Apple Hearing Study Bug Results in Accidental Historical Data Collection From Participants

[Analog Kid]

How one views this is purely subjective. Privacy and security is not binary and mistakes happen. If we are discussing PII that went out, that's a different scope than length of time for some historical data. And whether someone was fired for this or not, we don't know. Basically perfection doesn't exist.

Every company has blind spots, wasn't there a recent outage with google and aws? Shouldn't have happened, but the response should be aligned with the issue at hand.

Keep saying Apple should hold themselves to a higher standard, they do, but mistakes happen. There is no such thing as nobody will ever not make a mistake. It's those who don't learn from the past who are doomed to repeat it.

Good reputations are easy to lose, but a reputation is given not taken. I still give Apple's reputation high marks, but that's me.

I don't think I've said anything terribly controversial: good for them for being transparent, but they shouldn't let bugs like this happen. Bugs are bad. Privacy bugs are very bad. I'm not starting an iPhone bonfire here and calling for the mob to converge on Cupertino, but I'm also not willing to let things slide because someone thinks the breach wasn't important.


A few important precepts from my upcoming book, "The Analog Kid's Guide to a Better World":

• Privacy and security are binary-- was data accessed that shouldn't have been? That's a yes or no question. Anything that can be labeled a mistake is also binary-- if it was grey then it wouldn't be a mistake.
• If by PII, you mean "personally identifiable information" and if by "personally identifiable" you mean "your name", then I think you're misguided on what information truly identifies you. The machine learning that seeks to know us doesn't give a hoot what our names are because they don't really identify us that well.
• If you compete with the best, you'll try to be the best. If you compete with the worst, you'll be satisfied as the second worst.
• Perfection doesn't exist, but the moment Apple says "we're not perfect, but we think we're probably good enough" then they're no longer a company to envy.
• Learning from history doesn't mean not repeating the same mistake because situations don't arise twice. Learning means avoiding new mistakes.
• You can learn from other people's mistakes just as well as your own. Apple didn't need to bungle this to learn that taking data you didn't ask for is wrong. They've screwed up before and they've seen plenty of others screw up before.
• There are certain triggers that encourage learning, and embarrassment is one of them. If they truly learned from the mistake then they'd agree with this view. Saying "there's no reason to be embarassed, mistakes happen" means they're less likely to learn.
• Good reputations are neither given nor taken, they're earned. Good reputations are easy to lose, bad reputations are hard to rehabilitate.

 

[I7guy]

I don't think I've said anything terribly controversial: good for them for being transparent, but they shouldn't let bugs like this happen. Bugs are bad. Privacy bugs are very bad. I'm not starting an iPhone bonfire here and calling for the mob to converge on Cupertino, but I'm also not willing to let things slide because someone thinks the breach wasn't important.

Fair enough. You and I have some differing viewpoints. I agree things "shouldn't happen", but they do, because we are imperfect. It's whether there are repeat mistakes that differentiates one from another. So I give them a pass, this time, next time is another matter.

A few important precepts from my upcoming book, "The Analog Kid's Guide to a Better World":

• Privacy and security are binary-- was data accessed that shouldn't have been? That's a yes or no question. Anything that can be labeled a mistake is also binary-- if it was grey then it wouldn't be a mistake.
• If by PII, you mean "personally identifiable information" and if by "personally identifiable" you mean "your name", then I think you're misguided on what information truly identifies you. The machine learning that seeks to know us doesn't give a hoot what our names are because they don't really identify us that well.
• If you compete with the best, you'll try to be the best. If you compete with the worst, you'll be satisfied as the second worst.
• Perfection doesn't exist, but the moment Apple says "we're not perfect, but we think we're probably good enough" then they're no longer a company to envy.
• Learning from history doesn't mean not repeating the same mistake because situations don't arise twice. Learning means avoiding new mistakes.
• You can learn from other people's mistakes just as well as your own. Apple didn't need to bungle this to learn that taking data you didn't ask for is wrong. They've screwed up before and they've seen plenty of others screw up before.
• There are certain triggers that encourage learning, and embarrassment is one of them. If they truly learned from the mistake then they'd agree with this view. Saying "there's no reason to be embarassed, mistakes happen" means they're less likely to learn.
• Good reputations are neither given nor taken, they're earned. Good reputations are easy to lose, bad reputations are hard to rehabilitate.

All good aphorisms. And yes by PII, means somebody can identify me personally due to information that was leaked, even if my name, address, phone number, ss# wasn't leaked directly. If I can't be identified personally, I'm not worried. If I can be identified because someone has my weight, height, eye color, blood type in a database and that can identify me personally, that is an issue.

Additionally, I clearly didn't say Apple should say "they are good enough". It's clear google didn't learn from the AWS outage. (or for that matter Apple on the various and sundry outages that happened in the last year or so).

Earning a reputation means someone gives them that reputation. Which is why I said reputations are given not taken.

 

[paper cup]

i very much doubt that majority of the people posting here complaining here about their right to privacy rights being infringed upon even signed up for the study lol.

good on apple for identifying the problem, deleting the data and giving the *study participants* a heads up.

 

[Analog Kid]

I agree things "shouldn't happen"

Then why are you arguing with me for literally saying that bugs like this “shouldn’t happen”?

 

[I7guy]

Then why are you arguing with me for literally saying that bugs like this “shouldn’t happen”?

Saying things "shouldn't happen" is much different than reality is the underlying point. (and I didn't think we were "arguing", more like having a civil discussion)

 

[Analog Kid]

Saying things "shouldn't happen" is much different than reality is the underlying point. (and I didn't think we were "arguing", more like having a civil discussion)

Maybe I misunderstood your point, then. Were you just drawing my attention to the article saying that it did, in fact, happen? That seems a bit obvious, doesn‘t it? That’s what motivated me to comment in the first place...

 

[Analog Kid]

i very much doubt that majority of the people posting here complaining here about their right to privacy rights being infringed upon even signed up for the study lol.

good on apple for identifying the problem, deleting the data and giving the *study participants* a heads up.

So you just "disagreed" with everything I've said, including where I gave Apple credit for being upfront and handling this quickly. Does that mean you think this bug was a good thing? If it's a good thing, why did Apple call it a "bug"?

Still not seeing what's controversial in my statements... Apple screwed up. They shouldn't have. Screwing up on privacy is bad for the brand. Where do you disagree, exactly?

 

[Analog Kid]

🤦‍♂️