[laidoffamazon]

> Alexa put a huge emphasis on protecting customer data with guardrails in place to prevent leakage and access. Definitely a crucial practice, but one consequence was that the internal infrastructure for developers was agonizingly painful to work with.

I was in Alexa and this rings painfully true. So many workarounds and endless classification escalations. The customer-data certified compute environments were extremely painful to use (though later improved but still annoying) and getting data in or out, even for anodyne reasons, was nigh impossible. For a long period, even getting access to this system (called Hoverboard) took months. During my internship I spent about half of it waiting for access to be granted and had to spend a big chunk of it testing out my training system on CPU...not fun.

[lcnPylGDnU4H9OF]

I get the feeling that you weren't intending to say so many kind things about the access control practices for Alexa data. Sounds like good work.

[laidoffamazon]

This was a common complaint in Alexa and one interesting bit of insider information I found out from people that either left for Google Assistant or came from there is that their tools did not have this level of pain around data security. As a result I'm guessing there's a middle ground between customer data security and making it impossible to work with - either that, or Google just didn't care.

[lcnPylGDnU4H9OF]

> either that, or Google just didn't care

Let's just say I get the impression Google doesn't care. Really, that access control for Alexa data ought to be the standard.

[mh-]

"So painful it contributes to the downfall of your product" need not be the standard. There is a middle ground that takes customer data seriously.

[nicce]

I thought Alexa was bad for privacy.

But I guess Amazon does everything in their power that only they have the access.

So it sounds to be quite well secured, while no idea what Amazon does with it.

[lcnPylGDnU4H9OF]

To be honest, I'm just going off the other commenter's testimony; I would have presumed that their internal data access control policies would be... minimal, to be generous. The fact that developers couldn't get access to data to the point that they noticed and it was painful sounds like a genuine good step in the right direction, though.

There is a point that there should be a way of gatekeeping this in a maximally efficient and accountable way but setting the standard of "Access Control" as being that there's friction to gain access seems like a no brainer.

[GJim]

You're complaining that personal data was well secured?

This should be a given. The fact you think otherwise is worrying.

(Yes, data security legislation does introduce barriers. Tough. Get used to it.)