How online ads actually work.
Very simplified TLDR: you visit a news site. They load an ad network and tell it “put ads here, here and here”.
The ad network now tells 300 companies (seriously, look at the details of some cookie consent dialogs) that you visited that news site so they can bid for the right to shove an ad in your face.
One of them goes “I know this guy, they’re an easy mark for scams according to my tracking, I’ll pay you 0.3 cents to shove this ad in their face”. Someone else yells “I know this guy, he looked at toasters last week, I want to pay 0.2 cents to show him toaster ads just in case he hasn’t bought one yet.”
The others bid less, so that scam ad gets shoved in your face.
That’s extremely simplified of course. https://en.wikipedia.org/wiki/Real-time_bidding has a bit more of an explanation.
And how you’re tracked online. I’ve worked on Google ads accounts every day for a decade and I don’t see you,the user, and your data.
I just click “female, 50+, likes home decor, uses a phone” and then a little business I work with bids 10% extra on you because they think you might be interested in their new autumn wreaths they’re super proud of, and Google think you fit that box I ticked.
And that’s advanced marketing for most businesses. Most businesses won’t even get into the audience side of things and they’ll stick to keywords: they’ll show you an ad because you searched for “autumn home decor” and that’s all.
Google take advantage of most advertisers by saying "let us be in charge of your keywords, and how much money you spend, our AI is smarter than you and you don’t have time!"And most businesses just use the automatic stuff because they don’t understand it, and it’s true, they don’t have time… so then Google takes your “autumn wreath” keyword and shows your ads to someone looking for “Christmas trees”, because they’re both seasons and they’re both plant related, right?
And then the small business gets charged $1 by Google to show their autumnal page to someone who wasn’t interested and left right away.
My job is to help these businesses actually make an advertising account that doesn’t fall for all these little bear traps that Google sets all over their ads interface. They weren’t there 7 years ago, but things have been getting worse and worse. Including third party sales companies like regalix, hired by Google to constantly call you and telling you to trust the automation and spend more.
It’s fascinating that the enshittification is taking place on both ends of Google. I would have thought that the slow bastardization of search was for the benefit of advertizers but it’s bad for everyone except Google.
That was always part of the enshittification formula. The final stage after exploiting users is to exploit business customers to the breaking point.
::hugs my PiHole::
Inside almost every arcade cabinet is a Dell Optiplex running Windows 7, or 10 if its really recent. There’s no such thing as an arcade board anymore, they’re all Dells, or sometimes those HP mini PCs, usually with the protective plastic still on.
Daytona even uses a Raspberry Pi to control the second screen. SEGA intentionally ships those with no-brand SD cards that consistently fail after 3 months. It’s in their agreement that you’ll buy another card from them instead of just flashing the image onto an SD card that won’t break.
The Mario Kart arcade cabinet uses a webcam called the “Nam-Cam” that is mounted in a chamber with no ventilation, which causes it to overheat and die every few months, so of course you’ll have to replace those too. The game will refuse to boot without a working camera.
Oh yeah also all arcade games with prizes are rigged. All of them. We literally have a setting that determines how often the game will allow wins.
It’s in their agreement that you’ll buy another card from them instead of just flashing the image onto an SD card that won’t break.
Sounds like it’d be pretty simple to just replace it and not tell them. If they tell you they know it should’ve broken down by now, just ask, “Why, did you intentionally sell me something defective?”
Psst, that’s another secret
Oh yeah also all arcade games with prizes are rigged. All of them. We literally have a setting that determines how often the game will allow wins.
One time on vacation, my little sister and I found a crane game in the game room of our hotel that was clearly over tuned - basically every button press was another win, it was great. We still remember it fondly. A stupid thing, but even at that age we knew these are usually scams and we we’re stoked to just basically get cheap toys.
If I was to open up a classic video.game arcade and run it entirely on downloaded roms is someone coming to take me down?
Yes. You have to have a license to charge people money to play those games.
