Tell HN: Interviewed with Triplebyte? Your profile is about to become public
Hey [redacted],
I’m excited to announce that we are expanding the reach of your Triplebyte profile. Now, you can use your Triplebyte credentials on and off the platform. Just like LinkedIn, your profile will be publicly accessible with a dedicated URL that you can share anywhere (job applications, LinkedIn, GitHub, etc). When you do well on a Triplebyte assessment, your profile will showcase that achievement (we won’t show your scores publicly). Unlike LinkedIn, we aim to become your digital engineering skills resume — a credential based on actual skills, not pedigree.
The new profiles will be launching publicly in 1 week. This is a great opportunity to update your profile with your latest experience and preferences. You can edit your profile privacy settings to not appear in public search engines at any time.
Our mission is to build an open, valuable, and skills-based credential for all engineers. We believe that allowing Triplebyte engineers to publicly share their profiles and skills-based credentials will accelerate this mission.
Thanks,
Ammon Co-founder & CEO, Triplebyte
604 comments
[ 5.0 ms ] story [ 251 ms ] threadEdit: I missed that there's a privacy setting to make the profiles non-searchable. So, I guess you care enough to complain on the internet, but not enough to even ask if there's a privacy violation? Seems like there's a name for that.
(I’m also baffled by your comment about virtue signaling. I’m publicly stating my opinion, yes, and given the number of upvotes I’m getting there seem to be people who agree with me; but my primary goal is not some sort of social signalling, but to respond to you in order to clarify my stance on the situation.)
Clearly and obviously not the part people are upset about. Cmon mate.
You're not taking on LinkedIn, you're just trying to get a bigger piece of that good ole dark pattern pie.
I do think it's an urgent matter and something that can and will come to bite you later- HN Is how I found out myself and I don't really think right now is the moment to play silly games with people's privacy, and not everybody may keep in touch with Triplebyte after their assessments.
You didn’t launch anything. All you had to do was edit the “1 week” part of your email and you could have sent earlier
Also, are you genuinely surprised by this backlash? Did you really think making people’s info public was going to be a popular decision? It’s hard for me to understand how common sense doesn’t prevail in this situation.
How can we trust triplebite with our career, finance information and personal information when you pull these kinds of moves. Make a good product. If it's actually good people will sign up.
I have made a note of this singular action along with your repeated refusal in this thread to acknowledge the harm you are causing.
People don't want their current employer to know about their job searches, period. There's a difference in magnitude between this and the Ashley Madison leak, but it's the same concept. Having a profile at all is a clear sign to your current employer. It doesn't matter what you were doing with it or when you created the account.
I wonder, what future value will you find by giving away more private information? I know by this example that you won't even wait for the consent of your users before you exploit their private information.
The existence of the job search itself is the issue. I'm not sure what's not getting through about that.
Now if this blows up there is an even bigger target on Ammon's back and he may be panicking. That or he is a scumbag. Could be both.
It’s like explaining to your spouse of 5 years why you have a profile on a dating site that started 3 years ago.
Is that OK with you?
You are totally missing the point. You think the change significantly improves your product, but your users perceive the change as a massive breach of trust. Why? Because the underlying JTBD (job-to-be-done) for a lot of engineers is discreet job searching. IOW, for a lot of people, a public TB profile would be like having a private Ashley Madison profile [0] exposed to the public. Ashley Madison was a major source of embarrassment for many when they suffered a breach.
Rather than double-down, might be time to step back a bit. The aphorism "the market's perception is your reality" is especially instructive.
[0] The Ashley Madison metaphor used by this commenter is especially apt: https://news.ycombinator.com/item?id=23280782
There will be some other time in the future where you’ll have to come back to opt out again.
Deletion of your account will be a soft delete, with the account popping back up again and again like a weed.
The sooner these types run out of VC money the better.
But not this way, not forcing all of your users into a public profile by default and making them provide gvmt ids to delete their accounts. Your users gave you their data for a specific purpose, and you took it and used it totally differently. This seems like a great violation of GDPR BTW.
AFAIK unlike the CCPA, there's no private right of action for the GDPR. That is to say, you can't actually sue the violators yourself, you need to complain to your country's national data protection authority, and they have to take action.
Call them on the phone right now before you make more bad decisions.
Classic non-apology apology. You should not be sorry that he thinks it is awful, you should be sorry that it is awful.
Nobody cares about how much work you put into what amounts to an illegal disclosure of personal data.
>In the politician’s apology, you apologize not for the offense itself, but for the fact that what you did offended someone. “I’m sorry you’re a hypersensitive crybaby.”
"I'm sorry you're an idiot."
Not an apology, an insult, and feigning to be apologizing about you (which is doubly insulting).
They are super interesting given the link, so why try and hide them?
Use your downvotes to hide irrelevant posts, not to display your disagreement. (It won’t really display anything)
Thanks for the entertainment!
People in this thread have carefully laid out the dark patterns you are using to trick your customers into allowing you to try and make more money. This is wildly unethical, and coming to defend it on here shows us clearly that you have not thought about this from any perspective but your own.
Good luck with your company, you’re going to need it.
