This quote from another employee also looks naive now (and I'm not trying to offend him): https://news.ycombinator.com/item?id=13086454
The person in the article was terminated before I joined, so I don't know what the systems were like back then, but every time I access production systems, I have a ton of messages telling me that our access is being completely tracked and we are prohibited from doing anything that was mentioned in the article. I haven't actually tested to see what I can get away with because I'm not in the habit of risking my job and career over curiosities.
If you want to defend uber, it's pretty easy, just say there you know people that work on the team that audits the logs of employee access to personal data every quarter, and if those logs aren't justified by a ticket people get fired.
The image of Uber being a brogrammers haven just isn't true anymore. There are thousands of engineers working that care very much about the company and our customers, including drivers and riders.
It's hard to come up with a way to rationalize the above comment, when the comment is in the discussion of an article showing you're, at best, naïve.
I know you want to believe that what you're saying is true, but it sounds like you have no hard evidence to back that up to yourself, let alone evidence you can present to someone outside such as the HN readers reading this thread.
You may trust that Uber takes the security of customer info seriously, but from the outside we have no frame of reference, except for reports of past wrong-doing. A statement to the effect of "it was bad in the past but it's better now" unfortunately isn't all that reassuring, and I hope you can see it from our side of the fence and understand why.
You are calling the OP out for not having hard evidence, yet you are happily accepting the words of other folks in news reports as being true. You can't really have it both ways...you're just picking the side you want to believe is true...
In this case believing a news article over Uber is in our best interest. As a result your the parent poster is justified in requesting Uber for evidence.
You're implying every information available is to be credited with the same amount of trust. A published article from a journalist from a mainstram media outlet has track records, both on the journalist and the editor. The underlying source, is someone testifying in court, which engages more than aliased online posting, as well as cross-check performed by the journalist on other people.
Second point : the person you quote mainly questions whether the experience he described gives us information on Uber's data protection policy. I had the same feeling. This has nothing to do with the guy's integrity.
Maybe -- I don't work there or know anyone who does. But you have to admit that a company that would even think of creating something like "God Mode," then actually do so, then show it off, is seriously twisted and out of touch. AFAIK most of the higher-ups who were around then are still there now. You shouldn't be surprised if "I swear I've changed, baby" is met with a bit of skepticism.
But I trust that Uber takes the security of their customers information very very seriously.
Trust is something that needs to be earned. I can't speak for others but I don't trust Uber at all.
That judgment is probably even correct until you happen to hire a bad person one day.
So, how many hours a week do you drive? Oh, I'm sorry... those aren't "workers" -- they're just being nice and sharing their cars in their free time.
It's not an insult. It's a statement of fact: it is a different experience than depending on Uber driving for your livelihood. So one should not read much into it regarding the hardships/issues of drivers as professionals.
The same way a NLE developer that "eats his own dog food" by editing his daughter's birthday video doesn't exactly have the same experience/needs/issues of using the software as a professional editor in TV or film.
that's not what I heard from my friends that worked / currently work there.
Giving people a ton of warnings about the dire consequences of accessing data they're not supposed to is really easy. Preventing them from actually doing it is substantially harder.
You do know that this is literally the bare minimum level of user protection that you can legally get away with... right? That this isn't actually reassuring to anyone who has seen user data with any amount of protection?
If you're satisfied with this level of protection, I assume you're satisfied with it at the NSA/GHCQ.
As someone who works at an actual tech company, I can tell you without looking them up at least three layers that actually deny me access to user data. I know the team that actually audits any accesses made by those who can break glass, and I know who does the firing when the rules are broken.
And the products I work on aren't even regulated like those involved in finance/health/safety/etc.
is this built into the application.. at the ssh layer?
That's nice, but it shouldn't be forbidden to violate users' privacy, it should be impossible.
The purported "God-mode" that Uber had years ago, and showed off at parties, was a real problem with their culture. The ability of devs to get read access to some production data is much less of a huge deal.
I know homomorphic encryption is very new, but deploying it for privacy applications like these is a Good Idea.
Work for just about any company, tech or otherwise, in a sysadmin role. There is always going to be some way for a smart, malicious admin to get into things.
Snowden is maybe the best example. If an organization with an insider threat risk profile as high as the NSA's can't get it right, then you can be pretty certain almost no one else is either.