> Given the prevalence of comments like this, I wonder why any company would ever bother offering an apology or retraction.
To project my own opinion onto others: these comments are warranted because an apology has no actual value. The fact remains that Triplebytes can still do this if they wish to, and they are constrained only by what they can manage to slip past their users.
There's a stark asymmetry in the digital space, where service providers are protected by the legal language in their TOS or EULA, but the users have to trust that the service provider will not act outside their interests, and with no recourse. By contrast, in a normal contract negotiation, there will be an opportunity for both sides to ammend the contract to better serve their interests.
If Triplebytes wanted to show that they will not attempt to do this again, they could break this asymmetry and constrain themselves in their user contract, accepting all resulting liability or specifying concrete penalties if they do persue this route in the future. An apology is just a meaningless PR exercise.
Why is this a hard thing to do? It’s literally what everyone who ever messes something up is asking you to do.
Just because someone once committed a broken build, doesn’t mean I’ll never again trust them with access.
It’s argubly more like “sorry for being a moron, but I hear you. Please give us another chance”?
Because you're treating a service-client relationship as an interpersonal relationship. They are not, and the same norms do not apply. That apology, and its implicit premise(s) and promise, is rooted in the norms of intimate, interpersonal relationships. Those do not apply.
When you screw up and ask your spouse's forgiveness, the psychosocial interaction is quite different from when a CEO fucks up, writes a mea culpa to the faceless masses, gets his draft looked over by a PR flack and a couple board members, and then sends it out to the highest-impact social media circles for his service and waits to see what his KPIs do.
I don't think this analogy is useful. An error in execution can be quite different in an error in judgement.
To offer an alternative example: a contractor decides to publish the source code to a company's closed-source software, so that they can use it as evidence of their work for their next job application.
> It’s argubly more like “sorry for being a moron, but I hear you. Please give us another chance”?
When these kinds of bad judgement happen, the person normally loses some decision-making power to stop it from happening again. This is in noticeable contrast to Triplebyte here: an apology as a PR exercise, and no material change to prevent it in future.
However much you'd like to, you can't just flip that trust back on - and in a lot of cases, it'll never fully go back to the way it was.
Not that we should personify company-customer relations - this was a decision that would have been taken by a lot of people expending serious effort to get it out the door. It's not a single lapse in judgement, but a continued expression of different values.
Not to mention this terrible default practice landed them some great pr to start with and the apology gives them more (this time "good pr")
Correct. I don't want apologies or retractions from companies. I want postmortems.
This is really no different from a technical outage, e.g., "As a result of a bad deploy to prod on Friday, all Triplebyte profiles became public." Why was it not noticed in testing? What is the testing process? Is profile privacy part of the testing process or part of code reviews? What are the practices around making changes that affect user privacy - is there a culture of asking questions about it up front, etc.?
Most importantly, what changes are being made to prevent a similar outage from reoccurring in the future? I really couldn't care less about how bad the CEO feels about it - sure, the CEO probably should feel bad, but feeling bad is not a reliable mechanism. If the CEO said "Bwahaha, I wish to profit and I learned over the weekend that my profits were in danger, so I changed course" but then says that in order to maintain his profits in the future he added an external privacy council that reviewed all major new initiatives (or whatever), that would actually be a lot more useful than contrition.
Now, yes, it's true that basically no company does public postmortems of decisions that they needed to walk back (at best you get blameful postmortems that end with a key executive resigning, but most of the time that doesn't help anyway - either the executive wasn't the problem, or they were the problem and they already spread the bad culture to others). But I think it was pretty rare until a couple of years ago for tech companies to do detailed public postmortems of internal outages, and that expectation has slowly changed. I think we should push for the same change for non-technical incidents like this.
I'm sure the CEO has been taught that good leadership means fessing up when you've screwed up, and to an extent that's true. But it's also an act of ego to assume full responsibility. Ego got them into this mess, most likely, and it will not get them out of it.
The CEO needs to realize there was a systemic failure. It's not just about him having an epiphany – it's about surrounding himself with people, processes, and values that can help keep a runaway product idea from breaking their customer base ever again.
And I absolutely agree that the feelings of the CEO matter less than putting in place some proper procedures.
Profit ain't bad.
Now, I suppose it may be possible that the CEO in this situation dramatically misunderstood the situation. It may even be possible that he had good faith even as he militantly defended those misunderstandings in previous threads. But from the perspective of trust, I can’t get past the suspicion that he’s just sorry that he got caught.
