Hacker News new | ask | show | jobs
by 0xbadcafebee 1136 days ago
Dude. Do you realize how many companies (of all sizes) use things like Trello, putting proprietary information into a free website that can do anything it wants with the data? Meetings are barely the tip of the iceberg.
7 comments

In the same vein, it's very funny to me how many people are feeding proprietary information to LLMs without giving a damn about their employer's stance on data privacy.
Why wouldn't people do this? Employees are there to:

- Collect a paycheck

- Enjoy their job as much as the employer will let them

- Progress in their career

In 2023, there is usually zero loyalty in either direction. Much of management is about how you get people who fundamentally don't care about you (beyond the above) to do something in your interest.

This goes all the way up to most CEOs, so "your interest" means the CEO's interest (while not being fired by the Board).

Ethically speaking, you owe your employer the labor you promised for the wages agreed on. If they ask you to care about a data policy, and they're paying you to care, and you took the money, then you should care.

Morally speaking, you can decide that the employer doesn't have loyalty to you, so you won't have loyalty to the employer. But if that's your morality, then there is no rationale for being either loyal or disloyal, because you'll just mirror what someone else does. This makes the decision less meaningful than tossing a coin; it's a morality of randomness, which is dysfunctional and anti-social. It's better to live your own principles (such as loyalty) regardless of whether someone gives you the same back.

Practically speaking, doing your job the way your job wants you to do it (caring about data privacy) helps you in your career and improves the business, and improving the business keeps you in a job and again helps your career.

It's also a quarter of your life. Don't you want to do your job as well as you can, so that all that time wasn't a waste?

Your employer is a corporation, not a human. Corporations are an abstraction. There are two ethical perspectives one can take:

1) Mutual loyalty. This changed in the eighties, as jobs became transactional. Typical SWE tenure is three years today, and human resources are treated as just that, resources.

2) Improving the world. Would you rather individuals act in the interests of Shell Oil, Phillip Morris, Microsoft, Lockheed-Martin, or in the interests of society as a whole? Why do you care that a particular corporation survives or dies, rather than everyone being better off? If Google is replaced by DuckDuckGo or Bing, and customers / investors / employees switch over, what's the moral value of that?

It makes rational sense to do your job as well as you can, but "as well as you can" isn't defined the same as "to the benefit of maximizing shareholder value."

Most people I know switch viewpoints after a decade or two in industry. It takes an event or understanding the internals of corporations well enough.

As a footnote, "doing your job the way your job wants you to do it" doesn't even make sense. A corporation doesn't want anything. It's a collection of individuals. Your boss might want something, the CEO might want something different, yet a different thing might be in the interests of shareholder value, something completely different in the interests of customers, and a policy document stored on the intranet might dictate something yet different.

Loyalty doesn't solely mean staying at one job forever. You can be loyal to the terms of your employment and the expectations therein and still change jobs when it's in your best interest. You can also show loyalty later by refusing to share sensitive details about your past employer to a competitor, or referring people looking for a job.

Acting in the interests of a corporate entity and the interests of society aren't mutually exclusive. It's extremely beneficial to society for ethical people to work at large corporations to ensure the corporation does not harm society.

Well clearly a corporation does want things, as a corporation is a capitalist entity. It wants to increase its profits and maximize shareholder value. The rules, regulations and bylaws of that corporation are what it wants executed by its employees (and which you are contractually obligated to comply with).

Doing one's job as well as one can means weighing many different competing forces and making the best choice you can. The same happens in your own personal life. Do you eat an entire pizza every night because it's tasty, or do you moderate how much pizza you eat to stay healthy? These are two competing interests (your tastebuds vs your health) that you have to juggle and make the best decision you can.

This argument is nonsense in that a corporation does not "wants to increase its profits and maximize shareholder value" or want anything "executed by its employees." A corporation is a signed document usually in Delware, and a collective belief in it's existence by society-at-large. It doesn't want anything anymore than my computer, my car, or a my fence wants anything.

I do maintain my car so it continues to work for me, but it doesn't "want" oil or gas. I want it to work for me.

The same is true for corporations. Corporations are a useful construct for keeping society free and productive (relative to, say, command economies or feudalism). I want the retirees who invested in the corporation to be able to retire, customers to be happy, and employees to have a healthy work environment. The extent to which that aligns to what you think a piece of paper in Delaware wants varies. It sometimes aligns and sometimes doesn't.

