Private Deleted Messages from 10 years ago have reappeared

fritzelly

https://www.boards.ie/discussion/comment/117718422#Comment_117718422

That the point I'm making - if I deleted it it should have been deleted for you as well

Closest analogy could be email - i know if i delete my emails i know the other party still has the copy but a PM is a different level

batistuta9

https://www.boards.ie/discussion/comment/117718427#Comment_117718427

I know you were but didn't think you would believe it worked like that.

Worked pretty much the same though or like text messages, there's two copies sender & receiver.

Scot_in_Dublin

https://www.boards.ie/discussion/comment/117718419#Comment_117718419

Boards offered the platform. It's not on the companies at all.

fritzelly

https://www.boards.ie/discussion/comment/117718434#Comment_117718434

Where one party has control of the data of the sender and receiver that's exactly how it should work - it doesn't bother me per se as I never shared anything on boards that was in any way personal but I understand how people feel about this on top of everything else since the massive downtime and other "data breaches" and terrible experience, which one on top of the other is just like a volcano waiting to erupt

batistuta9

https://www.boards.ie/discussion/comment/117718440#Comment_117718440

How would boards manage it though?

What do twitter, Facebook, WhatsApp etc. Do with private messages between users & companies?

Scot_in_Dublin

https://www.boards.ie/discussion/comment/117718445#Comment_117718445

Those companies cover that generally in their privacy policies around what could happen with the data you send.

Can I ask you a question? When did you get the email around the change of the privacy policy and about where your Boards data was going to be stored?

shanec1928

https://www.boards.ie/discussion/comment/117718342#Comment_117718342

Could you actually trust them to purge them after all this? I wouldn’t trust them to organise a piss up in a brewery.

circular flexing

https://www.boards.ie/discussion/comment/117718494#Comment_117718494

They are probably purged from the Vanilla DB and boards will restore from the old vBulletin DB for older messages once they sort out the issues with the import.

I am very curious to see how the messages showed up again, unfortunately you have to be a paid subscriber of vBulletin to see the DB schema.

https://www.boards.ie/discussion/comment/117718252#Comment_117718252

It’s because it’s all been done to cover their arses. It was a serious data privacy issue but now there’s no issue and no proof of one, just like that.

CantGetNoSleep

Nothing to see here, it was Vanilla wot done it

johnny_ultimate

People are definitely right to be concerned about the issue, but it’s not reasonable to have thought deleting a PM from your inbox would have deleted it from the other party’s as well. PMs have never worked like that (nor have emails for that matter), and there was never any indication they did. Obviously that’s separate from very legitimate concerns over closed or dormant ‘Talk To’ accounts still storing customer info though :)

Anyway, deleting all pre-30 days ago PMs is a crude nuclear option, but certainly suggests the issue is being taken seriously.

Andrew76

@circular flexing - I am very curious to see how the messages showed up again, unfortunately you have to be a paid subscriber of vBulletin to see the DB schema.

This had me curious too from a technical perspective so I went looking at the API docs on the Vanilla site (https://success.vanillaforums.com/kb/developers) - since the reappearance of the messages was caused by a Vanilla process rather than a vBulletin one. Looks like you have to register to get to see their db models as the Models link (https://docs.vanillaforums.com/developer/framework/models) redirects you back to the overview page which is fair enough.

There's still some interesting information available though - the backend db is MySQL and they do have different environments for code deployment (https://success.vanillaforums.com/kb/articles/60-code-repository) - this was something I had queried back when fixes from boards to Vanilla failed to fix functionality or made things worse - why were these fixes not deployed to a staging branch and tested before being pushed to master (the live version that we all see)? Or if they are tested on a branch before going live (local/develop/staging or whatever) how are they still finding their way to live. Vanilla also have a pricing plan for reviewing code it seems, so maybe that factored into it too. Assuming boards is on an Enterprise plan with Vanilla these environments are available to them. Anyway, I'm not a shareholder in boards.ie so don't expect any answer to that but just find it interesting all the same.

In terms of the reappearing messages - and this is pure guesswork on my part - I'm thinking it's related to how Vanilla treats PM's as part of a 'Conversation' and the logic they used to migrate vBulletin PM's into a Vanilla Conversation (I'm guessing the backend tables & relationships differ also). If I send you a PM on vB and delete my copy, you still have your copy which would contain the receiverId (you) and the senderId (me). Maybe the migration process adds/appends the PM to a conversation record between both participants - so the sender (me) regains access to a message I deleted but you didn't.

