust is definitely in order in certain circumstances.

BoppreH• 15 years ago

The filename could contain enough information to be a big breach of privacy by itself. Think "microsoft bankruptcy proposal.doc"; "google downsizing plans 2012/2.xls"; "ipad 3 presentation draft.ppt".

Temptation can be resisted, but in this cases you are in trouble just for glancing.

tintin• 15 years ago

Very true. What if it was a screenshot of a secret CATalog? Or a scan of some secret Company Anonymous Transfer or whatever. So I hope they never took a look at the "cat.jpg" file because you just cannot tell what's inside.

absconditus2• 15 years ago

Another interesting case would be "Plan to kill the President.ppt".

tpatke• 15 years ago

I think the issue is access control. Clearly they can and do look at their customers personal data. Thats not very funny - even if it happens to be a picture of a cat.

foreverbanned• 15 years ago

They didn't mentioned the filename at first. What they actually said was : "And a Basecamp user uploaded the 100,000,000th file (It was a picture of a cat!)".

So people got the impression that they actually saw the picture. Hence the backlash.

Users of cloud services may be aware that engineers, sysadm or dba may occasionnally see their data but they certainly prefer not to think about it.

dugmartin• 15 years ago

Well done. I wish more companies would own up to mistakes instead of weaseling out of them.

To DHH if you are reading these comments: Since 37signals is such an industry leader why not take this opportunity to release a "trust manifesto" that other SAAS companies can learn from instead of just updating your privacy policy? Present it as a few straightforward bullet points instead of paragraphs of legalese.

dhh5• 15 years ago

I'd be very happy if we come up with a good privacy policy that it could help others revisit theirs. Most policies, including ours, talk about shit people generally stopped caring about 5 years ago (what do you do with my COOKIES?!?!).

These days people care much more about the privacy of the data that they actively share through uploads etc and much less about the tracking. At least on apps like ours.

untog2• 15 years ago

While the tone of the post is fantastic, I can't quite believe that anyone would be as offended as they suggest. I would like to believe that people can apply common sense to this situation and realise that they disclosed 'cat.jpg' exactly because the name was entirely inoffensive and anonymous.

jasonlotito4• 15 years ago

You miss the point. The point is with regards to privacy. If I'm paying them for their service, and I upload files, I can limit who sees them. If that can be circumvented, this is disconcerting. What if I had a file named "How to beat 37Signals.docx"? Or "Next iPad Specs - Official.pages" uploaded? And then someone reviewing the logs happens to see that. And they get curious.

The idea isn't that cat.jpg is bad. It's that over at 37Signals, someone was browsing the logs, reviewing the file uploads, and did see "2011 Financing Report for X Public Company - Unreleased" or something akin to that.

I understand your point of view. But the people offended by this are in the right. It's not what happened, but that it happened, and what it shows.

dhh5• 15 years ago

I agree, Jason. While it's unavoidable that we at times will see things through log files in order to ensure the performance and uptime of the system, it certainly shouldn't be for these causes and it double certainly shouldn't be in order to reveal anything publicly.

untog2• 15 years ago

The idea isn't that cat.jpg is bad. It's that over at 37Signals, someone was browsing the logs, reviewing the file uploads

Rather, they did "SELECT filename WHERE row_num = 100000000".

Honestly, if you're concerned about something like this then you should not be using a third party solution to store your files. Of course 37 Signals can look at the names of the files you are storing- they could probably hide that information from themselves, but then they'll get a support request saying "we can't open file-x.jpg" and they won't be able to do anything about it.

Tichy• 15 years ago

I think if you upload your data to some cloud service, you should assume that the employees of the company can look at it. The error here was some employee leaking information to the public (the name of a file).

billpatrianakos6• 15 years ago

You almost have my opinion changed to agree with you that the people who are offended are right to be offended. But honestly, isn't it a little naive to think that the company holding your data won't have some access to it? I tend to believe that unless it's on a machine you own then someone else can and will look at it in some way. They may not look at the contents but they most certainly will check out the file type, size, name, date created, etc.