Beyond that, there is no fundamental moral imperative for helping your employer grow anymore than there is for oiling a car.

There is a moral imperative to doing what you agree to do (which includes contracts), the strength of which varies by context and culture. I can go into that in much more depth.

What a bleak view. This is not my experience at all and doesn't match that of most of my friends either. Many have been loyal to their employer for years, and it goes the other way around as well.
People are loyal to people. In any org your boss could be replaced tomorrow with someone who doesn't give a shit about you.
True. And it does happen. But I don't think it happens at the scale the post I replied to seems to suggest. I hear about it sometimes, but not so often that it would be an endemic thing that has to be assumed to be the default in 2023.
I wonder which jobs you are thinking about here. Quite a lot of people work in a retail or food service position and I can assure you this feeling of "nobody caring" is absolutely present at that level.

I assume people on this forum immediately picture high paying engineering jobs and not the average worker's job.

I was loyal until I was laid-off. Never again.
Did you stop dating after the first time you were dumped?
This is inherently not the same, though. Sure, companies come in all sorts of shapes and sizes, but a company's first and foremost interest is profit for the shareholder. For a person in a relationship, it's about finding a partner that makes them happy. In addition, you are expendable to a company, whereas people build a relationship and become more and more invested over time. Way more than a company becomes invested in an employee.
I think the key, in both cases, is to learn more about relationships, and in the later case, about the nature of corporations.

It's perfectly reasonable to make a commitment to "not be evil," and to "to organize the world's information and make it universally accessible and useful." That was the founding mission of Google. That's very different from loyalty to a colorful logo, a set of incorporation documents, and an abstraction.

If I read too far into the comments on topics like this, I can’t help but imagine some did.

First sign of BS, give up and never try again.

Because of work ethics? In a world where everybody thinks like that, your plumber will map your house and sell the plans to burglars.
Actively assisting a crime is very different than passively doing something a little wreckless.

Do you think contractors shred plans of your house after you hire them for a remodel? Or do they just throw them away in a dumpster, with your address on them, behind their offices.

Work ethics dictate a duty to other humans, not to corporations.

The two are sometimes the same, and sometimes very different. To the plumber point, if you work for a plumbing corporation which requires you to up-sell unneeded repairs, you have no ethical obligation to do so, and indeed, you have an ethical obligation to subvert that particular requirement.

On the other hand, you do have a duty to do plumbing right.

Capisce?

Yeah, that’s why it’s funny to me!
I'm lucky because at the moment I work at a public project that is meant to be public and there is no issue at all with checking an LLM.

That said, lately I have favored Kagi FastGPT for two (three) reasons:

- I trust Kagi a magnitude more (or even more) than I trust any FAANG company except Apple [1][2].

- It seems to be way more up to date.

- (It seems a bit less shy.)

[1]: Why? Sound business plan, incentives align.

[2]: Does it mean I trust them? No, that would have meant I hadn't learned a thing from WhatsApp. And no, after the photo snooping stunt from Apple a couple of years ago I don't trust them either, I only consider them my best option at the moment.

I'd appreciate it if you could elaborate on where your trust for Kagi comes from? I'm baffled that an ex-GoDaddy employee reselling Bing search results at a premium, with a history of "attracting customers at one price, then increasing the price substantially" (I won't use the legal term, as IANAL), who flags HN posts bringing these facts to the public's attention, has generated so much enthusiasm here. Maybe I missed something?
People that aren't lawyers can use legal terms and give legal advice informally. I just did it for example.
Quite true, but "bait and switch" is an actual legal standard that Kagi likely technically sidestepped, given that (for now) he's still in business. I want to make sure my posts are factual, and I'm not even sure which jurisdiction Kagi operates in, so I won't speculate as to whether the deception technically reached the level of fraud, even though the phrase "bait and switch" is commonly used by laypeople to refer to non-criminal types of deception. Nevertheless, it's fascinating to see "Kagi" and "trust" in the same sentence, and I wonder if this trustworthiness was actually demonstrated somehow. It's more likely we're witnessing some kind of cognitive bias like sunk cost fallacy.
> I'd appreciate it if you could elaborate on where your trust for Kagi comes from?

As written above: "Sound business plan, incentives align."

> reselling Bing search results at a premium,

Should I also refuse to deal with ex-Facebook employees? Ex-Google employees?

These two companies has created a lot more hassle/stress/worries in my life than Godaddy.

