Hacker News Reader

Comment by nolok | Hacker News Reader

And they're not fined for storing in plaintext, nor for storing in plaintext by mistake, they're fined because the law give a time limit for you to notify the regulator after you notice it and they waited too long.

And in this specific case just to be clear it's not about taking too long to notify the public / customer, but about taking too long to notify regulator (the delay is much shorter). And they're not supposed to have perfect facts when they notify it, there is no sanction for notifying and saying "but we're not sure yet" if you're being honest, or coming back later with correction, there is a sanction for not telling them in time.

We often see "companies should be responsible / should have to inform me" and that's part of that regulation, and it only works if there are clear defined delay and sanction when they're not respected.

View on HN

How long has that even been a regulation and in which countries does it apply? Software engineers are trained to view these kinds of things as bugs. Legal isn't trained to monitor bug trackers.

it's GDPR from the subheader

> The Irish Data Protection Commission found that the company violated several GDPR rules.

this is why lots of websites block the EU from accessing. You basically need to consult with lawyers to make sure you're not accidentally breaking the law when writing a codebase.

“lots” not really as most companies want accesss to european market.

Also no you dont need to consult lawyers when writing code. You just dont track and save data and do questionable stuff with it. Saving passwords in logs is surely security issue first before its GDPR issue.

yes it's a security issue but you wouldn't "expect" to get fined millions of dollars.

Do I think we should punish companies for storing passwords in plaintext? Yes. Would I expect that a bug and devs untrained in GDPR best practices could lead to fines? No.

Usually in software engineering you don't get your company fined for making terrible mistakes unless you're in a field like finance. This was just passwords which most sites have, not something like PCI DSS stuff

> yes it's a security issue but you wouldn't "expect" to get fined millions of dollars.

Which is exactly why companies don't care, which is why this regulation was made and those fines decided.

> Usually in software engineering you don't get your company fined for making terrible mistakes unless you're in a field like finance.

You're not fined for a mistake, you're fined for a mistake AND that mistake huer the customer more than you AND you don't disclose it swiflty to him.

>yes it's a security issue but you wouldn't "expect" to get fined millions of dollars.

The penalties are based on percentage of turnover.

> “lots” not really as most companies want accesss to european market.

Plenty of foreign newspapers block the EU from accessing their sites. The EU is not that a big market.

This is also factually incorrect https://tradingeconomics.com/country-list/gdp?continent=euro...

How so? Your source shows that Asia + North America make up like 67% of global GPD.

The $18349 Billion GDP. What did you think I was referring to? Were you trying to be daft?

I said the EU is not that big of a market. It’s less than 1/3 of the global GDP. We seem to have different definitions of a big market.

Clearly but whatever definition you have that doesn’t include $18349 Billion is ridiculous

I probably encounter this like 5 times a year, your statement is wrong.

I see this comment pop up here often in these threads about EU fines and regulations. "Apple/company should just call the EUs bluff and stop selling in the EU!".

Apple's a good example because they're such an incredibly global brand, who should be less reliant on EU customers. Yet Europe is responsible for >20% of their revenue. Shareholders would eat you alive for just "nope"ing away from that.

Yes, US GDP/capita is far above the EU average, but the EU still represents 450 million, on average fairly wealthy people. So companies simply play ball. And that excludes the UK, whose data protection laws are similarly strict.

20% of revenue isn't that much. Would you rather focus on your core product and double your revenue, or focus on getting that 20%? Yes giant companies have the resources and experience less YoY growth so they will work with the EU market, but most companies would do better to ignore the EU.

Explain to me how not selling in the EU could double a company's revenue? How removing yourself from your third largest market would enlarge the others? How millions of people in the US don't buy an iPhone because you can buy iPhones in Germany?

> 20% of revenue isn't that much

It is in reality gigantic, especially at that scale. And in this specific example, Apple net profit is 24% of their revenue.

> Would you rather focus on your core product and double your revenue

Saying you no longer sell to people with blue eyes or wearing short is not in any way increasing your sales to other people.

I'm sorry to you your messages sound like you're not very knowledge about the subject matter.

Noping out of europe would create a vacuum that would be filled by a competitor who would fully comply with the consumer protecting EU rules. Rules that many consumers in other nations would love to have themselves but don't because of regulatory capture and regular corruption. Those consumer friendly products would become popular outside of Europe. Big-US-monopoly-company would lose dominance. They would either have to change to be more consumer friendly or eat the loss of market share.

The company with a board of directors responsible to shareholders noping out of anywhere isn't a choice.

see Apple's 14 billion tax troubles in Ireland. For years these companies have been using the European operations as part of the tax avoidance schemes.

Don't mess with the Flemish has been good advice for 600 of the last thousand years.

It’s part of GDPR. I’ve been given training on it at all (3) companies I’ve worked for and training has always included what constitutes a breach and what to do.

I would hope any company would treat it as an incident rather than just a bug where senior enough folks would be involved to know what their responsibilities are.

Can't blame a rogue junior engineer if that happens.

> Software engineers are trained to view these kinds of things as bugs

Competent engineers —software or other— must have an education in safety standards and legal regulations. I had a pretty formal education in data protection at both A-Level and undergrad. I know real engineers get tetchy about us programmers edging in, so if you want any claim to an engineering title, ignoring the ramifications of your code in the real world is unacceptable.

But that doesn't seem to be the problem here. Somebody did know it was bad, did fix it urgently, did report it internally and did an impact assessment. The problem was they needed to notify the regulator earlier so they knew it could have been a problem.

If these passwords were in the wild, delaying notification by however many days means attackers have more time to use stolen credentials. $100m sounds like a lot but a lot of these regulatory rules scale with the company so that punishments like this have impact. They need to improve how they handle security notification.

I think the big difference is that engineers have had to care about people dying for the past 100 years. Today there are software developers that throw code out into the world that kills people without any repercussions. At some point this needs to change.

An education in legal regulations teaches you the best solution is to make the fix and don't say anything.

To be clear, they are absolutely being fined for storing passwords in plaintext.

They chose not to mitigate the fine by following proper procedure.

Reply on news.ycombinator.com