Hacker News Reader

Comment by BoorishBears | Hacker News Reader

Are you seriously entertaining the idea that Github should pour resources into developing a SSN detection pipeline?

Why don't they also flag repositories with lots of names, those are PII. Too many addresses? That's a red flag.

Why would you even for a second entertain this nonsense? Non-technical people who think this:

https://github.com/Hack-with-Github/Awesome-Hacking

is a smoking gun to prove Github as a company is supporting hackers are the ones putting forth this idea, no one with any technical knowledge should come close to supporting this.

View on HN

Agree. This kind of DLP-like scanning is totally infeasible at GitHub scale.

In particular, one excerpt from the complaint reads like output from a noisy scanner that has detected “exposed SSNs” in client-side code:

> [...] Social Security numbers are readily identifiable: they are nine digits in the XXX-XX-XXXX sequence.

Per EU's GDPR, and maybe the future California Consumer Privacy Act, yes : GitHub should do everything they can to preserve people's privacy. Including maybe flagging and reviewing projects which process PII.

GitHub is popular enough that less technical people also browse it, in particular young people looking to learn.

If I accept that technical difficulty and infeasibility is no defense, then I want that standard applied to lawyers as well.

Overly litigious firms causing rising legal costs across industries? I don't care if it's hard to solve, the onus for fixing it is on the firms, they figure it out or face penalties. Perhaps in the interests of helping the disenfranchised we could institute something like what real estate has, where banks are required to sell a quota of mortgages in certain areas regardless of the financial viability. Lawyers could be forced to seek out clients they would ordinarily never entertain due to the risk of loss. If would stink for them, but what do I care? That's their problem.

> everything they can

Just the other day my mom texted my address to a friend that wanted to mail me something. I want to know why Verizon didn't stop that from happening!

Verizon should be censoring all addresses from text messages, but I suppose it could allow them after a manual review process.

HN is guilty here as well:

  1600 Pennsylvania Ave NW, Washington, DC 20500

Why isn't the above address automatically censored?

The message from your mom is private and isn't supposed to be read by Verizon for Verizon to provide its service.

If you don't want your mom to send PII about you to other people without your consent, and it incurs damage, you can surely sue your own mom.

I can't tell if you actually mean what you're saying, or if this is just the time-honored HN tradition of being a contrarian for the sake of being a contrarian.

Reply on news.ycombinator.com