Hacker News Reader

Once upon a time, I worked for a shop that did auto insurance. This involves handling a lot of fairly sensitive data about people and datasets about a lot of people, for reasons that boil down to it being incredibly useful data for actuarial purposes.

Bossware, or working machine monitoring software, endpoint monitoring, or whatever turned out to be a key part of making it possible for our data scientists to function. At all. It was the only way we could both protect the incredibly sensitive information about lots of people while allowing analysis work to proceed.

Aside: anyone who wants to talk about doing data analysis without access to the underlying data is cordially invited to explain how to do this to statisticians who only understand R and local Jupyter notebooks.

"But wait!" you protest, "Can't the business work just as well without that sensitive information?". That's a good question! The short answer is no. No, it cannot, and unfortunately there's a great deal of actuarial history behind this.

"But wait!" cry you, "Could you have not simply trusted them?". That's also an excellent question! To which the uncomfortable response runs roughly: how comfortable do you feel with "we trust them" as the primary security controls when some company has your data? Especially when that trust means you might not even know about a breach? How do you think a regulator concerned with privacy would look at "we trust them" as a security and privacy approach?

Unfortunately, I think some forms of bossware serve a purpose. Sometimes it's one of the few options available that enables trust beyond the directly interpersonal.

I think there is certainly a place for audit trails etc, but it again comes back to how that data is used. An access log is an access log, but it's a difference if you analyze it to find people looking at data they have no reason to look at, or if you analyze it to track who spends how long on their toilet break. And a lot of what's offered by current "bossware" clearly falls in the latter category.

I agree. My goal here is to set out that there are important uses for monitoring. Uses important enough that it would be irresponsible to discard the notion entirely.

> Aside: anyone who wants to talk about doing data analysis without access to the underlying data is cordially invited to explain how to do this to statisticians who only understand R and local Jupyter notebooks.

Provision some isolated machines with access to production data, and let the data scientists login remotely. You'll be able to tell who is accessing the data and when, and won't need to install invasive bossware on their systems. It's a fairly straightforward solution. It's one thing to control access to sensitive data. Its another to use that to justify monitoring employees all day, even when they aren't accessing sensitive data.

Now you need to convince them to use this system. You also need to convince them to not use this system, where they're injecting arbitrary code into the sandbox remote machine, to download the data to their local machines where they can work in the way they understand and are comfortable with. Inevitably some person will react badly to the perceived lack of trust or object to what they see as making their job more difficult for no reason.

There are a lot of options for monitoring for that kind of thing. You monitor the remote machine, you monitor the network traffic between it and their local terminal... and the most valuable will be monitoring their local machine to associate with the rest of the access and usage information. Among other things, you need to be able to distinguish between someone using the data scientist's credentials and the data scientist using their own credentials.

Your idea is a wonderful approach! It improves security, privacy, traceability, and auditability. It may not be the same as removing the need for endpoint monitoring, unfortunately.

You can never perfect endpoint monitoring. At the very least, the engineer could see data, go to the bathroom, and write down what they saw on a scrap of paper. As long as eyeballs see data this is possible no mater what software you install on device, or even if you have an armed guard sitting in the office right behind the engineer.

Yeah, do people really want no supervision on employees handling their PII or other sensitive info? I think I would be upset if I found out my info was not even being attempted to be protected while in an employees possession.

I worked as a bioinformatician at a medical device company. We did genetic testing on cancer patients, and had huge amounts of private, personal information on the patients we were testing, because it was necessary to provide the correct clinical determination.

We also didn't have bossware. There were access controls on the data itself, audit trails on who accessed the data, but no software running locally on my personal dev machine looking at what I did at any particular moment.

HIPAA governs the storage, transport, and use of that health information, and we all knew we were criminally liable if the information got out.

Bossware in a HIPAA environment (or other environment where not having leaks in important) can be more of a liability than a boon, because it becomes yet another vector for attack or data leakage. You are in effect sharing all data a machine can access, with the maker of the bossware.

Something with the teeth of HIPAA but for other pieces of personal information could go a long way. It's amazing how differently executives behave when the consequences of data leaks change from "customers could be unhappy if they found out" to "I could personally go to prison".