This just jumped out at me. Doesn't every agreement/TOS document these days say they can unilaterally change the terms at any time and your only recourse is to stop using the service?
I mean, I guess my point is not that it's ok, but that it emphasizes how "agreements" in our society don't seem to be actual agreements and we go around with the certainty that most will never be enforced, but then people don't always agree.
[0]: https://triplebyte.com/candidates/profile_builder
https://triplebyte.com/privacy-center
```
We're processing your request and should be done within 30 days.
We will verify your request using the information associated with your account. Government identification may be required and we may ask you for more information in order to verify your identify.
```
Triplebyte has definitely been the worst experience I have ever had, in fact they are so bad, i would rate them below the other unprofessional recruiters we all come across!
"Under Article 12.3 of the GDPR, you have 30 days to provide information on the action your organization will decide to take on a legitimate erasure request. This timeframe can be extended up to 60 days depending on the complexity of the request"
I deleted my account today and will issue a GDPR request if It doesn't get deleted.
You think it's actually gone while they still have your data. You should do the GDPR request no matter what and hope they're honest in responding to that...
Triplebyte team knew that their users were not going to like it and did their best to slip this through.
Triplebyte went from being a respectable company helping skilled hackers by-pass white-board interviews to being a prime example of unethical tech company in one stroke.
Remember that the premise was that they were non-adversarial, anti-gotcha interviews, whiteboards, nit-picky algo implementations from memory, etc. They purported to do some qualitative analysis instead.
We schedule a session and I get the confirmation: "This is a chance for you to go into more depth, and show us something that you've built. This will not be a high-pressure interview." I get at email the day before our scheduled session that says, "Remember that we're going to talk to you about a project that you've worked on," as agreed.
The following day, just a few hours before our appointment, a founder emails me saying, "Just wanted to give you a quick heads up that rather than walking through a project today, you'll be doing some programming together with an engineer."
They duped me into an adversarial interview. That kinda thing grinds my gears, but I went along with it anyway. I get the response: "We really enjoyed it and thought you did great. We'd love to talk more with you and invite you to a second technical interview."
I opted out as this continued. They acknowledged that they were changing things around without telling people, but it was just so antithetical to the mission that it became disingenuous.
When you pair that attitude of disregard with fact that they're playing sociologists, it's a bad look.
Subject: Triplebyte explained, from coding quiz to job offers
"Hey there, I'm Tyler, one of the engineers here at Triplebyte!"
This hours after opting out, setting privacy options, and deleting account.
Crushing it guys...
A nicely styled resume and showcase should do the trick nicely.
Were people that originally interviewed aware before their interview that their profile would become public at a later date?
Edit: For anyone else struggling to find it, look for the box with the heading "Profile URL". There's a link in the upper right corner of the box that says "Visibility Settings". It's light grey text and kinda hard to notice that's a link.
Just for anyone else, if you're forcing users to opt out of something like this it should be a BIG BUTTON AT THE TOP OF THE PAGE.
Because, in the "Visibility" link in the profile builder says: Your public profile will be invisible and will not appear in public search engines. This simplified version of your Triplebyte profile showcases your technical achievements based on actual skills, not pedigree (it does not contain your score details, job status, or preferences). Turn your visibility “ON” in order to share your unique Triplebyte profile URL on job applications, LinkedIn, GitHub, and other platforms.
However, "Learn More" says the URL will be inaccessible when not Public. So, which is it?
FWIW, I agree with other commenters that this is a betrayal of trust but I don’t have anything original to add.
I think you’re missing/avoiding the issue that people might want to hide the very fact that they have a Triplebyte account at all. It implies that they have job hunted in the last 5 or so years, and someone who’s been at a single company for longer than that might not want that information to be available.
I work at Google, and I can tell you as a fact that our Privacy Working Groups would never let us launch something like this without explicit user consent.
Absolutely.
Google+ became really nice towards the end, but HN kept hating it, and I guess partly because of Buzz.
> Google Buzz publicly disclosed (on the user's Google profile) a list of the names of Gmail contacts that the user has most frequently emailed or chatted with.
Google Buzz is something you definitely don't want to be similar to.
Here’s an old article about it: https://money.cnn.com/2012/01/26/technology/google_privacy/i...
I suspect TripleByte is about to learn some similar lessons.
I have had a really positive experience with Triplebyte so far but hope your team can understand the root of what is bothering people about this decision.
Why not just say "We think we'll make more money by sharing private information our users trusted us with, without their consent." Then at least I think you'd get points for candor and honesty. As is, no points for either and everyone reading knows what you mean.
By the way, is it true you require a government id to delete your account? If so, why?
Outing people who trusted you to help them find a better job in secret will go very badly for you.
I predict lawsuits.
When a user creates a profile on Stack Overflow or Hacker News, they are consenting to share whatever data they give on that particular platform.
When a user created a profile on Triplebyte, up until now, they were consenting to that data being used in a private profile for the purpose of connecting them with job opportunities, privately. Now, you've emailed all of your users on a Friday evening to say "by the way, if you don't opt-out in the next week, we will take this data that you gave to us under the assumption that it would be private, and make it public (and potentially searchable)."
