Hacker News Reader

Comment by asien | Hacker News Reader

Would love to use this , but I’m sure this is one those many rushed applications with the startup mentality.

Personal and Senstitive data is probably stored in a totally unencrypted manner and developers have unrestricted access to production.

We’ve seen what happens in terms of security when you give something like Firebase to startups « developers »[0]

Love the concept , but I Care more about privacy.

[0] https://searchsecurity.techtarget.com/news/252443616/Unprote...

View on HN

This comment breaks the Show HN guidelines. Please read them: https://news.ycombinator.com/showhn.html.

A fairer way to post something about this would have been to ask a question about privacy concerns.

Do you have evidence or are you just being unnecessarily unkind?

I don't think it's an unfair assessment about potential or actual security. And it's a fair critique. Whether it's a legitimate concern based on this particular implementation is another matter, but they are correct in that work history is probably sensitive personal history, perhaps not secretive. And there is evidence attached to the OP post - it's the link marked [0].

This thread is about this specific app/idea/team. It is not about potential security problems in general. The parent could have just asked "what is the security and privacy?" rather than make baseless assumptions and accusations. So no, it is not a fair critique without more information and I don't see how an article about unsecured Firebase databases is related given the current information. I can give you a similar article about unsecured, internet accessible Elasticsearch servers, but does that mean the ones I run are unsecured? You could assume that if you want but that would be an incorrect assumption.

If I'm a customer in a domain where these are concerns though, each question you make me ask during my evaluation is a chance for me to quit doing the work and move on to something else that's less effort, like the competing product that pushes their security and privacy policies upfront as a product benefit.

So don't ask me to pull myself through your sales funnel, make the process easy by addressing my major concerns before i need to ask.

Yes! Great advice! That is exactly what Show HNs are for. Tell the founders how they can improve such as including security and privacy information in their marketing materials.

I wouldn't be so blunt as the parent, but I think their comment demonstrates something that would be foolish to ignore if you're a potential business founder: credibility matters, and SaaS has a major credibility problem when it comes to personal data protection. If you're collecting personal data - and especially if you are targeting a market that is particular aware of how widespread data beaches are - it would behoove you to include your data protection approach in your sales pitch.

Honestly I'm not so sure. People apparently use Grammarly.

The next comment down is also about privacy, but in the context of business model instead of security. Maybe people (in our niche, at least) are starting to prioritize their data more than ever.

Having evidence of this particular app having poor security practices prior to expressing concerns is an impossibly high standard. The comment is clearly based on a pattern of early stage apps putting security second. I think it's fair to ask early stage apps handling highly sensitive info to at least show some evidence that they are following secure data handling practices. This is a good HN conversation to have, not unnecessarily negative.

So that would be my feedback to the poster: Detail how you ensure privacy and secure data. That should be a major part of the product description for this type of app at the outset.

> Detail how you ensure privacy and secure data. That should be…

I assume the app will target American users, but it could be useful to think through the privacy and data security with the EU GDPR — where that "should" becomes a "must".

I'll just copy a few bits, but the articles here are the most relevant:

https://gdpr-info.eu/art-13-gdpr/ : "Provide the data subject with ... the purposes of the processing for which the personal data are intended as well as the legal basis for the processing ... the recipients or categories of recipients of the personal data, if any"

Is the data shared with anyone?

https://gdpr-info.eu/art-30-gdpr/ : "...shall maintain a record of ... the envisaged time limits for erasure of the different categories of data ... a general description of the technical and organisational security measures ..."

How long is data kept after the interviews are completed?

https://gdpr-info.eu/art-32-gdpr/ : "The controller and processor shall take steps to ensure that any natural person acting under the authority of the controller or the processor who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law."

Can your developers access private data?

OP isn’t being unkind, it’s simply feedback. Not disrespect intended, but don’t be so sensitive:)

Hitchen's razor applies here: "What can be asserted without evidence can be dismissed without evidence."

It's unfair to assume poor security practices. It's also ridiculous for a Show HN to be expected to meet a burden like "separation of access" when it's likely a person, singular, that has produced this app.

Reply on news.ycombinator.com