https://twitter.com/DanielleVEsq/status/1472105731474137094

So yeah, pretty sure it's that. I almost never get harassed by people who think I'm cis male, the bulk of the harassment came from people who thought I was transmasc.

Probably the furry stuff too, which is honestly sort of terrifying, do these people not know how much infrastructure relies on stressed and overworked furries?

By my estimation it is real, the proprietorship (who I like and appreciate personally, and I think are operating on good faith) of this community has often made noises about how it should be better. It's not, and it should be.

[0] The irony that the whole problem is based on wording that implies a lawsuit is not lost on me.

Righteous indignation over something like this is dangerous, not least because it can lead to science being much harder (more bureaucratic and more expensive) to do by all scientists. “More oversight” or “dissolve the irb” all put too much responsibility on the institution.

Sometimes, we should just blame the people who did something rude and stupid not the institution.

There have been multiple examples of this going horribly, horribly wrong. (Naturally, the worst examples were government-funded and ran during the Cold War.)

As a society, we have since concluded that at bare minimum, people should know they are being experimented on--and even that isn't enough to stop things from going badly.

This is why the IRB exists in the first place. A major part of its purpose is to prevent this sort of thing from causing undue harm, i.e., by forcing people with limited incomes to seek legal counsel because they believe they're about to be sued into the ground. One of the rules generally agreed upon for this is that experiments with human test subjects must inform those humans up-front what they're getting into.

To say that the response to this "can lead to science being much harder" is an ethically wrong defense. We know it makes certain kinds of research harder; that's the point. There are certain kinds of research that directly harm their subjects, and we don't do that to people. More than that, people have a right to decide whether they want to be involved in a study, as they may personally feel endangered by it (i.e., someone who has a PTSD response to being sued may not want to deal with being fake-sued).

To say that calls to dissolve the IRB "put too much responsibility on the institution" is flat-out false. This IS the IRB's responsibility--they approve or reject studies like this specifically to avoid ethical problems like this one. To claim that this isn't the IRB's responsibility is like claiming that it's not the responsibility of the law to revoke a driver's license when someone has been driving drunk, or that it's not the responsibility of the Food and Drug Administration to reject approval for foods that contain dangerous contaminants.

So, to reframe this: "can you think of scenarios where institutional oversight could cause negative harms on society?" There are tradeoffs in ethical domains —and usually a lot of work has been done to find a middle ground.

Further, the study would still have worked if the researchers had simply asked for the information as researchers, instead of lying about their identity and making thinly-veiled threats of legal action if the subject doesn't comply.

I apologize for assuming that you were defending the study; I figured that was the topic of conversation, after all.

If there is nuance, but it does not apply to this situation, then it is worth saying that this nuance does not apply to this situation--so that I'm less likely to misinterpret what you're saying.

Ethical action involves nuance! It is very comforting to think that the world is black and white, good and bad. But it isn’t. Why is this so difficult to communicate?

So what happens when a site receives a CCPA inquiry from an actual person concerned about privacy instead of a researcher under a fake identity? The site still needs to determine if the law applies to them and if so what they must do to satisfy their obligations, so a real inquiry should be as costly and as stressful as a research inquiry.

Does this suggest that privacy laws such as CCPA (and GDPR) which create obligations for sites to deal directly with users on privacy matters are a bad idea? Should such laws instead require users to go through some state agency as an intermediary which would then only contact the site on behalf of the person if the agency determines that the user's data at the site is covered?

They conclude that it's a Princeton research study and throw it in the trash.

This is part of the harm this study has done; because the researchers were not upfront about who they were and what they were doing, they have introduced uncertainty about the CCPA process.

> Should such laws instead require users to go through some state agency as an intermediary which would then only contact the site on behalf of the person if the agency determines that the user's data at the site is covered?

That could be a good idea. It would depend, of course, on that agency being well-staffed and well-trained (both of which are separate from being well-funded, which can help). There's a giant pile of messy problems that can crop up due to negative influences from, say, corporations that want to sell more data.

That said, it would be nice to have an org that can do the minimum legal work necessary to figure out if the claimant has a leg to stand on. That would not only minimize the harm of this sort of ill-advised study, but also make it harder to use threats of legal force to coerce smaller site owners.

You don't get out much, do you?

I've known tons of lawyers that won't look at their watch and tell you the time, unless they get a tenner from it. To be fair, they are used to folks trying to extract highly valuable services from them, for free, so it's sort of a defense mechanism.