Otherwise you would have seen a ton of arcades open already
Edit: I only know this because I asked a guy who ran one. His machines were in pretty bad shape and I inquired why he didn’t just do as you thought.
Technically not my industry anymore, but: companies that sell human-generated AI training data to other companies most often are selling data that a) isn’t 100% human generated or b) was generated by a group of people pretending to belong to a different demographic to save money.
To give an example, let’s say a company wants a training set of 50,000 text utterances of US English for chatbot training. More often than not, this data will be generated using contract workers in a non-US locale who have been told to try and sound as American as possible. The Philippines is a common choice at the moment, where workers are often paid between $1-2 an hour: more than an order of magnitude less what it would generally cost to use real US English speakers.
In the last year or so, it’s also become common to generate all of the utterances using a language model, like ChatGPT. Then, you use the same worker pool to perform a post-edit task (look at what ChatGPT came up with, edit it if it’s weird, and then approve it). This reduces the time that the worker needs to spend on the project while also ensuring that each datapoint has “seen a set of eyes”.
Obviously, this makes for bad training data – for one, workers from the wrong locale will not be generating the locale-specific nuance that is desired by this kind of training data. It’s much worse when it’s actually generated by ChatGPT, since it ends up being a kind of AI feedback loop. But every company I’ve worked for in that space has done it, and most of them would not be profitable at all if they actually produced the product as intended. The clients know this – which is perhaps why it ends up being this strange facade of “yep, US English wink wink” on every project.
Software Engineering. Most software is basically just houses of cards, developed quickly and not maintained properly (to save money ofc). We will see some serious software collapses within our lifetime.
Y2038 is my “retirement plan”.
(Y2K, i.e. the “year 2000 problem”, affected two digit date formats. Nothing bad happened, but consensus nowadays is that that wasn’t because the issue was overblown, it’s because the issue was recognized and seriously addressed. Lots of already retired or soon retiring programmers came back to fix stuff in ancient software and made bank. In 2038, another very common date format will break. I’d say it’s much more common than 2 digit dates, but 2 digit dates may have been more common in 1985. It’s going to require a massive remediation effort and I hope AI-assisted static analysis will be viable enough to help us by then.)
My dad is a tech in the telecommunications industry. We basically didn’t see him for all of 1999. The fact that nothing happened is because of people working their assess off.
My dad still believes the entire Y2K problem was a scam. How do I convince him?
Well my dad does too and he worked his ass off to prevent it. Baby boomers are just stupid as shit, there’s not really much you can do.
Windows, Linux, FreeBSD, OpenBSD, NetBSD, and OSX have all already switched to 64 bit time.
Tell that to the custom binary serialization formats that all the applications are using.
Edit: and the long-calcified protocols that embed it.
So they have a year 202020 bug then
I get the joke, but for those seriously wondering:
The epoch is Jan 1, 1970. Time uses a signed integer, so you can express up to 2^31 seconds with 32 bits or 2^63 with 64 bits.
A normal year has exactly 31536000 seconds (even if it is a leap second year, as those are ignored for Unix time). 97 out of 400 years are leap years, adding an average of 0.2425 days or 20952 seconds per year, for an average of 31556952 seconds.
That gives slightly over 68 years for 32 bit time, putting us at 1970+68 = 2038. For 64 bit time, it’s 292,277,024,627 years. However, some 64 bit time formats use milliseconds, microseconds, 100 nanosecond units, or nanoseconds, giving us “only” about 292 million years, 292,277 years, 29,228 years, or 292 years. Assuming they use the same epoch, nano-time 64 bit time values will become a problem some time in 2262. Even if they use 1900, an end date in 2192 makes them a bad retirement plan for anyone currently alive.
Most importantly though, these representations are reasonably rare, so I’d expect this to be a much smaller issue, even if we haven’t managed to replace ourselves by AI by then.
an end date in 2192 makes them a bad retirement plan for anyone currently alive.
I can’t wait to retire when I’m 208 years old.
Omg we are in same epoch as the butlarian crusade.