By saying "we'll do it unless you say no", you are not getting consent.
If you're familiar with the tea analogy of consent, a la https://www.youtube.com/watch?v=oQbei5JGiT8, this would be like you saying "well, other users (not necessarily every user, or you, the user in question right now) have had tea (not necessarily the same type of tea) from other platforms. This is just like that. So, if you don't say no to our tea in the next week, we're going to drop the tea on you. We hope you enjoy!"
You are not just "launching public profiles for a product that has not had them in the past", you are launching public profiles and on them you are _sharing data that was given to you under the agreement that it was private_. You are using data that folks gave you in a very, very different way than for the purpose they gave it.
Finally, just to really drive this home, you say "What we've focused on to keep that from harming anyone is what data we include in the profiles."
And, what data is that? What personal data, given under the agreement that it would stay private, won't harm someone if made public?
Full (presumably legal, or at least professional) name, coupled with profile picture (presumably a clear photo of their face) and, I'm guessing, also the locations they said they were looking for a job in? Although, fine, in most cases sharing that data is mainly annoying and trust-breaching, that combination of information can be devastating if leaked. Consider a person who has escaped an abusive ex-partner, and has managed to keep private about what new city they've moved to, now popping up in a Google search for their name that has their picture and the fact that they're looking for a job in Los Angeles. This person probably isn't your core user-base, but stories like this are real, they happen, and if you get enough users, they will be among your real life user stories. You have to consider user stories like this when you are trusted with personal information.
This ain't it.
Tripebyte is fundamentally different and dangerous there.
It make no difference whether you're sorry that people feel that way. It's the wrong thing to do - you're going to hurt people doing this.
It make no difference that it's a fantastic opportunity for you and Tripebyte. It's not what you told people when they signed up and entrusted you their names and jobseeking. It's the wrong thing to do - and only lawyers are going to end up benefiting.
But well, I guess you aren't apologetic, are you Ammon. I think you just think these bunch of twits are ruining your plans to make money, and now you have to go and deal with them..
How about an "I'm sorry I..."
Take responsibility for your own actions.
Come on now, these examples are not even remotely similar to what you are doing here.
Firstly, it's up to me whether or not I even create a profile on those sites.
Secondly, if I choose to create a profile, I have full control over what is shown publicly.
What you are doing here is making information public whether I like it or not. This is not OK, and you trying to defend it here is mind boggling, and demonstrates clearly what little regards you have for privacy. I for one will now never have anything to do with TripleByte.
I disagree. HR reports to the CEO, just like everyone else. If the CEO tolerates HR (or any department of the company) being dishonorable, the entire company is dishonorable.
This seems so obviously disingenuous to me. You know why Triplebyte is different, right? You understand why employees would want to keep the fact that they have a Triplebyte account secret instead of public, right?
If you do know that answer, then you should recognize that you're betraying the trust you created with the user. If you do know why Triplebyte is different, then you're lying to us here.
If you do not know why Triplebyte is different why on earth are you the CEO of a recruiting company. That's absolutely unforgivable.
This one sentence gives away that you're either lying to us or willfully ignorant and careless about your users. Either way, I'll never trust you again.
You are making a huge mistake and going to drive your company to ruins. Change it now.
The roll out of this needs to be handled better, with extra care given to privacy settings, and verbiage on the profiles.
For example, Triplebyte has the following language - ‘I am currently open to new opportunities’, heh, yeah, please, show that on my public profile while I have an existing job.
A robust technical assessment site focused on tech is good, especially if it is nuanced in assessing people (not hard cut offs, finding strengths and weaknesses on a spectrum, etc), but please, take good care of privacy and clear communication.
Asking as someone who has been on the platform for a while but has not found any success through it. I have other thoughts but would like to hear your plans before adding.
There's no doubt a lot of truth there.
What matters a lot to engineering managers are the answers to questions like "What other roles is this candidate interviewing for?" "How well did this candidate do in their Triplebyte interviews for our competitors?" "What are the salary ranges of other roles this candidate has clicked on or applied for?"
Will that also form part of every user's public profile, with the same "1 week to opt out, 30 days to enable opt out" process? Or will that data only be available to hiring managers with Triplebyte Premium accounts?
But it really is a shame that from this incident, myself and many others will no longer be willing to trust you and your team with the data needed to execute on these ideas.
At the end of the day, we entrusted you with extremely sensitive data in order to use your service that could threaten our very livelihoods if exposed. Your choosing to expose this data without explicit opt-in shows an alarming lack of empathy for your users and that you were never deserving of this trust.
Corporations don't get to choose, either laws apply or they don't apply internationally.
How long before we all get an apology email, "Upon careful reconsideration...", 72 hours?
God damn corporate spin pretending nothing bad ever happens..
Extremely foolish and really shines a bad light on your decision making capabilities. Why would I put my trust in a company that is so shady?
You will change this bad decision and apologize, but you have betrayed the trust of all the people who have used you. Even if you change your policy now, we know you will change it back in the near future. No one will use your services again, because of this betrayal. You just killed your entire company in one fell swoop.
I’m shocked that someone associated with YC could make such a demonstrably poor decision.
