Comment by geofft | Hacker News Reader

Comment by geofft | Hacker News Reader

Parent Full thread

> Given the prevalence of comments like this, I wonder why any company would ever bother offering an apology or retraction.

Correct. I don't want apologies or retractions from companies. I want postmortems.

This is really no different from a technical outage, e.g., "As a result of a bad deploy to prod on Friday, all Triplebyte profiles became public." Why was it not noticed in testing? What is the testing process? Is profile privacy part of the testing process or part of code reviews? What are the practices around making changes that affect user privacy - is there a culture of asking questions about it up front, etc.?

Most importantly, what changes are being made to prevent a similar outage from reoccurring in the future? I really couldn't care less about how bad the CEO feels about it - sure, the CEO probably should feel bad, but feeling bad is not a reliable mechanism. If the CEO said "Bwahaha, I wish to profit and I learned over the weekend that my profits were in danger, so I changed course" but then says that in order to maintain his profits in the future he added an external privacy council that reviewed all major new initiatives (or whatever), that would actually be a lot more useful than contrition.

Now, yes, it's true that basically no company does public postmortems of decisions that they needed to walk back (at best you get blameful postmortems that end with a key executive resigning, but most of the time that doesn't help anyway - either the executive wasn't the problem, or they were the problem and they already spread the bad culture to others). But I think it was pretty rare until a couple of years ago for tech companies to do detailed public postmortems of internal outages, and that expectation has slowly changed. I think we should push for the same change for non-technical incidents like this.

If there's one comment I think the CEO ought to take to heart, it's this.

I'm sure the CEO has been taught that good leadership means fessing up when you've screwed up, and to an extent that's true. But it's also an act of ego to assume full responsibility. Ego got them into this mess, most likely, and it will not get them out of it.

The CEO needs to realize there was a systemic failure. It's not just about him having an epiphany – it's about surrounding himself with people, processes, and values that can help keep a runaway product idea from breaking their customer base ever again.

That sounds like an excellent idea.

And I absolutely agree that the feelings of the CEO matter less than putting in place some proper procedures.

Profit ain't bad.

You can’t install business processes to prevent unethical decisions. You can only hold the people making those decisions to high ethical standards, and replace them when they fall short of those standards.

Now, I suppose it may be possible that the CEO in this situation dramatically misunderstood the situation. It may even be possible that he had good faith even as he militantly defended those misunderstandings in previous threads. But from the perspective of trust, I can’t get past the suspicion that he’s just sorry that he got caught.

Exactly. I went through their process to delete my account on Saturday or Sunday, and still received their apology letter. This suggests my account was not deleted?

They could delete almost all the data in your account, but still hold onto your email address?

Why would they need to keep your email if you have deleted your account? To spam you? To sell your email to spammers?

You can install business processes that give chances for unethical decisions to be reviewed and identified, though. Committees are shit for innovation but relatively effective for squashing interestingly bad ideas along with any interestingly good ones.

I read the apology letter as essentially saying he single-handedly drove the idea, in part because he was flailing due to COVID killing their bottom line, and was tunnel-visioned enough to not recognize it was unethical. Even at face value, that’s absolutely troubling for a CEO in TB’s domain. But smarter people have done dumber things under pressure, and sometimes dumb is at someone’s (or a lot of someones) expense by mistake.

So I’d like to think this was an exceptional occurrence, and I appreciated his personal post-mortem of sorts. However, taking this as charitably as possible, a process-oriented RCA focused on how he’ll keep his runaway ideas from being a one-man show—or whatever the problem actually was that saw this conflagration actually see light of day—wouldn’t suck.

I still don’t like the idea of hamstringing the CEO’s ability to make executive decisions because the CEO can’t be trusted to make ethical executive decisions. Processes are fine for preventing operational mistakes, but when it comes to ethics and executive judgment, they’re a poor substitute for having trustworthy people making the decisions.

They should be more trustworthy than this, for sure. But sometimes a poor or harmful decision is still an operational mistake that comes down to poor information or comprehension. If it were to become more apparent to me that this was a deliberate lapse in ethics, I’m sure I’d be more where you’re at.

As it is right now, I’m giving some charitable credence to the idea he’s the CEO equivalent of the skydiving photographer that, in his passion to get a great shot, jumped out of his plane with no parachute. It certainly may end up having an analogous effect on Triplebyte’s credibility.

Maybe so. But in the general case I think individuals typically have much better moral judgment than processes and organizations. And the individual whose moral judgment ultimately prevails is the one who makes the decision. It’s not something that can be delegated.

I think you'd still want some sort of business process for "hire ethical people" - because there is a huge business process being implemented from all your team managers and all your board members for "make money in whatever way you can" (or, in the case of a startup, perhaps just "grow in whatever way you can"), and you want something to counteract that beyond just one person's conscience.

Potential business processes include "ask about ethics as part of culture fit, and have a good sense of what you mean by 'ethics'," "ask about ethics as part of promo / do not count projects that put user data at risk towards promo," "vet investors for their ethics and see how their other investments are doing before allowing them to take a board seat," etc.

An ethical CEO will probably be doing many of these anyway, which is fine. You don't need to formalize them. It's fine for the CEO to say, for instance, "Ordinarily I would have put the brakes on this via this particular means, but I failed to notice because of this unexpected circumstance. I'm sorry and this is how I'm going to make sure I notice and make the right decision next time." (That is't too far off from what was actually said, actually, except for the bit about how to make decision-making more robust in the future. Everyone, ethical or not, fails to live up to their expectations of themselves at least occasionally.)

> I think you'd still want some sort of business process for "hire ethical people"

I absolutely agree. But this only works if the top leadership are themselves ethical people. If they are unethical or even neutral, it’s going to backfire. Instead of hiring people for their backbone in terms of pushing back against unethical decisions, it turns into hiring people for their willingness to conform to what they are told.

> It's fine for the CEO to say, for instance, "Ordinarily I would have put the brakes on this via this particular means, but I failed to notice because of this unexpected circumstance. I'm sorry and this is how I'm going to make sure I notice and make the right decision next time."

Definitely. But you only get to use that excuse so many times before it starts to lose credibility.

> That is't too far off from what was actually said, actually

Here I disagree. To his credit, Ammon has taken full personal responsibility for pushing this through, even over internal objections. It’s not a failure to notice something that happened when you’re the one doing the thing.

The resolution is also more personal than procedural: be more conscientious about your users and listen to people who object to your ideas. Demonstrate that you can do that over time and you can regain trust.

> Processes are fine for preventing operational mistakes, but when it comes to ethics and executive judgment, they’re a poor substitute for having trustworthy people making the decisions.

Exactly this. The only thing that _might_ actually make me trust Triplebyte with my data again is if their current CEO actually stepped down to a less influential role. If I were part of the board I'd actually be advocating for him to step down or be forceably removed if possible.

He didn't put a stop this catastrophic breach of trust after being made aware of it. Even worse, he seemed to have actively drove this forward in spite of opposition. I'm simply not willing to trust a company where he's the top-level decision maker with data as sensitive as they're dealing with, apologies or not.

Reply on news.ycombinator.com