Now if you upload "HowToBeat37Signals.docx" to Basecamp you should probably assume two things. There's the possibility, however remote, that someone not authorized will see it (that possibility exists on every farmed out service, no server is hacker proof despite GoDaddy's little badges) and if someone does see it and it gets leaked or used against you, you'll have a damn good chance of suing the bejesus out of them.

The word trust is the key word here. Whenever you use a service to store sensitive material there has to be some level of trust. I think it's a mistake to trust that no one within the company or as a result of a security breach will absolutely never ever see what you've stored. What you do trust is that the odds of that happening are supremely low and if someone were to see your data (at least within the company) that they won't use it against you or share it. History has shown us that no web service is 100% secure and reliable so if you aren't comfortable with your odds then you shouldn't use the service. I for one assume everything I've ever put online is not secure. I'm comfortable with my odds though and bank on the fact that no one will take something written or created by a nobody like me very seriously or care at all.

mbell• 15 years ago

>What if I had a file named "How to beat 37Signals.docx"?

They wouldn't have released it, and you would be a moron for storing that data on _their_ servers.

> Or "Next iPad Specs - Official.pages"

You'd be a moron for storing that data on their servers.

The existence of cloud solutions doesn't beget the use of self controlled servers for truly critical data.

The reality is that the vast majority of business data is not interesting to anyone but themselves and possibly competitors. And the vast majority of those businesses and competitors are well outside the scope of 37. Thus your data is relatively safe. If you're that worried about the hosting provider being able to view you data, host it yourself. Simple...

3pt141592• 15 years ago

Honestly, people are decisional if they don't think this happens everywhere.

I've seen tens of thousands of pieces of private data across all the companies I've contracted for. Data guys need to explore, they need to learn what types of customers use what type of features and why.

Heck, I talked to a guy online (didn't know his real identity, or I would call him out personally) that wrote a script that automatically checked his employer's database against outstanding warrants in the US (fuzzy matching first name, last name, city, age) and pulled in 2 to 3 times his salary just by the rewards. That is how bad some people are.

What you can trust is that a company almost certainly won't intentionally leak your data to the public, but rest assured that they do flip through it. Some awesome companies will obfuscate the email addresses or company names so that it is much harder to back calculate who owns what, but honestly unless a company is promising full encryption on their side I would just assume they can see everything.

If you want real privacy use encryption (or some other zero trust protocol) it really isn't that hard to use.

dhh5• 15 years ago

I don't think it has to be this way. We often run internal reports on usage of certain features, but it's always aggregated, and never looks at the individual data. I feel bad enough looking at a customer's account when they've specifically asked me to do so from a support request.

I would certainly terminate any account with a company that willfully was reading my private data and opening files for the mere sport of it.

sunir4• 15 years ago

There's this small, harmless incident from 37signals and then there is this attitude. Some questions:

* Should it happen everywhere?

* As a data guy, do you have professional obligations to uphold the privacy policy and operate within the law?

* What are the mechanisms available to the market and the industry to prevent the deterioration of customers' trust with us?

3pt141592• 15 years ago

> Should it happen everywhere?

Yes. The market has spoken. People find terms of use acceptable, which includes looking at personal data. The alternative is to restrict your data team to the point where conversions would be half or a third of what they are. Are most people willing to pay triple just to remove the off chance that some random data guy comes across their info? Probably not.

> As a data guy, do you have professional obligations to uphold the privacy policy and operate within the law?

Any person, employee or not, professional or not, has obligations to uphold just laws; certainly including measures of privacy.

Here is a typical privacy policy:

"We use personal information in the file we maintain about you, and other information we obtain from your current and past activities on the Site, to provide to you the services offered by the Site; resolve service and billing disputes; troubleshoot problems; bill any amounts due from you; measure consumer interest in our products and services, inform you about online and offline offers, products, services, events and updates; deliver information to you that, in some cases, is relevant to your interests, such as product news; customize your experience; detect and protect us against error, fraud and other criminal activity; enforce our Terms of Use; provide you with system or administrative messages, and as otherwise described to you at the time of collection. On occasion we use email address or other contact information to contact our Users to ask them for their input on our services, and to forward to them media opportunities.

