(alexschapiro.com)
There's nothing wrong with pitching stories this way, but for context, if you look at this researcher's archive, they're all basically "I found a vulnerability in some big company's thingy". The news hook here is literally just "I found a GraphQL bug". This is not Alex Schapiro's most interesting front-page story (by which I mean: they've posted some genuinely interesting stuff before).
Two examples:
1) Hiring 14 year old slaughterhouse workers (https://www.nbcnews.com/news/us-news/pssi-hired-same-child-t...)
2) Gamifying of one its genealogy websites that tracked cemetery markers, which resulted in people "claiming" victims of mass shootings for points (https://dna-explained.com/2022/06/02/find-a-grave-owned-by-a...)
ETA
People have asked about the second example. In a nutshell, Ancestry purchased Find-A-Grave in 2013, and Blackstone acquired Ancestry in 2020.
Originally, dind a Grave was basically used by amateur genealogists to check the names and dates on gravestones across North America. Volunteers could submit photos and other data.
Blackstone brought in a Facebook executive to run its genealogy business, and gamified Find A Grave for engagement/revenue purposes (Find A Grave is top of funnel for Ancestry subscriptions and also is heavily blanketed in ad networks.)
Gamification led to some very ugly situations, and as I recall they barely backed down over this. Per Roberta Estes, an experienced genealogist cited above:
The problem is that finding your loved one’s memorial, often with incorrect information, created by a stranger is unexpectedly jarring, at best. Especially to discover that your family member was only a trophy harvest whose memorial was created hours after they died. Then, having to ask (sometimes beg an unresponsive person) for the transfer of their memorial to you, only to have the creator’s name forever associated with the memorial adds insult to injury. ...
Who in their right mind would think that entering those massacred children into Find a Grave immediately was acceptable by any criteria? Any standards of decency? And why would Find a Grave tolerate this for even a minute? Death is traumatic for family members under the “best” of circumstances and it only goes downhill from there.
/S
Evidence?
This is no different than blaming the big AI tool because it messed up doing work in your spaghetti codebase - “how else was I supposed to do it?”.
Stay small enough to do business properly.
Yes, this is a ding on the parent company.
How indicative it is of their other companies making the exact same mistakes is a different question.
But I’d expect issues somewhere.
It’s one of the major ethical / effectiveness issues with business - especially American business - today.
Anyhow, all else being equal, so long as I am living in a transactional society, I prefer those transactions to be with people I actually know. I like real relationships. So much of the way we are changing as a society seems to be alienating us from each other - I make a point of trying to counter that in my daily life.
On the flip side, corporate PMs tried billing my friends for damage that was questionable/grasping at best on an apartment they'd told my friends, in writing, that was going to be gutted down to the studs on the expiry of their lease.
The largest corporate PM in my county has this "look how tenant-friendly we are, we won't raise your leases just because we can" all happy and smiley website where they advertise their open listings...
... and a much less advertised site dedicated just to property owners where they "promise to get you the maximum value out of your investment, looking for every opportunity to maximize its income-earning potential (i.e. raise rents at every possible opportunity to the maximum legally allowed), and "ensuring that when you do change tenants, the minimum effort and cost is required" (i.e. bill your previous tenants for as much of their security deposit as possible, while doing as little as possible).
This led to situations where my partner and I saw that the "inspection form" for the apartment we'd left not twenty minutes prior (it was initially meant to be previously) was sitting on the desk of the property manager filled with remarks like "blinds not cleaned, needed professional cleaning", "drywall holes, needed professional repair", "odors, needed remediation, professional cleaning".
In other words, they'd planned ahead to take the deposit, and when our meeting with the PM was rescheduled it pointed out the lie, "Oh, when was this inspection and these repairs all done? In the fifteen minutes since us locking the door and going down the elevator to wait for you in the lobby?" Of course, said PM company also owned, helpfully, a carpet cleaning company, a housecleaning company, and everything else, so you knew they were going to give you a good deal (not).
"Oh... um... oops... that's a mistake, I must have printed off from a template and not tidied it up".
But this is just dueling anecdotes.
I think the expectation on a message board is that you can name drop a big private equity firm and count on voting support for them. Unfortunately for you, I've spent the last 5 years working on rolling back single-family zoning in my municipality, and an alarming amount of that work has involved pushing back on NIMBYs arguing that if we allow housing construction Blackstone (very specifically Blackstone) will just come snap all the real estate up and hoard it.
So I've had some time to marinate in this particular bit of populist rhetoric.
Real estate is very much a closed of group of more traditional business and has not begun to understand their responsibility to keep this data safe.
Edit for more detail: To tack onto this, it's very much the case we're all familiar with where management doesn't care about something being built correctly, they just want it built. Add on top that the management usually has no technical background. Also add that very few engineers that are passionate about writing good software want to stick around at these companies. It's a real nightmare industry.
There are some companies that will give you faith, but they're the occasional large property manager that's been scared shitless about a security based lawsuit (fine by me) or a proptech that's "disrupting" the industry that will be acquired by one of the big dogs in 18 months and slowly eroded away.
I have personally seen real estate people buy some trendy new app based intercom or entry phone system and jam it onto the front of their building and try to require that all of the residents use it...
We seem to lose the concept that people outside of tech have not idea about anything other than whatever they do. Just because you (the royal you) knows the ins/outs of security software does not mean the other 98% of the population does. Yet you're blaming them for buying a tool to do the thing they need help. Blame the devs for being idiots. Don't blame the users.
https://www.npr.org/2021/10/14/1046124278/missouri-newspaper...
Hoping this doesn't happen to you!
If you don’t stand up to weak bullies like that, you end up with people like Trump and Putin in charge.
I know a blackstone company, who were a client of mine before they underwent a hostile takeover (blackstone fired everybody).
They claim to be ISO 27001 certified. They are not. They never removed me from their ISMS, and I can see it has not been touched in three years now.
Wait, it gets worse.
My root credentials still work, both for the app, and for AWS. Nobody has logged into AWS in years (hey, we built a reliable system).
I have unfettered access to highly sensitive (in some cases literally classified) commercial data for the likes of Apple, Siemens, Philips, BAE Systems, Raytheon, and more.
Wait, it gets worse.
They did something to the API endpoint. You can now bypass authentication entirely and anyone has access to this data.
Anyway. Bunch of shysters. Incompetent shysters.