It is the only social media I can still view only those I follow and in chronological order. I don’t like the algorithms. I re-followed Elon for about 12 hours the other day. Then I remembered why I unfollowed.
My account has been silent since Musk bought Twitter. I’ve to muster the courage to ask my mutuals to follow me on another platform or exchange Telegram handles.
Poor reporting, as ever. As people have pointed out, you cannot disclaim away the Law. No one can.
If you did a bungee jump, and you sign any kind of waiver, it might protect the company if your glasses fall off and smash. It will not protect them if the rope snaps and break your head.
My understanding is that when signing a liability waiver, first the acknowledgement of risk happens, and then the release of liability. State by state it can be a little bit different for releasing liability, depending on the interpretation. I looked up where I live, and that liability waiver isn’t upheld if one can prove damages (possibly death, in which case someone has to sue upon my lifeless corpse) caused by intentional recklessness, not simply neglect.
Lawyer here: this isn’t necessarily correct and in America it’s state dependent. There are absolutely parts of the law you can waive, including negligence of a party which is likely your bungee jumping scenario with the rope snapping.
Are T&Cs retroactive? I would think any new T&Cs could only apply from that point forward, not that they could retroactively absolve themselves of liability or how you could pursue it.
Like all good lawyer answers: maybe. I don’t know enough about the specific amended terms or their data breach. Courts sometimes enforce adhesion contacts and sometimes don’t. But retroactive in and of itself isn’t illegal; for example, if you could edit NOT retroactively settle a dispute, you’d have no settlement agreements.
But settling a dispute requires compensation for the party that was damaged. That’s what a settlement is.
You can’t say “If you don’t do A, B, and C you can’t sue me! Nah nah nah!” Without compensation courts are not going to believe that anyone knowingly agreed to the settlement.
Now if they gave everyone like $5 and said “Sign here where it says you can’t sue,” that would be different.
You’re referring to the contract concept of “consideration” which sometimes is the same as compensation but can also do doing/ not doing an action. Sometimes consideration isn’t required either, particularly if the original contract had adequate consideration and says future amendments don’t have to have it. (Depends a lot on which state). That may or may not matter here. It really depends on the specific terms at dispute and you can’t just assume it fixes this issue.
IANAL and I don’t claim to fully understand the case, but it looks to me like the reason they might be able to get away with it is that they’re not trying to change anyone’s rights or obligations; they are “merely” changing the mechanism by which disputes are to be resolved. It is of course a pure coincidence that the new mechanism makes it a lot harder to find 23andMe liable for any infractions.
I think it would be a pretty solid case to argue that the change to the TOS, considering the timing and combined with the breach, would be outrageously unreasonable enough to invalidate the “meeting of the minds” requirement.
Elon saw how much Alex is making from his “rare earth mineral supplements” and said shit I want in. Alex lost everything in his divorce and got banned from every major platform and all it did was increase his store sales. Hell Elon is most likely asking for advice.
PSA: you can request deletion of your 23andMe account. It won’t do anything for this past hack, but it’ll at least prevent your data from being included in future hacks (assuming they actually completely delete your data like they’re supposed to).
it’s almost always a soft delete, that is, change active field in database to false, coupled with their terms of service that state vaguely how they start the deletion process which could take months and how they may still keep certain data for legitimate purposes.
And this is why I wish we adopted GDPR more… if they are compliant, then they have to remove all data held when requested. Too bad the US will never care that much to respect individuals’ data like that.
How does the legal authority work with GDPR if the company’s physical and financial operations are entirely within the US? Would the GDPR even be allowed to audit them without their consent?
No idea if they’ve been audited. GDPR doesn’t require it. My understanding is that American companies doing any business or having any users in the EU need to be GDPR compliant for those users. I don’t think that’s been challenged in any courts yet.
Why would you this wasn’t even a hack for my understanding?
It was a password stuffing attack. Meaning that a bunch of users with reused crappy passwords had their accounts accessed with their legitimate passwords by attackers.
I’m not sure why this reflects horribly on the company in a way that would encourage one to delete their account?
This would be like leaving the key to your apartment in a public place and then complaining about your landlords terrible security when someone accesses your house when you’re not there.
They stuffed passwords to get them access to information not just on the compromised accounts’ profiles but to detailed data on a large group of other people whose accounts weren’t compromised through a function within 23andMe’s database browser.
For people out of the loop what is this about? Is a new whatsapp clone being released? I read something about apple blocking something but don’t understand what’s going on.
I agree with the other commenter in general but I’ll give you the bullet points.