We may also use personal information about you to improve our marketing and promotional efforts, to analyze Site usage, to improve our content and product offerings, and to customize the Site's content, layout, and services. These uses improve the Site and better tailor it to meet your needs, so as to provide you with a smooth, efficient, safe and customized experience while using the Site."

That bottom paragraph is fully communicating the nature of the relationship. Outside any law that would render the above unlawful, it is well within the law for an employee to "SELECT * FROM users WHERE created_at > 2010-02-01" or to "SELECT * FROM todos JOIN users ON todos.user_id = users.id WHERE users.profession = 'developer'". There are perfectly valid reasons to do these types of things. Anti-fraud measures, site optimization, etc.

> What are the mechanisms available to the market and the industry to prevent the deterioration of customers' trust with us?

This is a problem of mismatched expectations and priorities. It's a lot like politics. In an ideal world a politician would be able to say something like 'I think the American people acted irresponsibly financing homes and that is a good part of the reason for the financial crisis' because it is the truth and it would help people in the long run to hear it, as well as help any policy formation in response to it. But practically they can blame others and get away with it.

Unless the industry is willing to educate politicians, site users, etc. There is no reason to go out shouting that this happens. It's already in the terms of use and the privacy policy. Do you think people want to know what Air Miles does with their data?

The only mechanism besides general silence (as well as inclusion in the privacy policy and/or terms of use) would be full, 100% truth when asked. But why make an issue of it? The netizens don't really care. If they did there would be competition around this angle of the market.

dhh hides behind: "I don't think it has to be this way. We often run internal reports on usage of certain features, but it's always aggregated, and never looks at the individual data. I feel bad enough looking at a customer's account when they've specifically asked me to do so from a support request.

I would certainly terminate any account with a company that willfully was reading my private data and opening files for the mere sport of it."

That carefully worded bullshit. Internal reports are not exploring. Internal reports are what you show at the monthly marketing or board meeting. C_Os get internal reports. Data guys test recommendation models. Data guys find out the interesting patterns to include in custom reports.

Also, His last paragraph is ridiculous. Obviously we don't read data for sport. In fact it is boring. You go through data for trends.

dennisgorelik5• 15 years ago

> checked his employer's database against outstanding warrants in the US ... That is how bad some people are.

Helping to serve justice is now a bad thing?

icebraining2• 15 years ago

Those ends are fine, the problem are the means.

billpatrianakos6• 15 years ago

People really got that upset over them knowing the name of the 100 millionth file? They're not going to look at the log anymore? I don't know how they operate on the server side of things but if no one is going to look at logs anymore then why have the log at all? I look up to 37Signals a lot but I think they were a little too apologetic this time. Why not apologize but explain that the log files tell you basically nothing about the contents of your files? How does anyone not make the connection between the cat joke and the file named cat.jpg? I mean, they even spelled it out in the original post! I'm not trying to be critical, I'm just kind of left wondering how something like this offended a single person. Weird.

tangus• 15 years ago

Keep in mind that the original post said "it was the picture of a cat". It implied they looked at the content of the file.

billswift• 15 years ago

No they didn't. They talked about how sharing pictures of cats was a running internet joke. All they said about that particular file was that it was named cat.jpg.

billpatrianakos6• 15 years ago

Yeah, I remember that. But they also mentioned the file name too so it wasn't really a secret as to how they assumed what was in it. I very rarely go into conspiracy land but now I'm wondering where the uproar came from? Does anyone know who started this backlash? Was it a group or an individual? I ask because for a fleeting moment I wondered if a competitor took their original post and used it as an opportunity to knock 37Signals down a couple of notches. I may be totally off in the deep end with that thought, however.

sscheper• 15 years ago

Sometimes I feel like 37signals should change the name of their blog to "Much Ado About Nothing"

torontos• 15 years ago

HN Discussion of the incident a few days ago: http://news.ycombinator.com/item?id=3456819

davidw• 15 years ago

FWIW, there's an Italian startup called Iubenda trying to do something around privacy policies, so that it's easy to have a good one:

http://www.iubenda.com/en

lukev• 15 years ago

The real lesson here is that if you really want your data to be private, you have to take responsibility for encrypting it or not uploading it anywhere.