Butlarian crusade
Butlerian Jihad, my dude. Hate to correct you, but the spice must flow.
Im just glad you got that reference
If you’re going to correct people about Dune quotes, at least use one from the book! “The spice must flow” doesn’t appear in any of them, it’s a Lynch addition.
How many UNIX machines in production are still running on machines with 32-bit words, or using a 32-bit time_t?
How much software is still running 32 bit binaries that won’t be recompiled because the source code has been lost together with the build instructions, the compiler, and the guy who knew how it worked?
How much software is using int32 instead of time_t, then casting/converting in various creative ways?
How many protocols, serialization formats and structs have 32 bit fields?
What is the basis for the 2038 problem?
The most common date format used internally is “seconds since January 1st, 1970”.
In early 2038, the number of seconds will reach 2^31 which is the biggest number that fits in a certain (also very common) data type. Numbers bigger than that will be interpreted as negative, so instead of January 2038 it will be in December 1901 or so.
Huh interesting. Why 2^31? I thought it was done in things like 2^32. We could have pushed this to 2106.
Signed integers. The number indeed goes to 2^32 but the second half is reserved for negative numbers.
With 8 bit numbers for simplicity:
0 means 0.
127 means 127 (last number before 2^(7)).
128 means -128.
255 means -1.
Are there currently any that are showing signs of imminent collapse? (Twitter, maybe?).
Or what are the signs to look for those who are untrained in this field?
Regarding Twitter: yes.
As a tech person outside Twitter, looking in: Twitter is metaphorically a huge airliner with one remaining engine, and that engine is pouring smoke.
The clown who caused the first four engines to fail has stepped out of the pilot’s seat, but still has the ability to fire the new pilot, and still has strong convictions on how to fly a plane.
That plane might land safely. But in the tech community, those of us fortunate not to be affected are watching with popcorn, because we expect a spectacular crash.
If anyone reading this is still relying on Twitter - uh, my advice is to start a Mastodon account. Or Myspace or something.
I used to be a funeral director. The majority of outsiders were unaware of pretty much everything we did. Often on purpose because thinking of death is uncomfortable.
The biggest “secret” is probably that the modern funeral was invented by companies the same way diamond engagement rings were. For thousands of years the only people who had public funerals were rich and famous. It was the death of Abraham Lincoln that sparked the funeral industry to sell “famous people funerals at a reasonable price”. You too could give your loved one a presidential send off! The funeral industry still plays into this hard, and I’ve found many people are simply guilt tripped by society to have a public funeral.
What do you mean by “public funeral”? What’s the alternative? It sounds like you’d consider an event with only friends and family where there was a coffin in a room to be a “public funeral”. That seems to be what most people have, but it isn’t very public. Is a non-public funeral one where the family makes the coffin themselves and there’s no event where people see the dead person and the coffin?
You didn’t talk about how coffins are sold for many thousands of dollars when they are just cheap plywood boxes that shouldn’t cost more than a hundred bucks and that serve no purpose other than to decay as quickly as possible.
Not so fun story:
One of my first jobs when I was barely 18 was with one of the big funeral home/cemetery providers in the US. It was positively horrible, and not for the reasons most people think.
As a new hire, you’d start on the cold-calling phone banks, which was bad enough. Nobody wants a cold marketing call from a cemetery. But it got worse from there.
After a month on the phone bank, I’d done well enough to be promoted to field sales, which meant going to the most impoverished areas of town to follow up on the appointments the phone bank had made, basically trying to scare poor elderly people into handing over what little they had to ‘pre-plan’ for their deaths, with the pitch that if they didn’t, their family would suffer.
After a few appointments it was clear I didn’t have the stomach for that, so they moved me to on-site sales, which was somehow worse.
On-site sales included helping to host the Mother’s Day open house at the large main cemetery. They set up a greeting station at the entrance with refreshments and ‘in memorium’ wreaths that could be bought by bereaved family (on that day, mostly children of the deceased, but also mothers who had lost their children, some at a very young age). It sounds like a kind thing to do, because many young mothers/fathers coming to visit were so distraught, they hadn’t stopped for coffee or thought about flowers.