> reselling Bing search results at a premium,

With the value add he offers it makes it a great deal for me. I don't care if other make money on me, even lots of money, as long as it is a good deal for me.

In fact, I actually see it as good sign if people make money on the services they provide me, as it will both incentivize them to continue providing these services as well as encouraging others to start competing providers.

> with a history of "attracting customers at one price, then increasing the price substantially"

I got in at an really low price and got grandfathered into a deal that is still the best in the market. They have announced the change in a clear way and since I was free to cancel anytime I wanted I cannot complain.

Had I been tied to the service somehow I would probably have been annoyed even if the service was the same and the price hike was the same, but I wasn't and I find this to be within expectations for an early stage start up.

> who flags HN posts bringing these facts to the public's attention

I'm not aware of this. Would you care to link some sources?

If not I would just expect it was a totally unreasonable post and some happy customer like me flagged it. (And on a side note: While non YC companies aren't bound to YC standards I really hope most companies who frequent HN stick to the standard of not flagging complaints against themselves.)

Edit:

> has generated so much enthusiasm here. Maybe I missed something?

For some of us, a working search engine can save us significant amount of time every day. After first having had a working search engine for years, then lost it and struggled for years with workarounds, I'd say my enthusiasm is rather understandable.

And I know this is not everyone's experience, but with my search patterns, and in the bucket Google has put my account, I get irrelevant results all the time and I get irrelevant and insulting ads all the time.

Thank you for the thoughtful response and useful info. I don't have visibility into who actually flags posts, but you could very well be correct. It's concerning to me that people find value in this product, but I'm glad you're enjoying it.
My boss used ChatGPT to write a proposal for a utility company recently. OpSec is so awful here it's laughable.
yeah, "very funny" as in reckless and ignorant of proprietary data best practices
At least with LLMs I get something useful in return.
And that's why I send it info. I used to send Google feedback until I realized it did nothing and stopped being not not evil.
My employer is explicitly against us putting stuff into chat gpt. Which is fair. But sad.
Not sure why Trello was picked as an example. Trello respects the privacy of its customers. It does not profit from collecting user information. Private company data remains private in Trello, even if the company doesn’t pay. Data is not shared and cannot be freely accessed by employees.
Their terms may have changed after they were acquired, I dunno. But Atlassian has something like two dozen different legal documents covering their software. How do you know what they do/don't do until you've had your legal department vet it?

As a random example: Trello can list any customer in their promotional materials (you have to dig through the legal docs to find the opt-out email). As the CEO of your own company, how would you like to see your company listed in a Trello ad when you're trying to do business with a Trello competitor, or gain a customer who competes with Trello?

Point being: employees use 3rd parties all the time in ways they shouldn't, often leaking a lot more data than meetings. It's why DLP is so popular.

By the same logic terms of my current email provider could be changes and all of my emails could become public or selled to higher bidder.

Both Trello and my email provider can do this. Both will have consequences.

Exactly, which is why you need to consider this stuff and not use those types of services if you have actual confidential data. Find a provider with clear contracts that prevent these types of changes. Self host. Whatever, just make sure to pay actual attention to what you're doing.
What is DLP?
data loss prevention
But how do we know? The pile is to the ceiling with other companies that said the same thing and later we discover that was definitely not the case.
Trello is owned by Atlassian. Not saying it's impossible, but they'd be shooting themselves in the foot big time if they pulled some shady shit that alienated their corporate user base.

I'd imagine they offer Trello for free to entice you to start paying for Jira (or god forbid, Confluence).

Leaking user data (or "anonymising" it and then selling it) doesn't alienate a corporate userbase, because corporations broadly do not care at all that user data gets leaked. Unless it materially affects their income, this is something that is ignored.
I work for a GMP manufacturer of pharmaceuticals and they use the free version of Trello and put tons of proprietary client information in Trello. Each client is a different company and they are never supposed to see data from the other one. It’s an absolutely insane thing to do in my opinion. I’m beginning to see why we are losing clients.
I use trello but would never give it read access to my mailbox or calendar.

There’s a big difference between me choosing what to put in trello (usually trivial data) vs giving an app unlimited read access.

Trello probably has more lawyers, more security professionals, and more QA than “Meeting Swipe Corporation” has employees?
Well don't do that either (especially if you're an european company with a business the US would like to spy on).

Duh.

I guess I should not put any meetings into Outlook either since I cannot see the code.
That doesn't mean that either one is a good idea.