> It was the only way we could both protect the incredibly sensitive information about lots of people while allowing analysis work to proceed.

Meanwhile this data is getting leaked every other week by other companies. Didn't Equifax leak pretty much all sensitive information for the entire nation. What happened there?

I haven't formed a constructive thought out of all this yet, I'm just frustrated that we'll get surveillance software to allegedly protect data that's already been leaked by a hundred other companies.

Often this will be like the "think of the children" argument. Of course we should be concerned about security and make efforts to protect data, but many times the same people who push surveillance software in the name of security will later turn a blind eye to other security practices or concerns that might be an inconvenience to them. Their concern for security will extend only as far as it gives them power.

It's very often different companies and different systems. It's rarely the companies with mature and well-implemented security, privacy, and governance systems that do Equifax-style data spills.

To draw an imperfect comparison - improving the efficiency of electric car motors does little for those driving dino-juice-mobiles. That we as a society have the tools and ability to do better does not mean that every person and organization adopted them immediately and perfectly.

> anyone who wants to talk about doing data analysis without access to the underlying data is cordially invited to explain how to do this to statisticians who only understand R and local Jupyter notebooks.

Joint distributions and generating functions trained against the production data to generate synthetic data, generally.

semi-randomly, I was reading about the colonial Spanish mining city of Potosi in the South American Andes today, before opening YNews. The Spanish Viceroy (administrator for the King) oversaw the conscription (slavery) of 1 in 7 adult males each year, over a vast area, to service the poisonous and intensely profitable silver mines. Stories of courage and death predictably follow, while the administrators, unconnected to the daily life in the mines in that region, made record profits, among the largest wealth in Europe at the time (late 1500s). Comments on the social structures that supported that, left as an exercise to the reader.

Consider history; Do you think for one minute, that a Viceroy somewhere, and legions of new administrators, won't inflict endless and strictly enforced conditions on anyone they can find, using software?

https://upload.wikimedia.org/wikipedia/commons/2/21/1776_Pot...

Yeah, if tech is developed with the explicit purpose of surveillance on workers, it's definitely not some dubious case where "well maybe it's done with good intentions". Nothing good comes from putting extra mental strain on your workers, showing you don't trust them and being an invasive boss overall.

> it's very clear how workplace surveillance tech will be used to harm workers

My takeaway is not just that that, but that it will be used to harm businesses as they train their employees to do the measured thing over and above the best thing for the company.

I suspect most people here could envision this as an extension of a "Lines of Code written" based performance metric and intuit the likely outcomes.

This stuff is worse than the Death Star. At least that thing made no pretence about helping its targets. I cannot fathom how much my mood has dropped on reading about Bossware. I'd do pretty much anything in my career to avoid it.

I was referring to some material from the no-longer canon Star Wars Extended Universe, where it was referred to during development as the "Imperial Planetary Ore Extractor", and some characters working on its design genuinely believed (due to brainwashing) that the Death Star "was developed to break up dead, lifeless planets to extract the valuable ores and elements within". https://starwars.fandom.com/wiki/Qwi_Xux

Of course, if programmers are raised from a young age and brainwashed into believing that workplace surveillance is innocent / good, that's a different problem than adults who should know better when it comes to the real world results of using the tech they are building.

Thanks for the context, I was unaware.

This made me think about other tech that has no good use. Flamethrowers come to mind. Not the fun ones that Elon will sell you as a gimmick, but the ones that toss sticky flammable liquids at people.

I was listening to someone describe their use in WWII, and he was I suppose trying to defend it by saying that actually most of the people it killed weren't burned at all, but rather killed because they were in enclosed fortifications and apparently flamethrowers produce prodigious amounts of carbon monoxide - basically you'd take a couple breaths and it's over - the carbon monoxide will bind into your blood cells such that even if you immediately step out into fresh air, you're a dead man walking. But at least your corpse will be recognizable for your friends and family I suppose; you won't be burned beyond recognition.

But building a reliable flamethrower is an interesting technical challenge, so I'm sure you can find an engineer who will be willing to give it a go.

>I think this is a key failure of understanding for the "tech is neither good nor bad!" camp:

I like the addendum, "...but nor is it neutral"

Oh come on. He's playing dumb for the positive PR view. Of course he knows what his product is going to be used for.