I read the apology letter as essentially saying he single-handedly drove the idea, in part because he was flailing due to COVID killing their bottom line, and was tunnel-visioned enough to not recognize it was unethical. Even at face value, that’s absolutely troubling for a CEO in TB’s domain. But smarter people have done dumber things under pressure, and sometimes dumb is at someone’s (or a lot of someones) expense by mistake.
So I’d like to think this was an exceptional occurrence, and I appreciated his personal post-mortem of sorts. However, taking this as charitably as possible, a process-oriented RCA focused on how he’ll keep his runaway ideas from being a one-man show—or whatever the problem actually was that saw this conflagration actually see light of day—wouldn’t suck.
Potential business processes include "ask about ethics as part of culture fit, and have a good sense of what you mean by 'ethics'," "ask about ethics as part of promo / do not count projects that put user data at risk towards promo," "vet investors for their ethics and see how their other investments are doing before allowing them to take a board seat," etc.
An ethical CEO will probably be doing many of these anyway, which is fine. You don't need to formalize them. It's fine for the CEO to say, for instance, "Ordinarily I would have put the brakes on this via this particular means, but I failed to notice because of this unexpected circumstance. I'm sorry and this is how I'm going to make sure I notice and make the right decision next time." (That is't too far off from what was actually said, actually, except for the bit about how to make decision-making more robust in the future. Everyone, ethical or not, fails to live up to their expectations of themselves at least occasionally.)
I absolutely agree. But this only works if the top leadership are themselves ethical people. If they are unethical or even neutral, it’s going to backfire. Instead of hiring people for their backbone in terms of pushing back against unethical decisions, it turns into hiring people for their willingness to conform to what they are told.
> It's fine for the CEO to say, for instance, "Ordinarily I would have put the brakes on this via this particular means, but I failed to notice because of this unexpected circumstance. I'm sorry and this is how I'm going to make sure I notice and make the right decision next time."
Definitely. But you only get to use that excuse so many times before it starts to lose credibility.
> That is't too far off from what was actually said, actually
Here I disagree. To his credit, Ammon has taken full personal responsibility for pushing this through, even over internal objections. It’s not a failure to notice something that happened when you’re the one doing the thing.
The resolution is also more personal than procedural: be more conscientious about your users and listen to people who object to your ideas. Demonstrate that you can do that over time and you can regain trust.
As it is right now, I’m giving some charitable credence to the idea he’s the CEO equivalent of the skydiving photographer that, in his passion to get a great shot, jumped out of his plane with no parachute. It certainly may end up having an analogous effect on Triplebyte’s credibility.
Exactly this. The only thing that _might_ actually make me trust Triplebyte with my data again is if their current CEO actually stepped down to a less influential role. If I were part of the board I'd actually be advocating for him to step down or be forceably removed if possible.
He didn't put a stop this catastrophic breach of trust after being made aware of it. Even worse, he seemed to have actively drove this forward in spite of opposition. I'm simply not willing to trust a company where he's the top-level decision maker with data as sensitive as they're dealing with, apologies or not.
To me it doesn't seem credible that you as the CEO of a recruiting company didn't realize the issue of "default public" profiles. You literally have a section about confidentiality on the front page of your website so you must have known it was important to users.
Because the people running the company have a conscience which causes them to feel bad and want to apologize when they harm people? Are we really entertaining the idea that the only reason someone might apologize is if it benefits them?
It's disturbing to me how absolutely normal your comment is on Hacker News. There's a significant portion of HN whose entire concept of ethics seems to be, "if it's profitable, it's right" and who can't imagine any motivation except profit. Over and over again we see profitable corporations doing terrible things and people on HN defending them on no other grounds but the fact that what they are doing is profitable. And when people disagree, it's almost always because the profitable corporation's actions affect them directly. All I can conclude is that a significant number of HN users are just amoral, which is terrifying, because a lot of HN users hold positions with significant power.
And before you tell me that everyone acts selfishly--no, they don't. I've met hundreds of wonderful people in my life who were generous, honest, kind, and/or brave, at great personal cost and risk to themselves. The behavior you're engaging in isn't normal, and it's not okay.
>... And before you tell me that everyone acts selfishly--no, they don't. I've met hundreds of wonderful people in my life who were generous, honest, kind, and/or brave, at great personal cost and risk to themselves. The behavior you're engaging in isn't normal, and it's not okay.
