Hacker News Reader

Comment by AnonC | Hacker News Reader

Firstly, this post does not even mention or describe what kind of information was exposed and makes it seem like some inadvertent tracking that's not serious in any way. You can continue with your root cause analysis, but you already know very well about what kind of information was exposed and shared with Facebook. The least you could do is own it and alert people about it.

> We take the privacy of our customers’ data and personal information very seriously...

It's astonishing that there is no apology of any kind on this post. Is that too much to ask for such a grievous violation?

> On March 8, 2021 at 8:39pm Pacific time, a new Facebook campaign was created that started firing a Facebook advertising pixel, intended to only run on marketing web pages. However, it was inadvertently configured to run on signed-in pages.

It went unnoticed for two weeks, with Facebook gathering information about the customers' files! And yet, no apology!

View on HN

There will never be an apology. A corporate apology is an admission of guilt. An admission of guilt opens it up to lawsuits. Through its litigeous nature, the US has evolved a culture whereby apologies and human decency are antithetical to survival.

Yev from Backblaze here -> I apologize for this mistake. We've updated the post with additional information now that we have it and there's also an apology.

On another note, have you contacted facebook to get the data removed from their servers?

Yev from Backblaze here - with sincere apologies. After we removed the offending code on Sunday night we went into investigation mode and conducted a rca - we wanted to get some kind of blog post out there so that folks could see that we were working and investigating the issue. I will grant you that maybe our initial execution on that was lackluster, but we wanted to make sure we had a better handle on what we were talking about. We've since updated the blog with additional information, you can read those here: https://www.backblaze.com/blog/privacy-update-third-party-tr....

> We are also reviewing applicable third party code on the website.

This is very simple. On all dashboard and similar signed-in pages, there's exactly zero applicable third party code.

If you think otherwise you do not in any way take "the privacy of our customers’ data and personal information very seriously".

As such, you should be much more specific about what you mean with "we removed the offending code".

If you never intended for third party scripts to run on the dashboard page, well then you got some serious explaining to do as to how your deployment process let that slip.

I see the blog post now says the following:

We also subsequently removed Google Tag Manager from the private pages.

This is good. However, the question then becomes how on earth did Google Tag Manager get added to those pages to begin with?

Either you did not consider this a cause for concern, or it slipped past your code review. In either instance, how could I ever trust you with my data?

That question needs a serious answer.

Yes, this is rather disappointing. It's probably also in breach of GDPR assuming backblaze haven't contacted customers directly, informing them about the nature and detail of leaked data (based on your use of backblaze on X, we see that the following filenames and Metadata was incorrectly handed over to a third party (Facebook)...).

Wouldn't this also be a GPDR violation by Facebook as well?

Possibly. But Backblaze has an agreement with the user; and they have taken data they need / are justified in handling (filenames, sizes) and leaked them. Google docs wouldn't be liable if I stole your credit-card and put it in a Google doc.

It may be that fb is doing something illegal here too - eg the whole way tracking pixel work seems difficult to square with gdpr - but the tracking pixel/service looks a bit like the drill used to force a lock - another party (like BB) must deploy it. And arguably the purpose is not to "steal" data.

on tv at least, they say that apology is the same as admitting guilt, so they might not want to do that for legal reason

anyone know if that applies to the real world?

Could it be any more admitting guilt than

>a new Facebook campaign was created that started firing a Facebook advertising pixel, intended to only run on marketing web pages. However, it was inadvertently configured to run on signed-in pages.

"We take privacy very seriously" is a sign that they don't take your privacy seriously at all.

inadvertently is the operative word here - I.e. their position is that this was just an accident.

Reply on news.ycombinator.com