I was not stationed at the welcome station. I was a ‘roamer’, meaning I was one of several staff expected to meander through the graves and check on families graveside – to ask if they needed anything and to upsell them pre-planning packages for themselves or their other children. I am not kidding, we were expected to do that.
I had to be prodded to approach my first mark (a young couple ‘celebrating’ the woman’s first Mother’s Day at the grave of her several months old child, and I couldn’t stomach it. It felt barbaric, to even try to sell someone who could not stop crying at the grave of her young child. I couldn’t do the pitch, obviously, and backed out as soon as possible, then hid by the skips behind the main building until the end of the day when I quit.
I’ve done many jobs in my life, including cleaning bowling alley toilets, but I’ve never been asked to do anything as vile.
I’ll bet everyone in the funeral industry can guess which company I’m talking about.
The USA is run by unpaid 22 year old interns being supervised by underpaid 24 year olds.
Old people in charge are definitely a problem (McConnell, Feinstein etc) but the people in their offices doing all the heavy lifting are basically children.
I mean, people in their 20s have done some pretty amazing things.
Yeah but most people aren’t Alexander the Great or Mozart. And even if you are, you’re probably not working in congress, hah
Alexander had Aristotle to tutor him. If you find yourself young and in power, you better hope your elder advisors are that good.
Many European language versions of anime and games are being localized not by translating the original Japanese, but the English.
Lots of translators also seem to use Google or DeepL, which makes the issue even worse.
The English language version often don’t even translate, they write their own version, calling it “creative liberty”. This leads to a completely different version than what was intended, with others, such as the German or Spanish version, being even further from the original.
That’s why claims of people of having “learnt Japanese from anime” are dubious in the best of cases.
Source: Am Japanese, working in game translation in Tokyo. I’m also trilingual, which makes it even worse to watch this. Ignorance is bliss.
Shout out to Banjo Kazooie, an older platformer from the Nintendo 64 game era, where the antagonist always speaks in silly rhymes. So the translators needed to translate and also make it rhyme while also keeping the context and humor intact. They took creative freedom of course because there simply isn’t a good match but it actually enhances the game in a way. So if you played the game in French before and now switch to English you’ll get a fresh set of jokes and rhymes.
The flip side of this is the Samurai Pizza Cats, where they completely rewrote the dialogue to make the English version way more entertaining.
Well that just sucks. So if you’re a die hard fan of [anime name] and happen to be European how would you find something close to the source material?
I noticed that “creative liberty” first with the Dragonball series. I grew up watching the dubbed versions then one day discovered a little import store that sold tapes of the series with the original dialogue subtitled into English. There were a noticeable amount of differences in the story and it was slightly mind blowing to me at the time.
It’s not exactly what you’re looking for but the website https://animelon.com lets you use English and Japanese subtitles at the same time. And you can look at definitions of individual words. It is probably only useful if you are beyond a beginner level though.
I think using Japanese subtitles would be the way to go in general assuming you can read them but have trouble with listening.
I used to work as a contractor for an environmental remediation firm. All the waterways that you joke about not swimming in are actually full of some awful carcinogen. Old industrial plants dumped awful chemicals for years and years. Some of these issues are being slowly addressed, but regulation is always well behind the science. But often, if the liability is significant enough, companies will spend millions of dollars a year to kick the can down the road doing studies and monitoring so that they can avoid what would be hundreds of millions to actually remediate the problem.
When your favorite band cancels their gig because the lead singer has “come down with the flu”, that’s industry code for “got too wasted, and is currently too busy getting alcohol and possibly drugs out of their system to perform”.
I even worked one show that had to end after 20 minutes because one guy in the band was visibly under the influence, refused to play, talked to his hallucinations, then spent a few minutes talking to the audience about how his foot was evil and wanted to kill him, before the tour manager could drag him off stage. Then he tried to assault several backstage staff for not allowing him to cut off his foot. This was on a tour that promoted alcohol free rockshows btw, so we didn’t provide alcohol to the artists backstage. God knows what he might’ve purchased from our local street dealers lol.