I can see that you’re trying to be charitable, so let me try and be charitable in return.
I actually kind of agree with the comment you’re responding to, but I don’t interpret it the same way you do. A normal, moral person like you or me will apologize out of genuine guilt. But then again, a normal, moral person like you or me doesn’t operate a business in a way that betrays the trust of its users.
I don’t think everyone acts selfishly. But I do think that some people do. And even a selfish person would want to try and convincingly feign remorse for their selfish actions once those actions backfired and were no longer in their own self-interest.
I think akerl_ is saying that companies shouldn't bother apologizing when they do something wrong and get caught.
I think that's some "lizard person school of business" shit that has no place in a civilized society.
And sure, maybe the answer is that they’re not sociopathic in the first place. But that’s a very non-cynical answer. Credulous, perhaps.
Either just release the feature anyway, and maybe default it to opt-in for people with existing content, maybe make it “only content from $now forward is public”, something to that effect.
Halt the feature, but expend the minimum possible effort on the message out: “Hi all, we’ve reconsidered the feature in light of feedback. Thanks, CEO”.
It’s not clear to me that applying more time/effort to explaining themselves to the world has done them any benefit. There’s the bulk of people who didn’t notice / don’t care, there’s people who are permanently angry, and there’s people who are going to want to see actual changes before they revisit.
The people who work for a business are incentivized to live lives that let them sleep well at night, but it’s entirely possible for them to learn from this experience and behave differently in the future without bothering to respond to the mob.
You have accused me of misinterpreting your intent elsewhere, but really I don't know how you expect me to interpret this that would cast you in a more positive light. You're saying you would do unethical things, so I don't think I'm off-base to say you might be unethical.
As a customer, am I going to believe TripleByte is sincere when they apologize to me? Maybe, but probably not. The only way to be sure is to judge them by their actions.
And in this case in particular, there’s not technically anything to apologize for since they never actually rolled out the feature.
Any liar can make beautiful apologies without meaning a word of them. It takes an honest person to demonstrate conscience through their actions.
My point above is that I don’t think internet mobs incentivize businesses to behave that way, and in fact it seems that apologizing to the mob, or adjusting behavior in response to things the mob does not approve off, are counterproductive for the business. They continue to take heat for the wording of their apology, they get another wave of media coverage about the thing the mob is pissed about, there’s not really any visible upside.
Given that, I’m surprised more business don’t just ignore the angry people on the internet and just proceed as-is, continuing to rake in money from the people who aren’t outraged.
But maybe I’m just a lizard, unfit for your civilized society.
Okay, great, so we're in agreement.
The incentives applied by dissatisfied customers aren't about getting companies to apologize: it's about getting them to behave in a manner such that they don't have to apologize. If you want to discuss whether there are better strategies that dissatisfied customers might employ, that's something I'd be happy to discuss.
If you actually want businesses to apologize and adjust their behavior as you claim, then it makes sense to look at how customers can make that happen.
Point being: if your goal is to actually help people harmed by corporations, calling those people "internet mobs" who "ragequit" and then analyzing whether it's profitable to apologize to them is a pretty strange way of communicating that goal.
I’m not looking to debate whether or not you agree with my word choice for “the people on the internet who loudly protest companies who do stuff they disagree with, and stop using those companies’ services out of these disagreements”.
Neither do I, and I'd be interested to hear how you think people could do better.
It would be one thing if he apologized immediately after people pointed out the flaws in their plan.
But he didn’t.
He ignored all the objections, and defended his decision over and over again.
He clearly didn’t care.
There is huge difference between “whoops, we didn’t think things through, sorry about that” and “after seeing tons of people cancel their account, let’s pretend that I’m now truly sorry.” Especially when he had a history of building shitty social networks.
Two thousand: https://news.ycombinator.com/item?id=23304097
It shouldn’t be for gain. In fact if apologies always led to a positive outcome they would mean less and the world would be a worse place for it.
Obviously is a bit harder if you hit-and-run someone’s pet dog.
FTFY...
It's hard to gauge significance without knowing a number of total users, but I imagine it is a relatively strong hypothesis that there is significant correlation between regular browsing of HN and having an account on his service.
I think you're running into the pagination problem: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...
If you scroll to the bottom and click More you should find it. Edit: yes, it's there: https://news.ycombinator.com/item?id=23304097.
