Hacker News Reader

Comment by theCrowing | Hacker News Reader

Sorry but the points are totally valid. If you delete your account your messages are still available with a userid that if someone has it can be traced back to you. They also don't delete files or pictures you uploaded alone for this they should get fined.

View on HN

I think they ended up fixing this, all the deleted users I can find resolve to UID 456226577798135808.

Although, messages that used to @mention the user don't have their UID mangled (since @mentions are really `<@userid>`), so it'd be easy to correlate someone @pinging a deleted user and that deleted user responding to the ping. Seems like fixing this would be pretty challenging (logistically and computationally) given you'd have to arbitrarily edit other peoples' messages.

Mentions are also listed in the message metadata, in the allowed_mentions field, therefore it should be very easy for Discord to strip mentions of deleted users' IDs.

In any case, 800k is a ridiculous amount for such a huge company like Discord.

Where do you find their revenue stream data?

They’ve probably never made any money.

"in August 2021, Discord had reported $130 million in 2020 revenues, triple from the prior year, and had an estimated valuation of $15 billion"

https://en.wikipedia.org/wiki/Discord#History

There's no evidence in that sentence that they have made a dime.

The company may not have recorded any profit, but the founders and other equity holders can leverage or sell that equity worth $15B.

Revenue is not profit. You need to subtract expenses and whatnot.

That’s right. But for GDPR no one cares about profits. They need to be fined on revenue.

Otherwise non-profit making companies could do any privacy BS and not be fined.

Good point.

They need to be fined based on gross annual worldwide revenue or market cap, whichever is greater.

Fines will go up if they don’t fix it.

isn't that the case for gmail? if you send me an email with a picture in it, then delete your email account, i can still see your email when logging into my gmail

It's the case for slack, insta, Facebook, Twitter, Tumblr, bereal, TikTok and snap. I am not talking about pms but public posts.

No. Email is private messaging.

If you send email to me and then delete it in your end, I'm allowed to store your email as a whole (sometimes legally obliged).

And if I send an email to 200 recipients they can all store it, I don’t see the fundamental difference for discord TBH

You can save a screenshot discord chat too. There’s nothing wrong with that. If someone published something and you want to save a copy for personal purposes, go ahead.

The difference is in what Discord’s responsibility is.

If Discord claimed to have deleted an account, then they shouldn’t still be publishing a post from a user. Especially if such a post could still be tied back to the historical user id.

I can understand why they’d want to keep the data (sometimes you need to keep an archive of posts for legal reasons - for a limited time). But making an archived post visible to the public is the problem.

An even better analogy would be a mailing list, instead of directly emailing/cc-ing recipients. Definitively not "private messaging".

If I delete my email account, and/or remove it from the list, there's no expectation that my prior emails are deleted for any of the other list subscribers.

The mailing list archive isn't pruned of my account and everything I ever sent will still be visible.

You’d have the right to request removal of your messages from the central mailing list archive (I believe), but not the copies received by the individual mailing list subscribers.

With Discord, all messages are in the “central archive”, there are no individual copies.

>email to 200 recipients they can all store it

On discord there are no 200 individual "they" storing it. It's stored by discord. (Or I guess people could be manually logging their own chats, but that's not the issue at hand here.)

At first pass it might sound like some minor technical squabble about implementation details, but there is intentionality in design decisions. The legal system can not be blind to those.

Discord chose a design that put them in control of the data. I'm not saying the highly centralized nature of their design is bad, wrong, or wasn't the best choice for the product they want to build. What I am saying is that when the legal system looks at the nature of a product, it has to look beyond what's presented in the pretty UI and marketing materials. It will look at the business' processes too.

But that’s the same for gmail. If I send a mail to 200 gmail contacts, that mail doesn’t disappear when I delete my account

But it does disappear when all 201 of you delete your accounts.

True. This is why I mentioned intentionality in design.

The design of email means there is an argument for the legal system that gmail is a very very popular post office. That email is a system wherein users have disparate storage areas for receiving/archiving emails, and gmail is one of many organizations that offers users the service of managing their individualized storage area on their behalf.

In the service that is email, there is nothing inherently special about gmail. In the service that is discord, discord is discord.

I would argue that discord and IRC, are email too. It's just the protocol of communication dictates. They all carry data to a username@somewhere; whether it a tld, username or id.

IRC enables Text & Attachments in text form (ie links)

Email Enables Attachments in visual (html emails)

Discord Enables Voice, Text and Attachments (Asynchronous sockets)

That's all it is. Present a Video, Picture, Voice to your visitor and you've got a new product. Just as facebook,twitter,myspace have been.

> I would argue that discord and IRC, are email too. It's just the protocol of communication dictates.

Assuming all this is correct, if a GMail user requests their account to be deleted, Google should delete that data.

One difference is that you sent the email to those 200 recipients specifically, whereas in Discord you published your message to a channel whose future membership is an undetermined set of people (everyone who joins).

Taking a mailing list as an analogy: If there is a central archive of the mailing list, you can request removal of your messages from that archive, but not from the individual recipients who originally received the message.

There are two fundamental differences.

1. With email you send messages to a specific, finite list of recipients.

2. With email change of recipient list will not send them past messages whereas once you have access to discord channel you get access to history too.

All emails and attachments are apart of your allowed cloud storage capacity, and you have to be explicit in whom you're sending emails to.