This is the company in question, I'm not sure if there's an online repository for all the ridiculous drama and bad decisions though.
FWIW, I hadn't heard of TripleByte before, but this is not a good way of hearing about it, nor would it encourage me to become a user, if people's fears match what you're actually planning to do. If they're correct, it sounds like you're about to intentionally or accidentally implement a dark pattern. I hope that's not the case.
Now I absolutely would not. Dead simple.
1) There is no lock in - I can move on and off LI whenever I want, and have. I've exported my data and used it to create my own resume site with analytics that I send out to companies. I can see who viewed my CV, when, and whether or not they actually read through it or bounced immediately.
I've also learned to track the progression of my candidacy through the organization using this trick (recruiters tend to view my CV on their Windows desktop during work hours, hiring managers tend to check out resumes in the evening on their iPhones or Macbooks, engineers/tech leads tend to use Macbooks, desktop Macs or Android phones in the morning or during lunch time. Usually when I've hit the engineering lead I tend to get invited to interview).
It's extremely easy to create your own CV website for free (github/lab pages) that's versioned by git and deployed automatically using a CI script.
2) You're attacking the tech hiring problem from the wrong angle, like everyone else. There is no issue with discovery of candidates and employers. LI and stackoverflow, etc do a great job of approximating this O(N^2) exposure process, the filtering and sifting. The ACTUAL problem is on the hiring end - companies won't take a chance on non-traditional candidates (not talking about race and gender here, more about credentials).
You have to start by chipping away at the costs of showing competence for a candidate (the traditional way to do this is to get a three- or four-year degree that's either expensive in terms of time and money, or useless, and if you get a degree with a low score, doubly so, even though you might be a better programmer than the people who scored over 90%).
This will only happen by convincing hiring orgs to hire non-traditional candidates, and this requires establishing a very strong signal/noise ratio for candidates coming from your hiring channel. Before you start PRing me about how great TB is at this - no it isn't. Not any better than leetcode etc, and those are terrible at predicting engineering competence.
I'd be super interested to learn more about how you did that.
Any information provided without a clear understanding that it would be made public should not now be made public by default, even if it is just a name and some badges.
Well, I was just about to go through your process, since you announced that you are opening to remotes (I'm in the EU), but now I've requested that you delete my profile. No way I want my current employer to know I'm looking, especially in the current climate where job hunting is difficult.
As other people have mentioned, you now have a deeper problem than entering a new market. You just broke your users trust.
And the sad thing is that this was a real opportunity, because linkedin sucks. Unfortunately what you failed to realise is that there is appetite to switch from linkedin to a more honourable company. Not to an equally or more dishonest one.
Most likely your staff were trying to warn you about this from the beginning, and it would be worth your time reflecting on why you didn't take note of that more deeply.
I know you are looking for actionable routes to save your company right now. In my opinion, the loss of trust is so bad that only a pretty costly signal will now cause people to reevaluate. The one that springs to mind is for you, Ammon, to announce that you are stepping down as CEO and starting a search for someone who is committed to privacy to take on the role.
If you gave me the option to make one, we could talk. But by making that decision for me, I now have to view you as a fundamentally un-trustworthy party.
Keep in mind that Triplebyte profiles have no reason to exist except people looking for work, and that most people have a reason to want to be sure that a current employer does not have an easy way to find out that they're looking for work. I can have a HN account and it doesn't make anyone think I'm looking for work, but if an employer sees my profile on Triplebyte, it tells them at the very least that I was at some point looking for work. If they see it on Triplebyte after having previously not seen it, it tells them that something changed recently.
I would definitely think this should be an opt-in thing.
So that's your bar, a growth-hacking dumpster fire?
>"LinkedIn profiles have become the default engineering resume (despite the fact that most engineers are not particularly happy with their LinkedIn profile)."
No they haven't. You know what the default engineering resume is? The one you have on your hard drive that you share at your discretion.
I'm quite surprised at how oblivious you seem to be of the issue of user trust.
Here is that problem: people gave you their data because you told them that you would make it available to companies that were NOT our current employers or the general public. None of us agreed to let you post the fact that we were actively seeking employment.
You betrayed our trust and are using data none of us agreed you could use in the way you are using it.
From today onward Triplebyte has established its place in the lexicon as a ghetto self-serving linkedin wannabe. Good job.
https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
This struck me as incredibly unnatural, since I frequently comment and very rarely upvote an article. I don't really see what the one metric has to do with the other.
But apparently everyone else has a different model of HN in mind.
To be fair they sent an email to everyone who had signed up; I received the same email.
Email is what I use to notify my customers of a 25% sale, not to tell them that I'm going to plaster their data all over the internet in violation of the spirit of the service I'm providing. I use regular mail for that.
It’s like saying “Your Tinder profile will NOT contain any data/details about you or your dating search that will undermine you in your current relationship.”
Another way to look at it: either you're a replaceable cog, or you're essential to running the business. If you're essential, they're going to do whatever they can to keep you. If you're replaceable, they probably don't care that much whether you in particular stay or go, but it will certainly cost money to replace you, which they'd rather avoid spending.
Only a completely irrational company would cut someone loose just because an online profile with that person's name on it appeared somewhere.