I wonder why anyone would ever place a non-zero value on an apology from an organization acting in its own interests. A company isn't a single person acting in isolation and ignorance. It's a profit-seeking entity organizing a whole number of people of various levels of conscientiousness and intelligence, and pointing them at a single profit-seeking goal.
When that many-limbed organism grabs at a profitable course of action, it's not an impulsive accident of blind flailing. If that turns out to be a problem and they have to reverse course, it's not because of remorse.
They did what was in their interest then; they did what's in their interest now. People confusing corporations for actual, you know, people absolutely baffles me. Their apologies mean absolutely nothing, good or bad, but how bad a hit their business appeared to take and how good their copy writer was. That is all.
As another poster said, and I agree wholeheartedly, I don't care for apologies, I care for post-mortems. The only thing that matters is what operations led to this action, and what change in those operations will prevent it happening again - if any such change can prevent it. A public mea culpa with an executive's signature on it means... well, nothing. Absolutely nothing. It's the cheapest possible way of reclaiming good will, and worth the paper it's written on.
And yet, tons of companies had done that, and suffered very little. Heck, any company has done something that "a chunk of people on the internet don’t agree with"...
It's not about never doing anything wrong, or it being futile to apologize.
It's about, you don't do THIS kind of privacy affecting changes without publicly announcing it first, and without red flags raised internally that it might not be a good idea.
That's a good thing to instill in companies, whether this one apologized or not...
2000 account closures is an actual business repercussion.
> and the internet mob’s displeasure, once roused, cannot be quieted by apologies, changes in behavior, or explanations
It absolutely could. As a member of said "internet mob" (I deleted my account) I'll say that yes, an apology by itself is not enough, but an apology combined with a long-term change in behavior would absolutely cause me to stop criticizing them and maybe even create an account again. If, for example, they remove a bunch of dark patterns from their site and change their terms of use to give specific guarantees of data privacy, that would go a long way in my mind.
Additionally, even if the 2000 accounts were enough to cause business impact, the idea that they’d need to demonstrate long-term change to win back those users is effectively irrelevant. They may as well put their efforts into gaining new users to replace the 2000, rather than try to repair the burned bridges. The return-on-investment for making “long-term change” to win back people who ragequit their service is low, especially since those people self-select for “people likely to ragequit again if they disagree with future company decisions”.
But ultimately, you might be right--maybe the net effect of not apologizing would be negligibly different from the net effect of apologizing. I don't have numbers to say you're wrong, but you don't have numbers to say you're right.
But as I said elsewhere, why are we even talking about this? You seemingly have complete, disdain for users who are concerned about TripleByte using their data against them, calling them an "internet mob" and accusing them of "ragequitting". Are you capable of empathizing with users at all? Do you have a conscience? Why are we talking about this as a strategic problem when it's an ethical problem?
But to be clear: Triplebyte’s specific situation is a an ethical issue only in respect to the fact that they planned to enable by default for existing users. That’s a bad move. They’ve stopped the bad move.
I’m more interested in the overall pattern of “company does thing, people disagree with thing, people express outrage to company, company issues statement”. Which in many cases has zero ethical components.
Your reaction that perhaps corporations shouldn't apologize when they do something wrong if it have any selfish benefit, does lack conscience and is a wholly inappropriate reaction to this situation. Discussing the self-centered strategic merits of apologizing from the perspective of a sociopath isn't a productive conversation.
However, I'm not one to write people off based on one interaction. Just because you've reacted without conscience in one situation doesn't mean you would do so in all situations.
> But to be clear: Triplebyte’s specific situation is a an ethical issue only in respect to the fact that they planned to enable by default for existing users. That’s a bad move. They’ve stopped the bad move.
There are more ethical issues than that--they haven't stopped them all.
> I’m more interested in the overall pattern of “company does thing, people disagree with thing, people express outrage to company, company issues statement”. Which in many cases has zero ethical components.
Which is irrelevant in this case, because this case does have multiple ethical components.
And, more to the point, this is still an ethical question. Apologies are never about benefiting the person apologizing. Apologies are inherently an ethical action--if you claim that the company didn't do anything wrong, then they shouldn't apologize. Not because it doesn't benefit them, but because lying about being sorry isn't ethical.
"Should a company lie and pretend to be sorry when they haven't done anything wrong?" is still an ethical question, and you're looking at it from the perspective of selfish gain is still an inappropriate way to look at it.
