Hacker News Reader

Comment by rco8786 | Hacker News Reader

Some real (understandable) ignorance about how the tech industry works in this article. There should be no expectation that Instagram ever deletes anything permanently from their servers.

The bug was showing users photos that were internally marked as deleted. Not that the photos were not in fact removed from Instagrams servers.

View on HN

> There should be no expectation that Instagram ever deletes anything permanently from their servers.

No, there should be this expectation. If I have a photo of myself that I'm not comfortable being saved somewhere, there should be an expectation that when I delete this from a service, that service will actually delete it.

The expectation should be that the service will do what it said, not that it hid everything very well.

Unfortunately this isn't how computer storahe works. This is why the military have acid baths for their disk drives.

In this particular case they are actively not attempting to delete the image at all, a big difference.

Untrue, even on flash-based storage full deletion is possible.

Here's an answer I pulled from reddit:

If you are appropriately using TRIM the data will be obliterated when 'garbage collection' occurs -- forensics will not be able to recover deleted data. This is going to be largely dependent on your OS and Hardware, but if you confirm TRIM is working correctly in your setup, shortly after you permanently delete something (not recycle bin or trash) it will be gone for good.

The answer is that simple.

Supporting data: http://forensic.belkasoft.com/en/why-ssd-destroy-court-evide... http://digitalforensicsmagazine.com/blogs/?p=271 http://www.mcgoverngreene.com/advoedges/AE_pdfs/2011_pdfs/AE... http://www.forensicswiki.org/wiki/Solid_State_Drive_(SSD)_Fo...

There's also this as a less reliable added measure:

http://cmrr.ucsd.edu/people/Hughes/SecureErase.shtml

The main takeaway is that people vastly exaggerate how recoverable disks are, making any effort at all will stop 99.9% of hackers trying to recover data.

Maybe we'll get to that place someday, but that is a far cry from reality both in industry norms and regulations in place (and frankly, even regulations being discussed at this point)

The GDPR and its right to be forgotten agrees with you.

This is grounds for sending a strong message to Instagram for not doing what they are legally bound to doing.

You are several years out of touch with the regulatory environment. The GDPR is pretty clear about this sort of thing and if you do not actually delete data upon request but pretend you do that might not be construed to be an accident but willful. Your comments in this thread provide further evidence that this is in fact the case.

It's also clear about how to request your data be deleted! Clicking delete in the instagram app does not constitute a request to be forgotten.

The GDPR does not allow for your data to selectively be forgotten either. You can request that they forget all of you, but not individual pieces of data.

The 'right to be forgotten' and the GDPR data subject access, review, correct and delete rights are two completely different things.

https://en.wikipedia.org/wiki/Right_to_be_forgotten

https://gdpr-info.eu/art-7-gdpr/

Reply on news.ycombinator.com