Hacker News Reader

Comment by fiiv | Hacker News Reader

From their perspective, they claim that it is not personal info since it's anonymised. On that, they're right.

But it still makes a shitty user experience to do something that is counter to what your users expect and want.

Maybe, maybe not. They record 3 octets of your IP address and the experience is opt-out rather than opt-in. ECJ ruled that IP addresses are PII but did not specify if using a partial address is OK. On the basis it is the 3 most significant octets, then this could be used to identify a company or a pool of users or a unique user on an unpopulated network.

Edit: also from [1]: "Hashed MAC address — Determine a cryptographically (SHA256) anonymous and unique ID for a machine. Useful to determine the aggregate number of machines that use .NET Core. This data will not be shared in the public data releases."

I think a machine could be a user in this circumstance? Also a hash isn't anonymous if it's idempotent based on the IP address alone as it's merely a derived value.

[1] https://blogs.msdn.microsoft.com/dotnet/2017/07/21/what-weve...

Atleast per german court rulings, which at that time largely covered what is defined as PII under GDPR, say that the full IP is PII but the first three octets is not.

The last three octets absolutely could be in conjunction with some other pieces of data, though.

Of course, yes. Once you can identify a unique person it's personal data, even if you cut of octets. If you only log the IP for example for detecting duplicate accounts, it should be good enough.

ECJ ruling citation please? That would be extremely useful in settling this argument.

http://curia.europa.eu/juris/document/document.jsf?text=&doc...

In the US under HIPAA laws, your IP address counts as PHI, not just PII

Source: I work in IS for healthcare providers

No, an IP on its own is not PHI. IPs must be removed when de-identifying PHI, which is not the same at all as claiming IPs are themselves PHI.

[1] - https://www.hhs.gov/hipaa/for-professionals/privacy/special-...

> But it still makes a shitty user experience to do something that is counter to what your users expect and want.

One way to improve shitty user experiences is to study them. This requires information.

How do I answer questions like: what is the most frequently-used command? Which command causes the most people to give up? Which argument is being asked for, which already exists? What effect does a change in documentation have? How many projects do people work on and do we need to invest in tools for repositories with many projects?

Etc etc.

This is all Product Management 101: form hypothesis and test it.

You could answer such questions the usual established way it's normally done in other fields: sample a voluntarily participating statistically significant subset of the population.

Other fields do this when there is no better alternative. It's is orders of magnitudes more expensive and also, more to the point, quite unreliable.

Would be great to give the user an option to send statistics or something like that to do just that.

I really like VSC. But things like this really question all the positive experience. I doubt product management is going to help here.

Will now scan network transfer VSC is causing. In many other cases I wouldn't even bother anymore.

> Would be great to give the user an option to send statistics or something like that to do just that.

This is exactly what they do.

Reply on news.ycombinator.com