I suspect, in light of that, that we’ve bottomed out the utility of this thread.
We should reward apologies and punish those who don't. Our failure to do so is creating a market incentive that will destroy or weaken valuable norms.
We should expect rather than reward apologies, and we should punish both people who fail to apologise as well as people who apologies but fail to follow through on changing their behaviour.
Ammon so far has done no more that the minimum expected from someone in his position. Time will tell whether his actions reveal his apology to be genuine and behaviour changing, or empty lies.
Rewarding apologies that turn out to be empty lies is what gave us Facebook. I fear Ammon's ambitions are to be more like Zuckerbergs rather than less, so I'll be very judgemental and dubious as I watch future moves by Ammon and Triplebyte. Like he acknowledges, he's lost trust. You earn trust back by your future actions, not by the eloquence of your apology.
The one action they took is that they cancelled the feature. _That_ has value. Arguably not enough, but it's a good first step. I'm eager to hear what they follow it up with, but they _have to follow it up._
Uttering (or publishing) words is an action.
Companies are becoming more sterile and calculated, and perhaps statistically issuing an apology has no impact on user retention, but I for one am glad there is still some humanity to be found even if it's a hollow gesture.
Publicly taking responsibility and acknowledging mistakes can be a powerful tool in changing. Because of this apology, I will at least monitor Triplebyte's progress to see if significant structural changes are made to keep a decision like this from being made, instead of not even giving them a chance to gain back my trust. Their actions will tell whether this apology is genuine or not.
With this understanding of the word, using the phrase "the internet mob" seems quite negatively loaded. Consider the context of companies harming their users in ways that may not be obvious to everyday people: I, for one, want people organizing to get the word out.
Just because it doesn't work for everybody doesn't make it not worth doing.
FWIW the apology doesn't do jack shit for me.
Users can still see that... and be worried about how they came to the inital decision.
None of that should influence if you do or don't apologize.
This isn't kinder garden, we're not here to educate those companies, they run a business, you mess up, you're out, we give the competitor a chance. That's how it works.
As a user, I’m also not dropping a company that provides me a useful service at the first (or likely second, or third) mistake.
Not everybody subscribes to this one-screwup-and-you’re-done mindset that you seem to be describing.
> that provides me a useful service
And what if the service stops being useful? What is an apology going to change? No longer useful, you'll move on.
That's where I find these apologies to be a sham. It's trying to play on people's emotions, to keep them around even once they've stopped providing value and utility, or in this case, actually causing you harm.
The only reason your employers have kept you around, is because your "mistakes" were within the expected range of what people in your position will be making as well. If you fall below that threshold, trust me, you will not be kept around for very long.
I’m saying that’s not how I approach my interactions with businesses. As you noted in your reply, employers expect an employee to make mistakes within a reasonable threshold. I have the same expectation for companies that provide me services. Making a mistake does not suddenly evaporate all their “usefulness” to me, as you seem to be suggesting.
When I say "mess up", I imply a quantity of mistake that is beyond acceptable for the value I get.
You seem to quantify "mess up" to a much smaller degree, like "mess up" implies a reasonable set of mistakes.
So we're not discussing the same scenario, due to us quantifying "mess up" to different degrees.
It seems if we normalize our quantity of "messing up", that we actually fundamentally agree. No amount of lack of or of providing an apology really affects the consequence. Mess up within reason, you don't even need to apologise, as long as I'm still getting good value I'll continue to be a customer. Mess up beyond reason, and an apology won't help, as soon as I'm no longer getting good value, or if you're actually providing me negative returns, I will begin to look for an alternative.
As soon as a company does something that a chunk of people on the internet don’t agree with, there’s really no way out. They’re going to get bad press regardless of whether they retract, whether they apologize, and whether they say they’re taking actions to avoid the sequence that led to the action in question.
But alongside that, for every time the internet mob has risen up over a company’s action, very few companies seem to have experienced major long term effects. I bet everybody knows a few people who have quit Facebook/GitHub, or who rage about Oracle business practices or MongoDB stability, but these companies still manage to keep trucking along.
In light of this, I’m mostly surprised that Triplebyte bothered apologizing; it seems unlikely to do them any good, and it’s unclear to me whether continuing course would have actually done as much harm to their bottom line as the prior Hackernews thread appeared to indicate.