Comment by geocar | Hacker News Reader

Comment by geocar | Hacker News Reader

I'd like to point out, it's not "DoorDash" that has done anything wrong, it's these people:

- Andy Fang

- Evan Moore

- Stanley Tang

- Tony Xu

They decided our security and privacy wasn't worth as much as hur hur hur growth hacking startup hur hur next uber, and couldn't be arsed to even give us a proper apology.

Look at their blog post: not one mention of the words "we sorry, we fucked up".

It's all about the other guys.

The bad guys.

The guys who stole your data not us, and you should change your password with us to protect your account with us.

No. That's wrong. Look at the 295 million people who weren't affected -- all the people who don't use doordash at all!

That means the best way to protect yourself is to simply not use doordash. Delete it. Delete the email account and the bank/credit card you used with them (ask your bank/credit card company for a new number). Move if you've got to (drivers license details!?!?!?) You have no other protection now- you're fucked. They have your data, and they're only going to risk it again.

And remember how difficult it is to get in control of your data again when the next breach happens, the next time you're thinking about signing up with something, or you're getting ready to vote.

The founders are very busy devising wage theft schemes. How can they possibly spend time on security or apologies?

> devising wage theft schemes

Expand?

Basically if you "tip" a driver through DoorDash, the tip doesn't really end up going to them.

https://qz.com/1659475/the-merits-of-tipping-your-doordash-d...

DoorDash implemented that scheme to give more consistent payments to workers, as tips are quite variable. Anyway, if it helps, DoorDash is currently moving away from that model. [0]

[0] https://www.theverge.com/2019/8/22/20828742/doordash-tipping...

> as tips are quite variable

That's kind of the point. And par for the course in any tipped job.

If DoorDash had actually wanted to make it consistent, they would've just removed tipping, like everyone else does that wants to do that.

What they did was shady as hell, and they know it which is why they are changing it.

---

* There is the common, legally mandated practice for employees where minimum wage is paid instead of tips, until base pay plus tips meets that. You could make the argument that DoorDash base pay is simply $0.

But (A) base pay of $0 is never done (B) base plus tips don't typical fall below minimum wage (C) this doesn't really apply anyway since DoorDash doesn't pay wages; it pays contractor fees.

There was recently a controversy over how Doordash implemented its tipping policy. Drivers get paid a wage to deliver food to you, and you would expect that if you specify a tip through the application, that tip goes to the driver and their compensation is increased by N, where N is the amount of the tip you specified.

It turned out that until recently, that was not the case; drivers would get a wage to deliver food to you, and if you specified a tip through the application, then the driver would have money deducted from their wage equal to the amount of the tip up until tips made up one hundred percent of their wages, at which point tips would increase their take-home.

So in effect, Doordash was using tips to subsidize worker pay as opposed to augmenting worker pay, and this was in no way communicated to customers who reasonably expected that a tip would increase the worker's compensation.

Yikes.

That is extremely misleading. Another reason to tip in cash, I suppose :/

Instacart and DoorDash used to deduct tips from the money paid to drivers so drivers make the same regardless of whether they receive tips or not. Instacart changed their policy in February 2019 while DoorDash changed it in the last month. Other delivery services like UberEats, Postmates, and Grubhub did not engage in this practice.

I agree there should be real people (founders, c-levels, engineering managers, etc) taking responsibility for things like this. Another place to look at is the insurance companies who sell cyber liability policies to basically all (even small) tech companies. Those policies provide near full coverage for the most expensive parts of breaches like these (including a set dollar value, often $100-200k in policies I've seen, to hire a PR firm to recover from the media fallout). These policies are often surprisingly cheap (you can get very good coverage for $10k / year)

Edit: A common complaint with these type of announcements is the lack of owning the mistake. Just wanted to point out that this is almost certainly a result of the company contact their insurance carrier about the incident, and the insurance carrier instructing the company how to respond to the event (in order to remain eligible for benefits under the policy). It’s not a great excuse, but there is a reason that’s slightly outside the control of management.

Really interesting. Do you know who the biggest insurers are?

A couple examples: Beazley, The Hartford. There are lots. Most companies have an insurance broker who goes out to the various insurance companies and brings the quotes/options to the companies to choose from. https://foundershield.com/ is one example of a broker for small/medium size companies.

Could not agree more. There's a tendency to not blame founders... but why? They created the product from the ground up. They had a choice on how to build security and chose the easy way out. They should be held to a higher standard given the power dynamics they have over the company and its users.

I would subscribe to a blog you write about the people (with names, photos) behind every single business fuckup, especially if it is a decision made because of greed.

For frustrated folks like myself who are also lazy like myself:

How to deactivate: https://help.doordash.com/consumers/s/article/How-to-deactiv...

Where to deactivate: https://help.doordash.com/consumers/s/contactsupport?languag...

*for what its worth, deactivation and deletion are mostly semantics if the point is to send a message to a company that their mismanagement erodes trust with users. "churn" is a metric that very much matters to executives and "deactivation" impacts that.

I'm very uncomfortable with this level of personal shaming. There's a reason most serious tech companies have adopted a "blameless post-mortem" culture. When you individually vilify people for mistakes, you create a culture of fear and kill initiative and risk-taking. Maybe you think everything worthwhile has already been invented, but I don't.

Is there something about this story that makes you think it's an issue of negligence rather than a capable intruder? We keep getting told that total security is impossible. Isn't this inevitable? Is it just that they waited too long to disclose it?

(clarifying since I've gotten one downvote as of now): Of course we should all be mad about the general state of computer security. I'm just trying to figure out if I really should be avoiding DoorDash in particular or is this just a straw breaking a camel's back?

Security is a cost/benefit decision, not a binary one. More security costs more. Putting the drivers licenses and bank details of employees in the same database as the credit cards and names of customers is cheaper than putting them on separate databases. Putting them on the Internet is cheaper than having a separate network. Turning off your logs "when you don't need them" is cheaper than leaving them on all the time.

If anyone says "total security is impossible" you just say: So fucking what? That's not an excuse for spending as little on security as possible, and you know someone isn't serious about security if they avoid admitting they are responsible for the security in the first place.

sorry, who are these people you've just graciously named??

The founders (and current CEO and CTO) of DoorDash.

thx, I just wasn't sure exactly who it was

Reply on news.ycombinator.com