Even in the best-case scenario, at least some employees can access data as part of their jobs. This has been true of every job I've ever worked at.

tomkin• 15 years ago

37signals really doesn't want to be the bad guy. They're not. And this whole thing is ridiculous. If you were to evaluate 37signals on a 0-to-9 scale, based on how "evil" they are, you might give them a 0 or a 1. What if the scale went the other way as well? There isn't just evil, there's apologist. And it too can lay the groundwork for unfruitful results.

37signals' target demo is smart, well-to-do, logical. They shouldn't have to apologize. As their logical demo, we should know better. We know that if the filename was MyBossIsAnAsshole.docx or even MyWeddingPhoto.jpg that 37signals wouldn't have had to think for a second on the appropriate thing to do. As logical thinkers, we know why cat.jpg is funny as it pertains to our demographic. We know that MyWeddingPhoto.jpg wouldn't be funny.

The whole burn 'em at the stake routine is asinine.

dpritchett• 15 years ago

I'm impressed that this mea culpa ended with a reasonably tasteful plug for the next 37s product release.

tghw3• 15 years ago

This is why our policy at Fog Creek is to explicitly get permission from users before accessing their data. It's enforced by the sys admins (which we screen more extensively during the hiring process), who give temporary access to the person who needs it once the user has given their permission. When we're done, the sys admins remove access to that account again.

It's a pretty painless process (we have snippets to ask permission from the user and shortcuts to request access from the sys admins) and it helps prevent both willful and accidental leakage or modification of our users' data.

jonknee2• 15 years ago

Is there anything stopping the sys admin from doing the snooping?

tghw3• 15 years ago

Ultimately, someone needs to have the keys, and they do, which is why they go through additional screening. Since there's a whole team, they would either have to collude or cover their tracks very well. Considering a major part of their job is keeping our data and our users' data safe, a breach like that would not be taken lightly.

So ultimately, it may be possible for one to snoop on our users, but it's much easier to trust (and keep tabs on) a small, well screened team than the entire company.

Speaking personally, I can say that I would (and do) absolutely trust my own data to our sys admins.

RyanMcGreal• 15 years ago

Quis custodiet ipsos custodes?

walkon• 15 years ago

Do they have to go through this same process when looking at certain logging data, such as, web server GET requests? Those would show file names.

drewcrawford• 15 years ago

I have to interject here, because the theoretical example in this thread is what would happen if somebody had plans to compete with Basecamp in Basecamp, as some sort of hypothetical case.

I actually have a bug open in FogBugz called "Build a better FogBugz" where we discuss in some length its shortcomings for our workflow and how to fix them. It's not exactly an active project, but it will probably be when I get sufficiently fed up, and I would have no problem organizing its development in FogBugz.

The point is, if you can't trust the people who are writing your tools, why are you using their tools in the first place?

aangjie• 15 years ago

Reminds me of my somethin' my ex-colleague came up with in a discussion over lunch.. Trust is a complex variable. it has some real part/value that both the parties involved can be secure about, and an(two??) imaginary part where both the parties have a guess about what else they will/can trust the other about.. In this case, i think the filenames would count as imaginary part. Not to imply, it's not private, but would be surprised if it had been in the terms of service..

sunir4• 15 years ago

I'm not really worried that 37signals are maliciously going through customer data, because I honestly believe they aren't.

However, I'm disgusted by the number of people in this thread that justify the violation of customer privacy because it's what's normal.

As an industry, we all face in our sales cycle the fear from customers that we will violate their privacy. Self-regulation by holding each other to account is the cheapest and best way to address the issue.

While I would be stupid to believe software vendors don't look at my data because I know better, that isn't my expectation.

It's not my expectation that my lawyer, my accountant, my doctor, my therapist, my social worker, or my librarian trade on or reveal or delve through my private information. That's why they as professionals are licensed and self-regulated by their professional colleges.

As information professionals, we should act professionally with information as well. This is not crazy talk. We also see credit card numbers and personal information stolen every month. Last year over 100 million credit cards had to be reissued due to data theft. That's why the card industry created PCI compliance to self-regulate the industry, as imperfect as it may be.

scrod• 15 years ago

No, as information professionals, we should be building tools that enable users to store and manage their data privately, without asking them to trust some anonymous system administrator. Allowing them to become complacent and implicitly accepting of remotely-hosted services does users and society as a whole a great disservice.

nopal• 15 years ago

I think this post highlights a missing component of the IT ecosystem -- a professional code of ethics.