The Tinder analogy is imperfect because of that, but it's still a good illustration of how just the existence of a profile can destroy your plausible deniability.
It definitely is.
Time frame is also very important. Example, a user has been with the company for over a decade, but the product has only been around for a few years. Or if one of the "achievements" was a test that was added recently.
But what if you didn't have one yesterday, but you do have one today? What if you have only worked for one employer since TripleByte was founded (2015)? What if the only place you've worked is a startup of which you're a cofounder?
If you can't think of a way in which a privacy leak can have consequences, that doesn't mean there aren't any.
Is there another big use case that I'm missing from their product? Interested in hearing your interpretation of a person that has a profile on an interviewing service. My assumption would be the main objective of a user signing up for a service would be using the main product the service provides.
Nonetheless, I don’t find very much wrong with what they do, in general, or what they’ve done here. Do you think because I have a dissenting opinion, I must necessarily be some kind of shill. Come out and say it, if so.
In the sense of a likely reason for someone to draw an inference: Most people do not specifically seek out excuses to take tests, and do so only because they want something that the test provides them with, such as access to a job-hunting platform. Most people who want access to a job-hunting platform want it because they are job-hunting or plan to be soon.
I'm guessing it's because their corporate metrics took a dive due to covid hiring slowdowns and now they need to justify their worth to investors who have put in $50 million.
I saw your email in my inbox but didn't read it. I never would've noticed with improved screenshots or not. Do you read every email you get?
What this means in practice is you can't default anything containing personal info to being public by default.
"In particular, such measures shall ensure that by default personal data are not made accessible without the individual’s intervention to an indefinite number of natural persons."
You are literally taking private data and making it public without consent.
I would suggest you step away from any scripts and turn on the company ears. Simply explaining what is going on more “clear” and repeating it more often probably won’t get you anywhere good.
Why does this make your users uncomfortable? How can you work with them to achieve your product goals without undermining your relationship with them?
Good luck!
Literally just make it opt-in.
Triplebyte as founded isn't working so they're trying to take a valuable asset they have (engineers looking for jobs) to compete with linkedin
The problem with bootstrapping a linkedin competitor is the same chicken-and-egg problem with networks generally. You need people on it for people to join it.
What Triplebyte wants is your identity public. That's the product goal. The problem is that opt-in won't get them that. What are the incentives for anyone to make theirs public?
How many people who were searching for a job without telling their company are going to opt-in to make that public?
Most certainly not enough to bootstrap a LinkedIn competitor.
So someone had the idea to move fast and break things, either:
a) hoping no one would notice
b) hoping the fallout wouldn't be bad
c) not caring that the fallout would be bad
d) not knowing that there would be fallout
none of the above are particularly inspiring. It does seem hard to miss this coming
I think that's the real issue: timing. The only time this can work is when someone has just resigned or joined a new company, so they can (and are actually willing to) "legitimately" pump up the volume about themselves.
So make it an easy opt-in triggered by these events. Any triplebyte candidate that "closes the deal" should get opted-in automatically. Anybody without an ongoing work relationship, should get opted-in automatically. Everyone else, you hold fire until something significant happens publicly, at which point you gently prod them. You can even ask, when someone signals they are looking for a job, "do you want your profile public at this time? It's a pretty cool thing! If not, no biggie, we'll ask again once things change."
It's not rocket science to do this respectfully and it's sad that they didn't.
Am I misunderstanding you? If you "get opted in automatically", then it's no longer opt-in; it's opt-out.
If they made the initial launch opt-in then that signals that the user deliberately chose to advertise that to the world. The message a current employer gets out of something that's opt-in instead of opt-out is notably different. This is just like the whole opt-out fiasco with the Do Not Track header. If it's opt-out, the signal is largely meaningless. In this case that's a benefit.
None of the users care. Just because something is convenient, doesn't mean it's right.
On that note, I wish one day we'll stop letting startups get away with dishonest behavior (e.g. astroturfing) and dark patterns done for the sake of "solving the chicken-and-egg problem". Building a network is hard, tough shit. Doesn't mean you should build your company on lies and disrespectful treatment of your users from the start.
I own my own business. I'm not looking for a job. Unless something goes really horribly wrong, I won't be looking for a job in 24 months, or ever. Having my profile public doesn't add to the signal on their platform, it adds to the noise. Having my profile public is a waste of time for me, them, and employers looking for someone with my skills.
I've learned this lesson personally. Trying to be "clear" about my own perspective while ignoring what the other person feels.
"You don't like what you see? Impossible, you just can't see it. Let me make you see!"
Me: Thing You: I hate that thing Me: You don’t understand Thing. Here’s Thing explained. You: I understand Thing, I still hate it. Me: You don’t understand Thing. When you understand it, you’ll like it. (Repeat)
Sometimes this is stupidity thinking that understanding is missing, but I think it’s usually shady just so they have something to say to counter the objection that is visible to people outside the conversation, who are interested, and at least see some form of technical interaction.
The technique seems super common now, and I’ve been expecting to run into it in some communications training, but haven’t yet.
I feel like there’s some crisis PR tactics this fits into that involves “Never disagree, redirect and ignore.” It diffuses criticism and makes it hard to argue.