Discord is none of that. They never tell you that your messages and media are forever. If you get banned from a server or leave, all of your stuff is still there. There is no reason for this other than eventually selling that data or other evil purposes.

But it’s a chat application, those messages aren’t owned by just the user that authored them. Even if a user deletes their account I should be able to go back in my chat history and find their messages and know it was them.

It would be stupid if someone closing their cellular account would somehow reach into my phone and delete their contact, their messages, and replace their phone number with all zeros and this is semantically the same, the implementation shouldn’t matter.

If you send a message to a group chat those messages are now owned collectively by the group and individually by each member, the gpdr is forcing companies to delete my data because someone else asked to delete theirs.

I agree with you in principle and I think that the EU is basically extorting American companies, but in your example all that information is stored in your phone, while in this case the information is stored in Discord's servers.

Right which to me is a distinction without a difference. If you and me are both Gmail users and you send me an email then delete your account should Gmail have to reach into my inbox and delete your emails? They’re on Google’s servers after all.

There is definitely a difference between PII data of different users being distributed rather randomly across personal devices vs. it being consolidated within a single company which can then proceed to use that data for all sorts of purposes you may or may not have agreed to.

It's about technical capability.

In this case, Discord is a very centralised service. They store all of the messages centrally, so can easily comply with the request.

Other services like email may not be able to do that, so they could use that as a defence when asked why they aren't deleting all data.

There's a spectrum of things I can share with you over gmail. Currently, if I share an email with some formatted text and attachments up to 25MB, then it's yours to keep, but anything above 25MB is shared as a link to a Google Drive upload, which remains under my account, and I can always delete or modify.

But I don't see any particular reason for where exactly the line between the two should be - why wouldn't it be that I could make anything I shared with you ephemeral, a-la Snapchat? And going back to email, it was actually MS Exchange who have supported the option to "Recall this message" [0] for many years, while gmail decided to not implement anything like that.

[0] https://support.microsoft.com/en-us/office/recall-or-replace...

Interesting; for me line seems fairly thick at "ownership" level (which just shows we may have different assumptions:)

My thoughts:

If it's in my inbox (whether on my physical phone, or hosted for me by a service provider), I own it and I get to control it regardless who sent it / how it got there (as long as other legal pre-requisites are met, i.e. not child porn etc)

If it's in my outbox, and I want to delete my account, THOSE instances of those artifacts should be removed, whether from my physical phone or by the service provider hosting them for me. If I've sent them to others, fair game, they own THOSE instances; but I expect the service provider to remove, upon my request, the artifact instances I solely own.

Does GDPR distinguish these cases? Personal information is fine to keep on an individual's computer, but not on a company computer? What about personal cloud storage like Google Drive (company's servers, individual's data)?

American companies are free to not do business within the EU. If they do, they must comply with the law. Same with USA, China, Russia, etc.

Yes but if the law was “Fuck You America Act: 5% of global revenue from US based companies goes to us because we can” then the US government might have opinions about that when it comes to trade negotiations.

The question is whether this law is closer to fuck you than it is reasonable regulation of bad behavior.

What about users from the EU who want to use those services despite the EU not liking them? Fuck them, right?

if they want it to work as you posit, they should not save all the date in Discords systems, but create a distributed chat system.

What’s the difference between Discord and two Gmail users communicating? The data is all on Google’s servers.

If we work on a Google Doc together should deleting your account delete my document as well? They’re both on Google’s servers and on the backend we don’t have separate copies.

I would say there's a real semantic difference between whether those files are stored and managed on your device, or on the provider's servers. If they're only on your device, have fun with them, but they are not allowed to store or touch data that I (as the sender) have instructed them to delete.

Discord is a massive data store. They hoard messages. The only reason for this is to someday sell it. It doesn't matter what the CEO says, it's the investors that own it. They either have to become profitable, or sell.

Not only should they get fined. They should also fix the problem.

Yep, that's typically how this works - there's a small immediate fine for the current issues, but there'll be rapidly increasing fines in future if the issues continue beyond a reasonable timeframe to get this fixed.

They did. The CNIL did several control and verified that they indeed fixed the issues.

How does this work for IRC networks?

IRC networks don’t generally store messages and your client only receives messages that are sent while connected to the network. Users can set up their own infrastructure to store messages received by their client, though, so you never know who might be collecting logs.

So I think you could get sued for hosting logs, or you must provide a way to delete data per request.

IRC network is simply a relay. It doesn't have anything to delete begin with.

I'm sure most sizable IRC networks have some level of logging if only to validate claims of spam or rule-breaking.

Even with that. It's anonymous if you don't login. All you do is pick a name you like, type something random and exit. And all they have is an ip address that may change at anytime.

I am not sure if GDPR should apply if that can't be used to trace back to you at first place.

And if this should apply. I think everyone on the earth that connect to internet are probably in danger. You visit my site and leave a message. And I am suddenly a target of GDPR, what?

Also, do GDPR actually care about internally logs? I think the requirement is the data on that platform can no longer be used to trace back to the user. But logs aren't even exposed to users.

yes GDPR care about internal data like logs, because companies get breached all the time and data get leaked.

Since GDPR, PII (Personal Identifiable Information) data has become radioactive, the less you touch it easier your life is.

True, though the "owners" (what's the term I'm looking for here?) of some channels do public logging

e.g. https://irclogs.ubuntu.com/

You’d have the right to request removal of your messages from those logs.

I think i read somewhere that they do delete files and images after some time.

Reply on news.ycombinator.com