Old news:
iMessage is a proprietary chat protocol that only works on Apple devices. Apple has indicated multiple times they have zero intention of porting this to other platforms
Apple users texting each other default to iMessage
iMessage has a lot of useful features over SMS texting that are highly desirable and convenient
On iPhones, when iMessages are being successfully sent in a text, the chat bubbles are blue. If they are SMS, they are green
The US additionally has a weird culture of some iPhone users shaming Android users because of the inability to communicate via iMessage, often referred to by the green/blue bubble appearance
There have been a few attempts to circumvent this, mostly by having a Mac somewhere with software installed to it that forwards iMessages to your Android device, though this is extremely cumbersome as it requires having an entire computer on 24/7 to make sure you receive these messages
New news:
Beeper Mini was released earlier this week, which actually runs a reverse-engineered iMessage client that tricks Apple servers into treating it like an Apple device
It was fully functional for about one day with almost all iMessage features working
Apple made some variety of change on their end that broke Beeper Mini functionality
And that’s about it. For those of us that would like to have easy communication with our iPhone-using friends and family, yet don’t want to change phone ecosystems to do so, this is a problem that would be awesome to see solved.
There are folks that, either because of ignorance or pigheadedness, like to chime in on these threads that they don’t care about having blue bubbles. That is the least important aspect of this to most people following this, for the reasons I mentioned above.
Thanks. That helps a lot. I never knew that iMessages was integrated with sms, just thought it existed as a internet protocol like many other proprietary ones.
Basically it’s all the same usual problem of using a closed proprietary chat protocol that a single stake holder has the power to change however and whenever they want.
Like whatsap, facebook and others which any alternative has to keep catching up to the changes that the companies do and which is very hard to maintain the reverse engineered protocols.
It never crossed my mind that I don’t usually see alternative clients for imessage, but makes sense, didn’t think it would be so hard to do.
So these guys came up with a implementation that works and apple just wants to crush them to destroy any alternatives. Business as usual.
It’s hard to understand these news when all the lingo used implies you already know the thing being talked about. An article talking about “Blue bubbles” makes no sense whatsoever to anyone not used to apple ecosystem.
Edit: added Axios link, removed double quote for Axios paragraphs
Forbidding people from filing class action lawsuit, as Axios notes, hides information about the proceedings from the public since affected parties typically attempt to resolve disputes with arbitrators in private. Experts, such as Chicago-Kent College of Law professor Nancy Kim, an online contractor expert, told Axios that changing its terms wouldn’t be enough to protect 23andMe in court.
The company did not publicly reveal the full extent of the breach until around two months after it occurred.
The latest: At least two law firms are pursuing a class action against 23andMe.
Canada-based law firms YLaw and KND Complex Litigation have proposed a class-action lawsuit against the company in the Supreme Court of British Columbia.
Of note: In emails notifying customers of the terms of service change, the company has said people are able to opt out if they email “[email protected]” within 30 days of receiving the notice.
However, the updated terms of service requires customers to email a different address, “[email protected].”
The latter would be an arbitration agreement, and unfortunately I think they're enforceable. They make you sign an contract waiving your rights and agreeing to arbitration.
On May 21, 2018, the United States Supreme Court, in a long-awaited decision, held that employment arbitration agreements with class action waivers requiring individual arbitration are enforceable under the Federal Arbitration Act (the “FAA”), notwithstanding Section 7 of the National Labor Relations Act (the “NLRA”), which protects employees’ rights to engage in concerted activities.
But they might not be. Sure, if I had some case related to this I would get legal advice.
Arbitration agreements are supposed to ensure that disputes are resolved outside of court, and that’s why it’s an irony of almost cosmic proportions that “the enforceability of arbitration agreements is likely ‘the single most litigated contractual issue’ today
The answer, fortunately, is yes, but it is important to keep in mind the most basic characteristic of arbitration agreements - they are contracts. Both Federal and State laws foster a strong policy favoring arbitration, but each provides that the enforceability of agreements requiring arbitration for work-related disputes will be determined by applicable state law regarding contract principles.
The majority of published case law suggests that arbitration agreements are most commonly challenged on the basis that they lack mutuality of contract, lack adequate consideration for the contract, or are unconscionable. These tripping blocks can be avoided by drafting a carefully-worded arbitration agreement and providing employees ample notice and opportunity to review the agreement.
The latter is why 23andMe is giving people the chance to review the new TOS first. It also is probably different for a TOS vs an employment contract.
Except that's not true. Somehow, 23andme missed the almost certainly anomalous activity on thier network that lead to the extraction of 6.9 million users' data. Missing the activity associated with the massive data dump, designing thier system to allow for that? 100% thier fault.
