Hacker News Reader

Comment by hayksaakian | Hacker News Reader

"When an advertiser uploaded their marketing list, we may have matched people on Twitter to their list based on the email or phone number the Twitter account holder provided for safety and security purposes. This was an error and we apologize."

This doesn't happen accidentally, someone had to engineer, test and build a system that performed reliable targeting.

View on HN

Yeah this is hilarious. I feel like tech companies get away with this because the internet is more "mysterious".

This is no different than a chemical plant "accidentally" building a conduit a quarter mile and dumping waste into a river. Of course they know.

I don't think it's equivalent. In the physical world, it's easy to make a mistake that destroys the entire thing (e.g. causes a power plant to explode) but it's hard to make a mistake that causes the system to do something completely random and not designed. Like, you can't make a mistake with a weedwacker that turns it into an airplane.

However I have made mistakes like that programming all the time... for example, having massively more data written out to disk than I had intended. You are never going to make a mistake in a factory that increases its electricity consumption by 1,000,000x but I have made errors that caused a million times more data to be written out to disk than planned.

> You are never going to make a mistake in a factory that increases its electricity consumption by 1,000,000x

Maybe not a million, but a thousand times? Sure. Just short some heavy machinery and watch the amperes light up the day like a second sun as they rush out to pour into the ground. Factories have breakers to prevent that, you'll say. Turns out software projects don't have fuse equivalents, even though they should. The reason is that bleeding electricity is expensive (and dangerous to people, which from the company's POV means "even more expensive"), whereas data leaks aren't. I hope the latter is going to change.

You really don’t think that a chemical company dumping waste into a river is worse than using phone numbers to target ads? Deep in your heart of hearts? Are you sure you don’t have an axe to grind against tech companies and perhaps that’s clouding your moral calculus?

He wasn't saying they are just as bad as one another, he was saying the excuses are just as unbelievable.

They never said it was an accident. They just said it was an error, which is true! They did err.

why call it error ? there was no undefined behavior; someone actually implemented and tested whether it worked properly. why not call it a mistake? this was a mistake. calling it an error makes it sound like it was not on purpose.

They did call it a mistake, later in the text. Not appreciably different from an error, in my opinion.

If you step into the street in front of a truck while reading Hacker News on your phone, it's a mistake. You wouldn't have done it had you been paying attention.

If you step into the street in front of a truck because you think the truck is farther away than it turns out to be, it's an error. If you are playing baseball, and you estimate the vector to intercept a ball rolling along, and you touch your glove to the ball but fail to actually catch it, it will be classified as an error, You made an estimate of what the circumstances were, and it was wrong and you acted on purpose.

I'm not saying dictionary.com is the be-all and end-all of dictionaries, but their definition of error uses the word mistake several times. https://www.dictionary.com/browse/error

Likewise their definition of mistake uses error a couple of times. https://www.dictionary.com/browse/mistake

I get it though, there is a subtle difference. I'm just saying both terms mischaracterize (intentionally) what I think was likely a very intentional, knowing and calculated action by Twitter. I'm asserting without proof that there was no inattention as in your first example, and no miscalculation as in your second example.

The baseball example is problematic because "error" has a game-specific meaning just like "run" and "base," and whether you commit a mistake or an error, they will both be recorded as errors.

I was wondering about this as well, ie. if there is a qualitative difference between error and mistake. (English is not my first language, so can't really tell.)

IMO "mistake" implies an incorrect choice, whereas "error" implies an incorrect result. A mistake may or may not cause an error (and an error may or may not be caused by a mistake). There seems to be an element of "could have been done differently" in "mistake" that is absent in "error".

Recently I read an article saying that programmers should reserve "error" for the mathematical usage of "distance from correct result" (as in, behavior of the program), and refer to their bugs and other mistakes as "blunders" instead. I have to think on it more but I like the overall direction of the distinction.

Accidents happen all the time there though, like when they accidentally lock your new account minutes after you create it, and all but force you to give them your phone number in order to reinstate it.

Same happened to me. However, I did do a support request which 2 days later agreed to let me in without a phone number. 2 days.

I think we can file this under 'dark patterns' and finally realise Twitter is attempting to be as abusive as Facebook.

I haven't worked there in a while, but you would not believe the volume of fake account creation they get. Spammers. Fraudsters. Jerks creating a second (or 20th) account to bypass restrictions. And more recently, state actors trying to manipulate things. So I am inclined to cut them some slack on the, "Please prove you're a real user" stuff.

A week or two ago anything I did with my hacker news account took me to google to solve a recaptcha. (I had blocked google when accessing this site, thanks umatrix)

Or I could email them to unblock it (my account has no email address associated with it)

Depending on what you mean by "a week or two ago", this was probably because of a botnet attack HN was under in mid-September, when we resorted to turning on recaptcha for logins for a while. We know why people hate this and want to avoid it in the future, but defending HN against attack took priority.

I'm not sure about processes at 'big' companies like Twitter but in my experience if an inexperienced developer sees a field in a DB or API it's fair game to use it even if inappropriate, and this could be the source of the mistake.

So perhaps one team forgot to secure it property (based on role authorisation) and another team saw the field and didn't think it was something they shouldn't use (maybe an OKR or some target as kicking them in the direction of being eager to use what they could get).

Obviously nothing happened accidentally at a coding level, but at a business-constraint understanding level a mistake may have been made.

I work at a big company, every field in a database of user info is tagged with a data classification. Everyone knows the rules about which classification can be used for what. Products go through a review of data use and storage (i.e. some data should be encrypted, and encrypted correctly not some hand rolled hash)

If twitter doesn't have common data classifications and everyone with a keyboard and an idea has access to the database without review, they are probably pushing criminally negligent. I understand at a company with just a couple employees. This shit happens all the time. I don't understand it with a publicly traded company that would be in big trouble with a class action data lawsuit.

Pretty sure there was a product manager who drove the project. This person needs to understand where the data is coming from and where it flows to. This person is also responsible for checking with legal to see that everything is in line.

Besides that, there're cycles of product reviews with directors and VP's.

I could buy that marketing/sales snuck around dev's oversight to manually get a copy of that to use - possibly by enlisting a poor junior dev to do an export - but there was definitely intent.

How many times have you, during the process of doing work, said "Oh hey, I think this might be a nice feature to work on for the next 3-4 days" and just not done any of your normally scheduled work?

That shouldn't be possible though. If you classify data in your database as pii and classified but then let any one with door access in there you're really doing something wrong. To add to that, what are the chances the team that owns that database didn't notice a significant uptick in requests from a new caller? I'd say a program like this is probably enough to tip over a service if it's not coordinated.

I agree that it'd be nice if devs couldn't see this data at all, but perhaps the backups are less restricted than the live DB or it's standard practice for folks to run BI/marketing queries against prod there?

Twitter probably has a serious BI department so I'd imagine they have ways of getting at various data vectors for analysis, and BI folks usually complain loudly when you block data that let's them "cohort" usage data to the point where it can be easier to just open the door for them on a read-only instance.

Facebook blocked accounts created for my Tutanota accounts within minutes. Real names but I hide a few things. I setup one for my private email only domain I use through Tutanota and it finally worked. But they continue to add a banner asking for a phone number

It was an error (as in it was against the law and they got caught), it wasn't an accident. Read what they wrote not what they're implying. I promise you their lawyer vetted it.

It’s a mistake or an error, not an accident.

They mistakenly thought this is fine. They made an error in judgement. Etc

Reply on news.ycombinator.com