It seems related to when I see a complaint on a review site that’s been responded to with “I’m the manager, please call me.” It doesn’t resolve the issue, but it shows that someone is doing something, so it diffuses pile on because it stops complaints of ignoring customers.
I could explain more but honestly James Clear has done a far better job here: https://jamesclear.com/why-facts-dont-change-minds
I have absolutely no interest in helping companies who pull shit like this recover from their PR disasters. If you do something like this, you deserve all the bad press you get.
From TripleByte’s perspective it is a PR disaster, or at least we should treat it as such. Appealing to TripleByte’s internal moral compass is unlikely to succeed since they’ve demonstrated that they don’t have one. So we resort to appealing to their self-interest, since that is something they care about.
But whether these particular business people have a moral compass or not is irrelevant to whether we should be discussing this as a moral or strategic mistake:
1. If they have a moral compass, then the strategic mistake pales in comparison to the ethical mistake, and they'll get that. We should be encouraging people to listen to their conscience, not teaching them to equate their conscience with selfishness.
2. If they don't have a moral compass, then we shouldn't even be talking to them, we should be talking to each other about how we dis-empower them and remove them from positions where they can do harm. Even if we persuade a narcissist or sociopath that it's in their best interest to do the right thing in one situation, they'll just be presented with a new situation where they think it's not in their best interest to do the right thing. If they really are just bad people, they should be treated as the blight on society that they are.
I’m not going to pronounce any absolute judgment or certainty about this, but I think it’s a serious possibility for us to consider.
> If they don't have a moral compass, then we shouldn't even be talking to them, we should be talking to each other about how we dis-empower them and remove them from positions where they can do harm.
I won’t ever use TripleByte again; will you?
> Even if we persuade a narcissist or sociopath that it's in their best interest to do the right thing in one situation, they'll just be presented with a new situation where they think it's not in their best interest to do the right thing.
I never accused anyone of being a narcissist or sociopath. Those are relatively extreme conditions. I’m simply describing people who have bad intrinsic moral character. And the world is filled with these people. As a society, we elicit good behavior out of these people by creating and applying incentives. It turns out that PR is one such incentive. Laws are another.
Note that you are opening yourself up to major legal and financial liabilities, besides the obvious personal ramifications, ie: you're on the record as a sleaze unless you handle this with velvet gloves from here on in.
https://en.wikipedia.org/wiki/General_Data_Protection_Regula...
I hope (for your sake) that you don't have any users that can invoke their GDPR rights against you by virtue of their citizenship.
For the sake of incentivising companies to do the right thing, however, I hope you do have some EU or UK citizen users who do litigate or have their data protection authority investigate and formally punish Triplebyte, even if only to establish clear precedent here for the future.
Article 18 restriction of processing can apply here. Art. 25 "Data protection by design and by default" would seem to be relevant as well. The section I alluded to above is the latter half of 25(2), saying "In particular, such measures shall ensure that by default personal data are not made accessible without the individual’s intervention to an indefinite number of natural persons."
There's also the question of whether their consent or other grounds of processing suffice, which likely wouldn't for making anything public, but Article 25 makes it clear enough anyway this is illegal.
A European visiting the US and interacting with an American business does so under the protection of US law, not EU law. This is complicated in the case of Facebook and google because they also do business in Europe, so European courts can fine their European branch offices. But Triplebyte has no such EU presence that the European courts could pursue. And they don’t advertise European jobs. I suspect an EU citizen interacts with triplebyte legally the same way they would if they went to a cafe in SF while on vacation.
The opposite would be crazy. If triplebyte can be fined by the EU, that would also mean the government of Australia or China or Russia could arbitrarily levy fines against any US company if one of their citizens interacted with a US website one time. And everyone would put geo blocks on their websites to protect from liability.
GDPR is very clear in wording that it doesn’t matter whether company has offices in EU or not, only thing that matters is if company is providing services to EU citizens.
Of course there is a question about how you could enforce such a ruling. And if it can't be enforced, is it really a sanction? I guess if countries wanted to take this really seriously, they could get a list of company officers and put immigration flags on those individuals, and hold them temporarily upon trying to enter that country, until the matter was resolved. But that would be rather extreme, and you do raise some good points around which countries can fine the companies of other countries.
CCPA from California seems to have some cross-border implications as well - perhaps we will finally see a framework for privacy laws that works better than today's hotch-potch?
https://www.hipaajournal.com/does-gdpr-apply-to-eu-citizens-... seems to suggest it is based on location. There would seem to be standing for anyone based in Europe that made an account when considering a move to the US, or who is based in Europe next Friday when the "data processing operation" occurs. That seems like it would give them standing, even if they weren't protected while overseas, as this is a new data processing operation.
If your new service is of true benefit, it will be used.
Are you arguing for this change? Whatever the argument is seems to be based on misinterpreting 'private' as 'known by no-one else'. Exactly the same argument could apply to e-mail: it's not private in the sense that no-one else sees it, just hidden from the majority of the world; presumably, when you sent it, you were advertising what it said to the recipient.
