Re:GitHub sued for aiding hacking in Capital One breach
by danShumway on Sunday August 04, 2019 @02:49PM
(#20608471)
> What about the cost for people whose data leaked? Are you saying we should treat them as collateral damage for others to have an "accessible" service?
Yes. That's what being in a society means, you have to put some thought into the collective good of allowing a service to exist. Living in a society means that sometimes you accept a greater personal risk in order to allow a large number of people to access services that better their lives. It's how cars work, for example.
You're drawing a distinction between private and public that seems completely arbitrary to me. If we really ought to be doing everything in our power to limit PII leaks, I don't see why operating a private service is any excuse.
Why do I care whether a message was meant to be public or private if it leaks my PII? I could see an argument for something like end-to-end encryption being exempt, because in that case the service provider literally can't scan the messages. But where my texts, or a private software repository, or self-hosted software are concerned, there's nothing technical or legal that prevents companies and software providers from running the exact same tests as they would on publicly facing content.
If we're going to hold public hosts accountable, why are we letting private hosts off the hook? And if it seems obvious that private hosts shouldn't be subject to those restrictions, then what's fundamentally different about a public host that means they should? You can't think about PII as a black-and-white issue, these are a set of tradeoffs that have to be run through a cost-benefit analysis.
> Github is an opinionated centralized collections of software repositories.
A side-effect of making moderation into an indicator of responsibility is that platforms will stop moderating. Platforms like Facebook and Twitter are bad at moderation, but we don't want them to turn off all of their moderation and become 8Chan. The "they already moderate some things" argument can have some really negative side-effects, because it punishes companies and increases their liability just for trying to be better.
Quick side-note, Pastebin does do some text processing for spam detection, particularly around links. But let's assume a service which did no moderation at all. It sounds good to say this service should be treated differently than Github. But what you end up with in that scenario is that everybody stops doing moderation.
If your goal is to make it harder for people to publicly post PII, then this is counterproductive. You should be trying to make it easier and less risky for companies like Github to moderate content.
> Unsolved issue so far, I don't have proposition about it.
Well... don't you think you should solve that before you make a policy? If I propose a car with square wheels, I can't just say, "don't worry, I'll figure out how to make them roll after I build it."
Yes. That's what being in a society means, you have to put some thought into the collective good of allowing a service to exist. Living in a society means that sometimes you accept a greater personal risk in order to allow a large number of people to access services that better their lives. It's how cars work, for example.
You're drawing a distinction between private and public that seems completely arbitrary to me. If we really ought to be doing everything in our power to limit PII leaks, I don't see why operating a private service is any excuse.
Why do I care whether a message was meant to be public or private if it leaks my PII? I could see an argument for something like end-to-end encryption being exempt, because in that case the service provider literally can't scan the messages. But where my texts, or a private software repository, or self-hosted software are concerned, there's nothing technical or legal that prevents companies and software providers from running the exact same tests as they would on publicly facing content.
If we're going to hold public hosts accountable, why are we letting private hosts off the hook? And if it seems obvious that private hosts shouldn't be subject to those restrictions, then what's fundamentally different about a public host that means they should? You can't think about PII as a black-and-white issue, these are a set of tradeoffs that have to be run through a cost-benefit analysis.
> Github is an opinionated centralized collections of software repositories.
A side-effect of making moderation into an indicator of responsibility is that platforms will stop moderating. Platforms like Facebook and Twitter are bad at moderation, but we don't want them to turn off all of their moderation and become 8Chan. The "they already moderate some things" argument can have some really negative side-effects, because it punishes companies and increases their liability just for trying to be better.
Quick side-note, Pastebin does do some text processing for spam detection, particularly around links. But let's assume a service which did no moderation at all. It sounds good to say this service should be treated differently than Github. But what you end up with in that scenario is that everybody stops doing moderation.
If your goal is to make it harder for people to publicly post PII, then this is counterproductive. You should be trying to make it easier and less risky for companies like Github to moderate content.
> Unsolved issue so far, I don't have proposition about it.
Well... don't you think you should solve that before you make a policy? If I propose a car with square wheels, I can't just say, "don't worry, I'll figure out how to make them roll after I build it."