I have (and have had) many friends that are lawyers. A few will help me out with quick consults for free. I even have one chap that has gone beyond that, and I'm grateful. I'm quite aware of the value of their services, and always offer (and am willing) to pay; even if they decline to invoice me.

This creates even more incentives to have a paywall--one, it keeps people from bugging you for free legal advice that can bite them and you in the ass later, and two, it ensures that the people who do get advice from you have followed your procedures for setting up an account with you.

The CCPA applies to for-profit businesses that do business in California and meet any of the following:

Have a gross annual revenue of over $25 million; Buy, receive, or sell the personal information of 50,000 or more California residents, households, or devices; or Derive 50% or more of their annual revenue from selling California residents’ personal information.

It's not a very hard decision to make, the text is pretty clear. Especially if literally the fifth word of it - "for profit" - makes the further reading unnecessary.

> any of the following

OK

> Buy, receive, or sell the personal information of 50,000 or more California residents,

"receive" and "50,000" seem like a low bar if the definition of "personal" includes anything caught in typical web logging.

You see? It's not clear cut from reading the thing you just said was very clear and it's hard to be 100% sure it doesn't apply.

"For profit" and "business" and similarly wide nets. Business can include individual sole traders and "profit" could be "accepting donations" or "running AdWords"

I was wondering whether not logging could be an option. That's now quite clear.

The point of my original comment was that there is gray area here and people dismissing it outright as obviously bogus are not thinking very critically about it. I think this is a good example of that.

Further, logging an IP address has also been necessary for security--to detect DoS and DDoS attacks, for instance, as both involve many repeated connections from the same IP (though you can offload that to a service now).

You seem to be confusing temporarily holding information in the database (no matter whether in-memory or on persistent media) for operational purposes (be it networking or threat detection) and permanent storage of the same information way beyond the time it ceased to be useful for the purposes above.

Also, even if you only store the information for 24 hours--how many users are on Hackernews in a given hour? How many of them click through the top links? Certainly enough that some sites have crashed under the load, which makes me think that the number is higher than 50K. Congrats, you're now storing 50K IPs, despite having an automated system to delete them in a day.

(I don't even wanna think about the headache it'd cause if you got dragged to court over this. I don't know how many judges will understand that you delete the list every 24 hours to avoid being liable for storing it, not to get rid of evidence.)

"Before the courts and on the high seas, we are in God's hands" isn't a proverb for no reason, and it's valid pretty much anywhere.

I don't think this is mocking (excluding the few obligatory spammers). It's a known fact that if you have a public e-mail, you will receive a lot of spam and threats. Also, an actual request could've very well taken a similar form - would you have been okay with this if they actually requested their data?

I'm not saying these actions were great. Sending out these mails was definitely not the nice thing to do. And yes, the threat of a lawsuit can be very scary. But, unfortunately, this is something you must be able to handle as a webmaster. It's also not great or nice that people try to log into my ssh server all the time, but this is just something you get when you have an ssh server on the internet. Same thing.

Based on the way the system works, especially the civil side, it's sometimes impossible to even answer this question.

If a Russian were able to file suit in California, wouldn't the defendant have a chance early on to ask a judge to dismiss it?

I'm trying to sound naive because I want some gory details.

a particularly foolish or over-confident defendent might represent themselves, but otherwise, I would not budget less than $2000-3000 to hire a lawyer to draft and file a response to statement of claim and show up in court to attempt to get it dismissed before it gets started.

Foolish, overconfident, or just "never have had $3000 in one place and time in my entire life."

For most people, if you pull them into the spot light, you will quickly shut them up. That does not make their legal threats baseless.

I think the core issue here is not being able to distinguish the two cases easily.

Personally I've told some expensive solicitors to get lost successfully, and for some I've engaged my own & spent tens of thousands. I suppose I tended to be aware of legal risks that I was running in my old business.

But lawyers are trying to get a result for their client as fast as possible. So if they've sent you something full of hand-waving jargon, they're either not very good at communicating (& not the kind of lawyer used to taking things further) or they're trying to intimidate because they've not got anything substantial to say.

Also (in my xp) it's rare that a lawyer won't clarify something they've written unless they're being paid to intimidate, and (in the UK at least) a judge will have short shrift with a plaintiff if pre-trial communications were insubstantial and intimidatory. You can't just be summoned to court with no idea what you did wrong.

Yes, it's a bad thing to do, it's pretty obvious that it'll scare the bejesus out of some people and even worse, have some chilling effect.

