Thread

1. overgard · 1785947861 · focus · HN ↗

   I'm mostly going off the tweet, it could be I just don't understand, but how do you managed shared data if everyone has their own copy of the code and they can add whatever features they want? I mean, I'm assuming that any sort of significant feature requires some sort of change to the data model, and even with a schema-less database you could have conflicts if two things use the same field name, for instance? Also what happens with updates? Like, part of IT is keeping people up to date, but if everyone has their own bespoke customizations how do you not clobber those?

   Also the security story doesn't completely add up to me. Like, if I'm a user and I can just add features that I want, what's to stop me from placing data in there that's maybe covered under HIPPA or some other sensitive data (protected class, or even just stuff like authentication information)? Right now a small number of people need to think about data security, but this seems like it'd extend it to anyone? That kind of data, it's not just about "keeping it internal by default", there are a lot of rules around storing it at all.

   I dunno, it kind of makes me think of when people suggest forking an open source project if the maintainers won't accept a suggestion. Sure, you can do that, and it does happen, but you're also basically signing up to maintain it for decades. I'm not sure if anyone wants to maintain Alice in accounting's very weird spreadsheet app 10 years after she's left the company?

   (Again I'm not throwing shade, just trying to understand better)

   1. kentonv · 1785951892 · focus · HN ↗

      The key is the fine-grained instances (gadgets).

      E.g. if you're using a slide editor app, each slide deck you create is its own instance of the app, whose code can be independently modified.

      The slide content and the code are kept together and sandboxed together.

      Adding HIPPA data to the app is no different to adding it to the slide content. I suppose whether or not that is OK depends on a lot of things, but the same things apply to traditional PowerPoint. The fact that the code is modifiable doesn't change the situation, since those modifications are sandboxed and constrained to that one slide deck.

      1. heybales · 1786010599 · focus · HN ↗

         I hope there are no healthcare CEOs reading this and if there are, please, for the love of god, do not let your execs or providers use cloud platforms to create apps with HIPAA data in them unless your lawyer is really bored and you have cash to burn on all the fines and lawsuits. Also don't offload yet another responsibility (i.e software development) to the people trying to take care of patients.

         1. kentonv · 1786022186 · focus · HN ↗

            You can self-host using workerd.

            But I'm certainly not claiming that this alone is sufficient to comply with regulations. I have no idea.

Unofficial Hacker News client; not affiliated with Y Combinator.