And I know the e-mail says that results will only be shared if you did well. But, if you have a profile on TribleByte and there's no signal on your profile that you did well, the only logical conclusion is that you did not do well.
I'll be deleting my account, anyways. I didn't ask for this.
Edit: To be fair in their survey i think i said something like this sounded good, but it was phrased as "be part of an exclusive club of competent engineers" rather than "show current employer you're interviewing because you clicked on a banner add. And my whiteboard code had a bug.
You may wish to consult your privacy attorneys; you'll likely be the subject of a number of GDPR complaints considering the above.
My interpretation of the above if you were to do it within the letter of the law (again, talk to your attorneys; I'm just a security director):
1. opt-in via settings page (or a modal on next login) for all people who already have accounts.
2. opt-in during registration for all people who choose to register accounts after the roll-over date.
Again, talk to your attorneys. If you successfully roll over without having taken the suggestion to talk to your attorneys, your conversation with your attorneys may change from "how to best implement this" to "how to avoid getting fined."
I've seen some epic CEO fuckups but this one is special.
There isn't a spin you're going to be able to put on this that's going to change that what you're doing here is diametrically opposed to my goals. You knew that, which is why you tried to sneak it past everyone.
The problem isn't that people think what you're doing is unethical. The problem is that what you are doing actually is unethical.
In order for this to hold, there would have to be objective ethical claims which were independent of what people thought about ethics.
> Your public profile includes any badges you've earned, your basic info (current job title and company, current location, and years of experience), and the tech experience & resume section.
This information can very easily be used to identify a person, especially at smaller companies.
> ... to provide us the canvas to release badges. That’s it.
So before you were taking on LinkedIn, but now it’s just a place to release badges?
[0] https://triplebyte.zendesk.com/hc/en-us/articles/36004382061...
Thankfully I felt "odd" when I signed up for your "interview" test and never fully finished it.
Also, you single handedly brought me out of hiatus from commenting on HN.
What you have done with this decision is a friggin stab in the gut. If you think your foolish "it's only X we are making public! Not Y!" means something other than "oops, we got caught, how do we cover this up?!" then you are deluding yourself.
Did they purposefully go out of the way to make this email address unguessable/non-standard/multi-word
Source: Candidate, has a very specific marketing meaning, of you being the product.
I’ve worked at 3 different companies in the hiring space across two continents and “candidate” is the internal term they all ended up using internally for people seeking jobs. “Applicant” is too vague and “job seeker” is long and hard to scan (and it’s too similar at a glance to “job”, which is also not often used).
If “candidate” has bad connotations for you, I’d love to hear a better suggestion. But I still haven’t seen a more appropriate name for my database table.
Company / candidate / role / resume / profile / interview / offer. These are the terms almost everyone uses.
(Of course, the candidate also receives value because presumably they are looking for a job and get one in this transaction. But the whole "you are the product" trope always ignores the fact that the "product" person is receiving value in the transaction).
I clicked privacy center, ( https://triplebyte.com/privacy-center ), couldn't find the option, but chose 'Opt out of Personal Information Sharing' because why not?
After clicking the button I had to click a confirmation email to get this approved. Then it said it would happen within 30 days and I may be required to show govt ID.
Why? I am already verified with my login account. It is not like I am doing something sensitive like changing a password or email. And what is this about needing to show govt id? They have zero reason to need govt ID to opt out of 'Personal Information Sharing' of all things.
Honestly tempted to just delete my profile. (That may also require govt ID.)
NightlyDev going straight for the jugular here. I cannot deny the effectiveness of this strategy lol
No government ID required.
After this announcement, though, I’m afraid that faith has completely crumbled. Even if Ammon had showed up in this thread and immediately announced that this was a terrible idea and they were rolling it back immediately, the mere fact that they were considering doing this is a huge blow. It doesn’t help that I skimmed the email when I got it this afternoon and didn’t even realize it was an opt-out; it was only when I saw this thread that I took a closer look and realized that the email was lacking a CTA button at the bottom for a reason. That seems incredibly shady to me and instantly changed my impression of the company.
Take heed, other companies: it only takes an instant to destroy your company’s reputation, and it’s incredibly difficult to win back that confidence.
Not really. Given that nobody on here has identified the underlying problem, and are happy to blame everything on Triplebyte ... it just goes to show how nothing is going to change anytime soon.
Confidence in using this, and other services, will only grow.
Q: where did these expectations of privacy come from ?
There was never any indication our involvement with the company was going to be made completely public.
Identifiers, third parties. “ Companies that use our services to be matched with job candidates. Candidate profiles created by our users are accessible to the public. “
https://triplebyte.com/privacy
An entire generation (across all age ranges) has willingly thrown out personal liberty in favour of convenience ... and now the surprise when that turns around to bite.
Honestly, what did you expect ?
I’m not even sure what your argument is here; are you saying that because “an entire generation across age ranges” (whatever that means) collectively did... something... now companies can indiscriminately trample on everyone’s privacy forevermore, and nobody’s allowed to try to reverse the situation?
Im just saying - I think its amazing that _anybody_ trusts any of these Silicon Valley organisations to do anything reasonable. They are convenient to use, sure ... but ever trusting them to put your interests above their own. I dont understand how people can believe that.