On the other hand the pendulum on ethical boards has gone waaaay in the other direction to the point where a lot of very useful research doesn't get done. The most vivid example being that we don't have human challenge trials with Covid, even now when it's crystal clear that actual risks to young healthy people are close to zero. Another example: https://slatestarcodex.com/2017/08/29/my-irb-nightmare/

So, what's my opinion? Well, an "opinion" would require me to chose one of those two perfectly valid points of view. But if I had to, I'd say the travesty that is "ethics boards" has become a bureaucracy so rotten it doesn't even perform its original function of stopping vaguely unethical research, and has instead gone completely the way of paper pushing. While, of course, still drawing a salary from making sure tens of thousands of people are dying needlessly.

FWIW, the author of the essay at the link you provided seems deeply ignorant of why IRBs exist. "Mere resident doctors weren’t allowed to do studies on their own. They would probably screw up and start building concentration camps or something. " really?

Human challenge trials. Hundreds of thousands of dead later, and we're still using statistics to answer questions like "is Omicron ignoring immunity", instead of answering them definitely in a few days with an absolute minimum of risk. I'd volunteer for that, btw, so would literally millions. But it's just not inside the Overton window. This isn't wisdom or caution. It's plain cowardice.

How is asking someone questions a legal threat?

From the email:

>My questions are about your process for when I do submit a request.

It's really easy to read this as "I am going to be submitting a request."

>I look forward to your reply without undue delay and at most within 45 days of this email, as required by Section 1798.130 of the California Civil Code.

So I'd say there is some legal threat here.

Random blogger who's not a business does not have any connection to this. It's more like if I tell you I'll sue you for murder, high treason and collusion with the Martian invasion, is it really a legal threat? There's literally no legal way for me to sue anybody like that.

>These FAQs provide general consumer information about the CCPA and how you can exercise your rights under the CCPA. They are not legal advice, regulatory guidance, or an opinion of the Attorney General. We will update this information periodically.

I understand that someone can do cursory research and be overly confident in their understanding of a law that spans 46 pages. I hope you can understand that people can be underconfident in their understanding of a law that spans 46 pages, is bound by the entirety of a state’s statutes and case law, and feel overwhelmed by someone asking for a response on their compliance with said law. Regardless of what their interpretation of the original email should or shouldn’t be.

>It's more like if I tell you I'll sue you for murder, high treason and collusion with the Martian invasion, is it really a legal threat? There's literally no legal way for me to sue anybody like that.

Comparing a reasonable fear that one may not be in compliance with a complex legal system to something absurd does not invalidate that fear.

And, as someone also pointed out in that thread, being on Hackernews and having IP logging may be enough to trigger that requirement.

Further, with the absolute shitshow that is the US court system, if someone brings a frivolous suit you're looking at thousands of dollars in legal fees, because you're going to need a lawyer (or previous experience in law) to properly explain to the judge why this suit is utterly ridiculous. And there's no guarantee if you'll get compensated for that, even if you file counter-suit--and even if you do get compensation, it's likely going to happen several years later, after the guy who tried to sue you does everything in his power to avoid paying up, because he knows you're eventually going to run out of money.

There’s a reason patent trolls, copyright trolls, ADA trolls, etc. go after small entities: they’re more like to pay a small settlement out of fear than risk taking it to court and being bankrupted.

[1]https://youtu.be/rEcOzjg7vBU

This reads as a thinly vieled command to respond, not a mere request, citing legal code and (incorrectly) asserting it's applicability as a basis for the authority to give such a command, with the implication being the possibility of legal action if the demanded response is not provided.

It isn't. Being paranoid about lawsuits against some personal blog shows a lack of legal sophistication and this type of sensationalism promotes an irrational fear of being somehow financially vulnerable to almost any legal predation. That's simply not how the US system works. There have to be actual damages for a court case to go forward to the worst-case expensive end (depending on what most people consider "crippling"). Courts aren't pernicious and are very sensitive to anyone attempting to waste court time on exploitation (except in Texas courts supporting patent trolling, obv).

Any judge would have this resolved by giving the parties a 15 minute sidebar to come to an actionable resolution or sanction both sides in some motivating manner. The US legal system has a vested interest in not taking everything to a long drawn out fight, due to limited court time, even if it is presented differently in media (or the comments in these threads, which are laughable).

And yet, many people reacted just like this writer. Perhaps, given that the reaction was widespread, it could and should have been anticipated, instead of expecting every person to have your evident legal knowledge.

Nope. A legal threat is a statement by a party that it intends to take legal action on another party. GL with whatever.

Asking questions is an implied threat often enough that a question can indeed effectively be a threat.