One should not be able to use a set of hacked accounts to dump that much data. That's a design flaw.
As someone in that data breach (not from reused passwords) and of Jewish descent (the seeming target of the hack), I’m going to say it is not blown out of proportion. They previously had no limits on failed login attempts which is pathetic from a security standpoint. They still don’t require 2FA. They say they courage it but it’s not like they bug you about it.
So they failed at multiple points prior to the hack and still fail after. They do have a limit on failed logins now so they have done part off the base level of security.
in order for a ToS to be legally enforcable, the user has to see it. A user cannot give consent on an agreement they did not see, therefor in court it would be 23andMes job to verify that the user was indeed aware of the ToS and acted accordingly. they could not say everyone ops in and defend themselves that way by default because not everyone that was forcibly opted in gave an agreement to the new ToS.
Exactly. There’s a world of difference between “You must agree to the terms to continue use of the service”, displaying the new terms before a user can continue, and just saying “If you don’t reply within 30 days we’re changing the terms of the contract without your input”.
Desperate strategy they’re hoping will fool some of the people some of the time.
Trusting complete strangers with highly personal information is never a good idea. Even if they promise to take good care of it, before or after they’ve already got your money.
IANAL, but I think they should be in a far weaker position with their whole “if you don’t object within 30 days we will consider you to have accepted”. They can’t really argue that no positive action from the other party is construed as acceptance of a new contract. If there was continued use of the service that would be different, but no action cannot reasonably be construed as acceptance.
I think you’re going to be very surprised by how quickly they win any trial when they first impress upon the court, “I know you are, but what am I?” Of course, the judge will primarily be swayed by the moment when they call a customer to the witness stand and then mutter, “guiltypersonsayswhat”
You’d be forgiven for thinking that no judge would rule in favor of a company who, post-damages, tries to build a loophole that ties the hands of users who likely will no longer trust the platform enough to log on. But this is the legal version of a bully giving a triple-w (wet willy and a wedgie) to someone who’s ignoring them and judges think that kind of behavior is super cool. That’s why if you ever ask a judge “what’s that on your robe?” as then flick their nose when they look down, they’ll simply laugh and you’ll be friends forever.
IANAL, but everything I said feels really accurate. ᕕ( ᐛ )ᕗ
That’s exactly how it works, as long as they notify everybody and set a drop dead date on it, usage beyond that point constitutes acceptance. No different than every other passive TOS on the planet.
That’s exactly what they’re trying to do, the point I’m making is it won’t hold up to any scrutiny. You need at least some sort of positive action from the other party to construe agreeing to new terms. Contracts are always two way agreements, in spite of how many consumer facing businesses would like you to believe they dictate the terms.
Not sure about other states, but in my state you can agree to mandatory arbitration for past incidents as long as they don’t do reeeeeally egregious behavior like, eg, slipping a notice into your normal bills and having you “agree” by not objecting within X days.
I admire their dedication, but at the same time strongly disagree with asking people to pay money for a service, that’s fundamentally based on a hole in a reverse engineered protocol. They won’t win this
I wouldn’t mind paying $2 a month for Beeper. I’ve been using it for months to consolidate all of my messaging apps. It’s worth $2 a month for me. Beeper Mini is just iMessage, so I don’t know if it’s worth it for me. They said they’ll eventually move all of the other chat services over to Beeper Mini, at which point it will just be Beeper.
I believe it’s a system that uses an actual Mac as a server for relay. Not really a way for them to stop that, and I doubt they care that much since it requires someone to have a Mac.
They're doing more than riding on apples services for free. They had to build and run a notification relay server to make this work.
Same thing that's been in the news about Apple sharing info with police. The content of the messages are ETE encrypted but notifications of who is talking to who is not
Same thing that’s been in the news about some sharing info with police. The comment of the messages are ete encrypted but notifications of who is talking to who is not
Beeper Mini’s GCM server only handles a “new message waiting” trigger, it doesn’t contain any private data like who the message is from or its contents, just that a new message is available.
If you’d rather not pay the Beeper Cloud service is free and all of the matrix bridges it uses are open source.
The source code behind how Beeper Mini works is available as well but will require a client of some sort to be written since you can’t just use a matrix bridge and a matrix app.
The guy who started Beeper also created the Pebble Watch and they have always maintained open source alternatives for their bridges.
I’m just happy that a company with those ethics is the one to take up this fight against Apple, this could have been a $10/month app from a company who believes in closed source and pushing ads/tracking users’ data.
Beeper is a good company that actually cares about privacy and security and that should be commended.
engadget.com
Active