Yev from Backblaze here -> we’ve looked into and verified the issue and have pushed out a fix. We will continue to investigate and will provide updates as we have them.
What you have right here and right now is a public relations disaster. Trust in your brand has been damaged. It cannot be repaired by you providing minimal information. Your standardised message is akin to "Don't worry your little heads over the details - trust us, everything is fine now", and to be honest I find it a bit insulting. As far as we know, "pushed out a fix" could mean that you have hidden the tracking, so it is harder to find. Your short message is making the public relations disaster worse, not better.
These are the steps that you need to take:
1. Provide an explanation of why tracking was being performed in the first place, including an analysis of how much of that was a mistake.
2. Make an apology for breaching your customers' trust. This is a really important step, and it should be repeated in each of your press releases.
3. Provide details on the steps you have taken to fix the problem, and what that means for tracking data.
4. Make a promise that strictly limits the level of tracking that you will be allowing yourself to make in the future. Ideally we would all want that to be zero, and if you intend to do business with certain jurisdictions then you are limited to what is legal, but you must in any case be clear about what tracking you will ever do.
Honesty and transparency are the keys at this point to restoring your brand. I do not think the community will accept anything less.
Yev, if you are not in the upper management chain of Backblaze, please show mnw21cam's message to someone who is.
The problem is not that there was a little bug which caused the Facebook tracker to get a few little pieces of information it shouldn't have.
The problem is that Backblaze failed to understand how to distinguish appropriate and inappropriate uses of third-party trackers for signed-in users on a security-critical application. The Facebook pixel should never have been there at all. It shouldn't even have been considered. It should've been an absolute no-brainer that Facebook has no business being on secure pages on a critical infrastructure service for paying customers.
The fact that the pixel even showed up at all on a logged in page represents a breach of trust for customers and casts doubt on Backblaze's competence in handling security issues. This warrants a serious reply from the CEO, not a copy-pasted meaningless reassurance.
He posts a lot on HN and Reddit in Backblaze posts.
Sort of like the Streissand Effect; if BB starts posting press releases about "breaching trust", filled with apologies, the audience that will become aware of this issue will be a lot bigger than it currently is.
So from a PR persepctive, a one line low key "we pushed a fix" reply makes total sense.
Right now, the issue is being downplayed, much to the chagrin of an increasingly knowledgeable set of computer users.
I'm not sure that's true.
There are a number of barely-technical subreddits, typically centered around Plex or some flavor of bittorrent, that consist of an all-day-every-day request for "as much cloud storage as possible for the lowest possible cost and please say it's free".
These are not HN readers. It's as if they attained consciousness two minutes ago and one minute ago they decided they needed cloud storage.
This is the audience these kind of analytical tools are geared toward and I don't think this changes their "engagement" or their "convertibility" or their "lifetime value".
The real information here is that in 2021, and in conjunction with a much more sophisticated product offering (B2), Backblaze is very aggressively pursuing flat-rate, loss-leaders who can be influenced and targeted by facebook.
Draw what conclusions from that you will.
I understand that is a lower price than your own product, but it doesn't necessarily follow that they're losing money.
You seem to be implying that their covering the losses on storage by selling customer data. Is that correct? In which case, would you like to be a bit more specific and explicit?
Aren't those the kind of users you can monetize through social media "engagement" ? I don't think it's the B2 users... which class of users had data leaks ?
But just to be clear: is your claim that the unlimited storage consumer backup plan is a loss leader, and they cover their costs by selling the backed up data (or metadata) to the likes of Facebook?
It seems like you're trying to waft a very serious claim in the direction of competitor, but you're being very careful to avoid saying anything explicit or specific.
Which is to say: the provider has a vested interest in minimizing your usage and incurred costs which runs directly counter to the consumers desire to use as many resources as possible. This antagonistic relationship leads to all manner of dysfunctions and bad patterns.
When I see serious businesses "enhancing engagement" with facebook pixels, I think that perhaps that is one more side effect of that antagonistic provider/customer relationship.
HOWEVER, it turns out that the tracking code was on the B2 side of things - the people-paying-money side of things - and not on the who-will-let-me-upload-movies-forever side of things.
So my sense was wrong.
I was suggesting that this might not be as brand damaging - and trust eroding - as my parent suggested. After all, both sides of that unlimited flat rate storage relationship are pretty dysfunctional. If this was on the B2 side of things then I take it back - it's probably quite damaging.
Regardless: I stand by my disdain - and continue to warn against - flat-rate service offerings. You want your provider to happily enable you to use more of their product.
[1] https://blog.kozubik.com/john_kozubik/2009/11/flat-rate-stor...
I think their best advertising for B2 is the quarterly hard disk stats, it's a shame they made this mistake with the fb tracker; I can't store data in my garage as cheaply as they do. ~100W continuous for a box with drives at $0.30/KWh (CA PG&E) is $20/month.
I'm jumping through the hoop of s3backer to turn B2 into a vdev for a zpool with encrypted datasets; I'll have to try something similar on rsync.net with sshfs.
I might very well start using backblaze next year or maybe even next month[1], but that is depending on the outcome of this event.
For a comparison: one good friend once called med to apologize that he had been laughing behind my back with some friends.
Guess who I definitely trust today? The one admitted his mistake. He always was a nice bloke and I guess he will never ever do anything like that ever again.
[1]: I won't start using it this week or the next however.
As another data point, Backblaze has pretty much until this weekend to provide an update that includes "we have removed Facebook and are getting a 3rd party review for other security holes in our product". After this weekend, I won't care because I'll be on a different product.
This is embarrassingly bad, as in, I'm now embarrassed for recommending using Backblaze at my company.
Crap, I just realized I got Backblaze installed at two previous companies. Thanks!
If they refrain from engaging, then I agree that you shouldn't judge them by that.
I'd still use Backblaze but that's VERY dependent on how do you handle this. Just saying "we fixed it" doesn't answer the much more fundamental question of "what is the FB tracking pixel doing in a privacy-critical page in the first place?".
Please, do a thorough post-mortem analysis and publish it. Looking at the comments here, this could mean you get or lose the business of many.
Who thought that Facebook tracking should be forced on paying customers?
If this passed review - it is likely even worse.
> In the unlikely event of a data breach, as defined in the GDPR, Backblaze will without undue delay send its affected customers a notification email, and provide at its discretion, updates through other communications channels. This notification will describe the nature of the data breach, including where possible, the categories and approximate number of data subjects concerned, the categories and approximate number of personal data records concerned, the contact point where more information can be obtained, the likely consequences of the personal data breach, and the measures taken or proposed to be taken by Backblaze to address the data breach, including, where appropriate, measures to mitigate its possible adverse effects.
Because that's the only valid fix here.
Also is this “bug” in breach of GDPR?