If you hand over info and put in on their servers .. you dont own that info at all. They can, and will, do whatever they want with it to make another $
Your original post is poorly worded at best to get your point across; it comes off as a victim-blaming status-quo-advocating cheap quip, which doesn’t add anything to the conversation, either about this particular instance or the general problem.
Apparently deletion requires ID or something. Um... thats less good. I vaguely understand why if it was needed to sign up. [addendum: nope!]
Suggest you think carefully about your next step if you have an account. Maybe gibberish your account to whatever extent you see fit, update the email address somewhere less identifying (perhaps sneakemail) and go on with your life. Assume all details will be sold (you mean you didn't already?!)
I think they are out of touch with their userbase. Or they have even more plans their userbase won't like.
Addendum:
There's an option to control public visibility. Opt-out but this is only partial details. I would not rely on that "partial" aspect.
Worse still: if you want to "not be contactable for new opportunities" that only lasts for 24 months at max. You can't select a "not wanting offers at all". Minimum is 1 month.
This means you could be inadvertantly outed as "looking for opportinities" without even knowing it.
Nope! Triplebyte flew me across the country, put me up in a hotel, and otherwise arranged a job for me with nothing more than my email address and a phone number. The first time I had to provide ID in the entire process was when I filled out the I-9 form on my first day at the company that had hired me.
I've got around 150 messages and more within last few hours of our little group - all very unhappy. The irc server #rant channel is getting loud.
Edit: 150 and growing (growling?).
This is abusive and evil.
Anyone have ideas on how to figure that out without accidentally registering and exacerbating the problem?
which means you might be able to find it there, other than that maybe try 'forgot password' usually my go to solution.
Ah yes, the classic "send us more of your PII to delete your information." I've ran into that too many times.
This is not lawful under both the GDPR and the CCPA. If Triplebyte follow through with their request against an EU or California resident, they'd be breaking data protection laws.
If comments here are any indication, too many people, being unaware of their rights, may fall for it though.
IANAL, but they may already be in violation of the GDPR with the 30 days processing time. While the GDPR states 30 days as the upper bound, the article about erasure also states:
The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies [...]
Notice the phrase undue delay. It seems that the legal interpretation of undue delay is as soon as possible [2]. Since the sign-up for Triplebyte seems to be immediate (you just create an account), they could also remove an account with a simple delete account button (remove some rows from a SQL database). So in the case of most web services as soon as possible seems to be with the click of a button to delete an account itself. Allowing a few more days for changes to propagate through storage systems and backups.
For anything longer, they should probably come up with damn good reasons when this is brought to court.
At any rate, they will have more serious problems if they make citizens public for people in the EU. They'll open up themselves to a huge liability. You are simply not allowed to use data for other purposes than what the data subject gave explicit well-informed consent for. And no, burying somethings in the terms and conditions is not explicit consent.
[1] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
[2] https://www.linkedin.com/pulse/term-without-undue-delay-cont...
INAL, but from my understanding that's exactly what GDPR itself suggests to do:
> The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers.
Thats mainly because [2]:
> There is a very real concern of fraudulent requests from bad actors, who might use a customer’s data for nefarious purposes.
While it's great to know that noone else is able to delete my account, it still feels shady af.
[1] https://eur-lex.europa.eu/eli/reg/2016/679/oj#d1e1374-1-1
[2] https://konfirmi.com/blog/gdpr-personal-data-id-verification...
Article 4(b) actually states that to verify you you (for a data delete request), they must do their best to use info they already have on you, and "Avoid collecting the types of personal information identified in Civil Code section 1798.81.5, subdivision (d)"
and in 1798.81.5,(d)(1)(A)(ii) we see: "Driver’s license number"
4(c) also helps: "A business shall generally avoid requesting additional information from the consumer for purposes of verification."
So if they can verify you another way, they must, and cannot ask for the DL (likely the only ID many people have)!, if i read that correctly
So instead of jumping through their hoops, file a CCPA request and have them chew on that.
1. Triplebyte knew this would cause some outrage, especially on HN and Reddit. 2. Triplebyte did some calculations and predicted that doing this on a Friday and only giving people a week to opt-out would result in the fewest number of opt-outs. 3. Triplebyte assumed that many of those outraged online would delete their accounts. 4. Despite all of the above, Triplebyte calculated that this move would make them more money in the long run.
I’m also guessing that these profiles will serve ads. I bet Triplebyte will offer “premium” plans for both job seekers and employers so that they can directly contact you more easily.
I hope this change incorporates necessary privacy measures for job seekers. I hope that this doesn’t become a 1-to-1 LinkedIn competitor that only seeks to get clicks and ad revenue. Only time will tell. I’m very skeptical but I won’t rage yet. I’ll opt out for now and see how it goes...
Was it Friday of a three-day weekend? That's one of the best news dump days of the year.
[1]: https://i.imgur.com/0J4sVlX.png
> Welcome to Triplebyte
> As part of this exclusive network of engineers:
> - Companies reach out to you
> - You control what companies see
> - Your profile is private
> Now, let’s take a look at your new dashboard.
> [Next]