Hacker News Reader

Comment by jwr | Hacker News Reader

I wonder how long until companies start regarding customer data as a liability (and a risky one at that), rather than an asset.

View on HN

To my knowledge there are very few negative consequences, outside of the immediate and obvious ones like reputation, that actually occur when companies leak customer data. I suspect they won't regard keeping vast troves of customer data as a liability until that changes.

Just look at Facebook. How many people have deleted their accounts...

I strongly suspect the amount of money Facebook makes utilizing that data greatly outweighs the cost incurred by the "customers" they've lost as a result of poor data handling.

I’m busy building a little tool that I hope I can sell as a SaaS one day and this is absolutely forefront in my mind.

I do not want any of your data, above that which I must hold for the service to be useful. It’s just a liability.

See also: Marco Arment, maker of the Overcast podcast player, pushing people to take their accounts anonymous [0]. It’s just good business sense at this point.

I also plan on having zero trackers. I’ll just get over the fact that I’ll have no visibility of users on my site other than what I can glean from public forums or, you know, actual paid sign-ups. It’s all too fraught with leak risk and I can’t be bothered.

[0]: https://marco.org/2018/04/27/overcast42

Under what circumstances do you think an airline would choose not to know its passengers? This isn’t adtech.

Doing so will require regulation, and the current US government is against any/all regulation. So I'd say at least 2 more years of further 'data leak' bullshit until we have a real shot of doing something to motivate companies to treat customer data appropriately.

I work in a so called "Big Data" startup.

We go to great extent to not have any kind of Personally Identifiable Information, because the liability is way too big.

It really sucks when a client accidentally send us a list of their customers email and we have to clean up everybody's inbox.

When there is meaningful regulation, serious consequences, and enforcement agencies with teeth.

I just made this case to my coworkers recently to defend our use of a hard delete in our customer database, as opposed to a "soft delete" boolean column.

It would only be a liability if there were serious punishment.

When CEOs start getting jailed. CEOs are ultimately responsible. Especially if they are going to justify high salaries for themselves. Fines mean nothing.

This makes no sense. Imagine a junior engineer forgetting to sanitize some inputs, leading to SQL injection. Should the CEO really be put in prison for that? Should the engineer be jailed?

Why doesn't the engineer's manager require code reviews for all check-ins/patches before running in production? Why doesn't the CEO, or anyone between the CEO and the engineer, mandate that all engineers writing production code take courses in writing safer code (e.g. sanitize all input, no exceptions)? Why doesn't the CEO pay for code audits?

I wonder how many companies who have 'leaked' data recently are doing these things. Granted, it will never catch all bugs, but avoiding these things is negligence, which should be punishable.

The CEO makes what, like 100 times of that what a junior makes. Why shouldn't he responsible? He cannot account for that much money through his pure workload but only by taking up responsibility.

Criminalization is wrong, though. Put the company to death, that's enough. Even the high penalties of GDPR already cause changes of management behavior (at least where I work).

But the CEO can set a policy of deleting information that is not required, and making sure that policy is followed. Cathay Pacific could choose not to keep all that information.

Reply on news.ycombinator.com