The next day in the papers, the headline says “[the band] cancels first week of reunion tour after flu outbreak” 🙃 Yes, of course
I always wondered why Paul Westerberg caught the flu so much. When I finally got to see him live a few years ago he definitely was coming down with the flu on stage.
Phone systems that give you the prompt, “Press # for more options” etc are called Interactive Voice Response (IVR) systems. If you encounter an IVR that asks for credit card info, social security number, etc, don’t enter it in! If you stay silent, you will usually be routed to an agent, though that varies on whichever system you are calling into.
Even if the system is designed for completely non-nefarious purposes, the IT people who maintain the phone system can analyze call logs to pull electronic keypresses (DTMF) and reconstruct every digit entered to capture your data. Most IT people would never consider abusing this access, but some organizations contract or sub-contract their phone support out to the lowest bidding third parties and might not do a great job of vetting their techs.
Giving this information to a live agent has its own risks, but if you initiated a call to a documented telephone number for the organization you are trying to reach, it is generally a safer option than keying in sensitive digit strings to an IVR. It is much harder for anyone outside of the call center to scan recorded audio for information like this. (Though technology is closing that gap)
Truth
The past decade of the tech industry has felt very snakeoil-y.
INB4 “It always has been.”
If you’re good at building hype and have some connections, you can attract all sorts of investors hoping to get in on the ground floor of the next big thing.
Dan Olsen’s NFT video from a year ago summed it up well, I think (link). People with money to invest today want to repeat the insane growth in wealth brought about by computers, the internet, social media, etc. So they will basically gamble on any new ideas that have an air of plausibility to kick off the next boom.
What’s sad is there are plenty of actual problems out there that could be solved with software. Most of the time they’re not that ‘sexy’ and management is so blinded by greed that they throw away all the good opportunities.
Do you have any examples of problems currently lacking a (plausible) software solution?
I think it started with registry cleaners.
Those weren’t really pushed as a get-rich-quick scheme, which a lot of the hustle seems to be currently.
Oh, you’re thinking of crypto to junk. Nah, Fudge That.
It is kind of hilarious that airplanes are seen as being safe and reliable, when if they were given the same factor of safety as most other consumer goods, they’d never get off the ground from being too heavy.
I do NOT recommend you do this, but if a ladder says it is designed for 300 lbs, then it should carry 1200 lbs. 4X is a fairly common factor of safety for things like ladders where people’s lives are in jeopardy. Most other items are usually 2X. (I want to point out that there are qualifications to this… static loading and dynamic loading are totally different things. Also a simple point load is not the same as a cantilevered loading condition. A new piece of equipment is not the same as one abused on the job for the last 10 years. All these things will dramatically affect safety ratings for things)
I’d say the difference is that every single part of an airline is carefully rated though. Everything that’s supplied for use on an airline is expensive because of all the regulations.
A ladder may be rated for 1200 pounds, but nobody inspects every single use-case for that ladder and ensures that the entire system always has 4x safety. Once you buy the ladder it’s up to you what you lean it up against, etc.
Regulations and quality checks on aerospace parts is no joke. More so on stuff that goes out into space and on military hardware, but every single nut and bolt and everything in between can be traced back to a supplier and that supplier will be able to tell you when it was made, by who and even where the raw material came from and show you the certs. Regular airplanes not nearly as strict or as much paperwork, but it isn’t that far behind, quite honestly.
Also, you might be surprised by the testing that ladders go through. Not so much the cheapo Chinesium stuff, but safety in all fields is no joke. It is too costly to skimp on testing.
I used to believe this, but recent incidents have exposed systemic issues in engineering and QA at at least one major US aerospace manufacturer.