Many companies, especially large ones with lots of lawyers, have developed policies and procedures relating to what's acceptable and what's not. But most smaller companies and startups don't seem to have time to formulate these policies.

A professional code of ethics, specially with regard to privacy and user data, would be very useful.

Right now, most developers operate on a "do unto others" philosophy. While this may be good intentioned and work well a lot of the time, it's highly subjective -- as evidenced by the comments on this thread.

shasta• 15 years ago

Seems reasonable, but can adults stop boasting that they're behaving like adults? Unless 37 signals is being run by children, in which case: good job kids.

screwt• 15 years ago

There is a strong case to be made that 37signals should have access to this data for debugging purposes or similar. And as others have suggested, customers trusting 37signals with data should expect this at some level, unless the customers are encrypting everything at their end first.

But should everyone in the company have that level of access, or should access be restricted to the minimum necessary? What I don't see in others comments here (except tghw's [1]) is any recognition of that. It's all very well saying you want to give your devs access, and that you can be trusted, but over time and as your company grows you're exposing yourself to the risk of a rogue operator. And it only takes one person to do something bad to severely damage the trust your customers hold in you.

It's a balance, to be sure, but I'm inclined to think a blanket "we trust our devs, so they have the access they need" could be exposing yourself to a large risk you don't need.

[1] http://news.ycombinator.org/item?id=3471338

sunchild2• 15 years ago

I was one of the people who was vocal about this being a serious gaffe when the post went up.

This is the absolutely the best response conceivable. Bravo!

scrozier• 15 years ago

This post and comments has made me reconsider the word "trust" entirely.

"Trust" is an emotion-laden, rhetorical word used by a someone who wants you to do something. "Just trust us."

Trust is not fragile, trust is an illusion.

Replace the verb "trust" with the word "assume" or "take a calculated risk" and you're closer to reality.

Instead of "trust us," how about, "Look at our record. Note that we have had not a single incident of data disclosure in 6 years. Decide for yourself if it is likely that we'll have one now, with your data."

Instead of "trust us," how about, "Think about our business: imagine the consequences if we were found to have looked at our customers' data, and see if that disincentive allays your concerns sufficiently."

Instead of "trust us," how about, "Here are the ways we are protecting your data. Consider whether they meet your requirements or not."

I'm voting "trust" off the island.

dennisgorelik5• 15 years ago

I routinely look into my customers' data and didn't really have second thoughts about it.

I even automated process of looking into customer's data. The main goal is to catch spam and scam and delete such accounts.

May be it's specific of my business (job board), but isn't scam and spam is risk in any business to at least a certain extent?

BadassFractal3• 15 years ago

You can do whatever you want as long as it's explicitly stated in the EULA, hopefully that's the case in your situation.

BadassFractal3• 15 years ago

At any large organization with million of customers and public opinion affecting stocks, even mentioning to the that random people on the dev team have access to customer data can be pretty career altering. The fact that you're even looking at confidential information is generally highly frowned upon.

What if Mint.com celebrated their 1 "billionth" processed transaction by posting what it was? Wouldn't that cause outrage?

8ig8• 15 years ago

I'm not too troubled by employees reading file names in the logs, but for some reason it bugs me that the apology post included a promotion (a link) for "Basecamp Next." In this context it didn't seem necessary.

joshontheweb• 15 years ago

When I was in college and working for a bootstrapped startup I was handed an unprotected thumb drive with an excel spreadsheet containing all the credit card numbers, expiration dates, address, social security numbers, etc of all the clients (thousands) and told to take it home for when I was working out of the office. I was too ignorant to realize how terrible, and I'm sure illegal this was. Of course I never abused it but it definitely makes me wary of my data these days. I imagine this happens much more than people think. Don't worry, the company I speak of was localized and failed now I think. It's prudent to cancel your cards once or twice a year and be careful who you trust. Some companies value convenience over security and put way too much trust in the employees.

Trust is Fragile

Related Stories