Accounting is a goddamn mess. There’s lots of mistakes in accounting, finance, banking, etc but we’re supposed to act to outsiders like they never happen. Publicly traded companies (US) get audited every year, but no audit company would give a paying customer a failing grade. New grads are funneled into working for public firms - the 10 or so companies that cater to the world’s audit, tax, and consulting needs. They’re supposed to teach discipline, but in reality they only teach you security theater. You’re worked to the bone until you either burn out or agree to perpetuate the system to keep your job.
And the only reason it continues to work is society’s social contract agreeing that it has to work because we don’t have any other options. All it takes is the rumors that the idea is failing - like in the silicon valley bank run - and we’re all out of luck. With the speed of information these days all it takes is a few minutes for a situation to spiral out of control. It’s bonkers.
I got into accounting because I enjoyed bookkeeping in high school. Now that I’m in it I refuse to work for anything larger than a mid sized, non public company.
Accounting, just like economics, likes to pretend it is a hard science when in reality is it close to reading tea leaves.
So basically, everyone is full of bullshit and lying to keep the system working.
Why am I not surprised?
Social security would be a ponzi scheme if it wasn’t done by the government. System only works because new younger people are “convinced” to put in money to pay the old in hopes that new younger people will pay them in the future.
The social security liability is currently 23 trillion. If no new people started paying in and everyone wanted to cash out, they couldn’t get a dime.
We are 33 trillion dollars in debt. 33 trillion.
If we as a country ever tried to cut spending and save money to pay that down, our economy would collapse so fast.
Social security was designed to be that way, it’s not a secret or anything. It’s how the system was set up and it’s how it is supposed to work. Today’s workers fund today’s retirees.
Except it was built with the assumption that everyone would continue to have 2.5 kids, and skilled immigrants would keep making the US home, and the economy would keep growing and growing forever, and retirees would die off a couple of years after they retired.
All the base assumptions on which the system were built were shaky. People are having fewer kids, so there’s less money coming in. Retirees are living longer so they need more benefits. People who paid hundreds of thousands into the system during their lifetimes are requiring millions in benefits at the end of their lives. But, people are having fewer kids and so the bottom of the pyramid is shrinking.
More immigration would help, but we’re just too damn racist
[in the US] your insurance dictates your healthcare, not your disease, deformity, symptoms etc. If your insurance pays for an allergy test, you’re getting an allergy test (even if you came in for a broken arm). If insurance pays for custom orthotics, you’re getting custom orthotics (even if you came in for a wart removal). We will bill your insurance thousands of dollars for things you don’t need. We’re forced to do it by the private equity firms that have purchased almost all of American healthcare systems. It’s insane, it’s wasteful. The best part is the person who needs the allergy test or the custom orthotics can’t afford it, so they don’t get the shit we give away to people who don’t need it.
I would gladly kill myself if it meant we got universal healthcare, but private equity firms can’t monitize a martyr so it would be pointless.
Fuck everything about the current US healthcare system. The US can be so much more, can be so much better, if we could somehow just make a single percent stop fucking over the other 99%
Supermarket employee here. We have a “fresh” fish counter selling stuff like whole mackerels and raw salmon fillets and the like.
Each and every one of these has been frozen at least once - this is a mandatory health hazard prevention thing (to kill off parasites etc) and also basically the only food-safe way to transport them in great quantities over long distances without them going bad. They get delivered frozen solid, get thawed behind the scenes and then put on display / on ice for customers to buy. And then they’re lying there all day long until someone happens to buy some … people still treat the pre-packaged fish from the frozen foods aisle as a second choice, even tho those have NOT been lying around half-thawed in the open air for 10 hours straight.
Long story short, “fresh” fish from the counter is less fresh than the frozen stuff, despite customers commonly believing it to be the other way around.
Hold up, you mean that market in the middle of nowhere (like Kansas) with “fresh caught” fish was not caught by my local fisherman.
Shocked, I tell you 😂
Oh you’d be surprised … by the way, the same goes for literally everything at the bakery counter. Heard a customer complain once that she won’t ever buy pretzels in the store again because they weren’t actually freshly made, the employees just tossed prepackaged frozen pretzels ino the oven yadda yadda … uhhhm lady, do you really think they’re kneading dough behind the scenes?! Never wondered why your croissants, bread rolls and the like always have the same shape, size and weight? It’s almost as if they were made in a factory or something …
…yet these, too, are treated like first choice over the frozen bread rolls you can bake at home, because “a real baker made them” …
The bakery part hits me especially hard, I’m living in germany, where many people are proud of the bread culture, and you basically need to look for artisan bakeries to get stuff they actually made themselves instead of having frozen stuff delivered and just baked in the store. The saddest part is most people don’t realize, while still writing comments online about how “american bread is just sugar”
If you’re ever in San Francico there’s this hole in the wall Bob’s Donuts on Polk Street, go there after 8pm and order whatever was just made. Eat a five-minute-old donut.
Bob’s supplies most of the cafés and donut shops in San Francisco, and tapping the source is a fast way to becoming a donut snob and addict.
I have a micro-bakery (I run it completely alone) where I make everything from scratch, and every day I get customers who enter and immediately leave disappointed because I only have 6 or 7 different breads at most, when the big-name franchise store in the main street has literally dozens of varieties. Once one woman asked me why I wasn’t baking fresh baguettes every hour like them. I don’t know, lady… maybe because my baguettes take more than 3 hours just to do the first proofing, while they simply have to put industrial made ones in the oven?
Please tell me more. I’m obsessed with good bread. Where are you based? Do you have to work mad hours to survive?
Sorry for replying late.
I am in East Asia. I work about 11 to 12 hours a day, every day. And it is NOT worth it, we survive because we are fortunate enough that my SO has a well paid job.
If you really crave good bread, I can give you this advice: find yourself a copy of “Bread” by “Jeffrey Hamelman”, get a nice baking stone (pizza stone?) for your oven, and bake it at home. It is incredibly easy (really, you will be amazed), and really satisfactory.
I’ve worked with massive customer databases of over a million people multiple times in jobs I’ve had. And while each company has spent tens-of-thousands of dollars in cyber security to protect that data from outside hackers, none have given any fucks at all about who accessed it internally or what they do with it.
I’ve literally exported the entire customer database in two different jobs, dropped the CSV into my personal Google Drive (from my work computer), and worked entire databases at home.
No one has ever known I’ve done it, cared, or checked if I have any customer personal data when I quit.
Sounds like they didn’t spend any money on Cyber security’s team to properly implement it then…data exfil %100 would have been picked up by any real DLP solution and even barebones heuristics based EDR would have thrown a red flag as well.
Haha, please. You’re talking about machine learning when the best any business is using is antivirus. You forget, Boomers are still running big business and IT departments are running security.
It’s perfect world vs. real world my dude, and real world puts out tender for the cheapest solution.
It sounds like you’ve been working for Mom and pop shops then, and they’re not having audits done. Companies with millions of customers will usually either have in house secops or an mssp handle everything. Point being is, without audits then insurance usually will not be approved for PII loss or they flat out will not work with the company at all. It even more so with HIPAA laws.
I’m with the above commenter. I’ve worked at many companies of various sizes, from small local shops up to international corporations, including at least one contractor for the US military.
Every one of them had rules and policies and training on security, to varying degrees. But at every one of them, I’d find some vulnerability, or instance where someone was neglecting security. Each time, I’d bring it to the attention of someone in management. Each time (with one company as exception), those warnings would be “heard” and “passed up the chain”, and then nothing would happen. Only one company in 20 years of work actually fixed a security issue I found. And no company I’ve ever worked for was leak proof.
In my experience, until it threatens to cost a company much more money in losses than it would cost to fix the problem, but said problem will not get fixed. That’s profit motive. And often it seems they’d rather roll the dice until a loss occurs, and then (maybe) fix the issue.
I’ve worked at plenty of companies with exfil protection and people still did this. One has 100 devs and 500 total employees