What is also interesting is if you go into one of your conversations now and look at the URL - boards.ie/messages/conversationId#Item_x - the data is not specific to your profile. Item_x is a preference to the PM that is now part of a conversation. Change the conversationId to some other number and you'll get a 'Permission Problem' page rather than a 404 - Not Found etc - you don't have access to that conversation (unless you were to be added to it).

Interestingly they show an example SELECT statement to retrieve conversation and related user data (from here https://success.vanillaforums.com/kb/articles/257-database-layer):  

Gdn::sql()

->select('cm.*')  

->select('iu.Name', '', 'InsertName')

  ->from('ConversationMessage cm')

  ->join('Conversation c', 'cm.ConversationID = c.ConversationID')

  ->join('UserConversation uc', 'c.ConversationID = uc.ConversationID and uc.UserID = '.$viewingUserID, 'left')

  ->join('User iu', 'cm.InsertUserID = iu.UserID', 'left')

  ->beginWhereGroup()

  ->where('uc.DateCleared is null')

  ->orWhere('uc.DateCleared <', 'cm.DateInserted', true, false)

  ->endWhereGroup()

  ->where('cm.ConversationID', $conversationID)

  ->orderBy('cm.DateInserted', 'asc')

  ->limit($limit, $offset)

  ->get();

Note the reference to a 'DateCleared' field in the WHERE clause, wonder what that signifies. P.S. Pasting that code directly from their webpage into here or inside a codeblock causes this boards page to freeze, doesn't seem to freeze when copied from a text editor into a quote block (I hope so anyway).

Anyway, complete speculation on my part so I could be totally wrong, I just found it interesting to waste some brain cells thinking about how things might work behind the scenes. 😊

Fr_Dougal

If anyone is having issues or had issues with old PMs reappearing and they were related to to any of the business from the TalkTo forums, contact those companies Data Controller. Most of these companies have a strict policy on where data should reside, and would be horrified to find out that boards.ie have made them non-compliant with their own terms and conditions regarding data.

They will follow up with the Data Commissioner for you. It’s not just the current TalkTo companies that you can contact, you can contact all of them including the archived companies. 

These companies will be very interested to find out that boards.ie moved their customers data outside of the EU.

They can also ensure a “hard deletion “ of your data, something boards.ie don’t really care about.

Muahahaha

https://www.boards.ie/discussion/comment/117718776#Comment_117718776

Anyway, deleting all pre-30 days ago PMs is a crude nuclear option, but certainly suggests the issue is being taken seriously.

I read about all PMs that are over 30 days old are going to be deleted on another forum, is this official? Anyone got a link to when it is happening? What a mess, Im going to have to go through a rake of them now to get information out of them. Theres also going to be tons of users who dont know it is happening and will lose a lot of information.

Gadgetman496

https://www.boards.ie/discussion/comment/117720490#Comment_117720490

Already happened last night.

My understanding is that they have been moved to a secure location (cough) and are not actually deleted & may return in a future migration when the Ice Cream company opens again next week.

Muahahaha

https://www.boards.ie/discussion/comment/117720556#Comment_117720556

ah jayss what a mess. I had read about it on the Fantasy Soccer forum where you have lads organising mini leagues with each other for years using PMs, thats going to be a hell of a lot of information lost and just at the time the new season is starting. What a balls up

Esel

The deletion on the Vanilla site is temporary.

On the old Boards database, the staff will then purge all previously 'deleted' PMs as well as (presumably) all PMs that may still exist on the closed Talk To forums.

When this housekeeping is complete, the remaining PMs will be uploaded to the Vanilla site.

So, you should not lose any PMs which you had not previously deleted from the old site.

This is my understanding anyway. Not sure about any PMs sent/received since the Vanilla site went live last month.

CantGetNoSleep

https://www.boards.ie/discussion/comment/117720634#Comment_117720634

Sounds like quite a complex mission for a group of lads who can't make drop down menus to take on

Muahahaha

https://www.boards.ie/discussion/comment/117720634#Comment_117720634

Cheers for the info Esel and hopefully they do come back soon as Ive a poster to PM in the coming weeks and as of now I cant even remember their username.

It would have been nice/proper management for them to put up a site wide notification before nuking years worth of PMs. At least that way people could have gotten information from them in case the worst happens and they dont return. We get notifications for when the site is down for a few hours in the middle of the night so Im not sure why one wasnt given for deleting years worth of users PMs which is a far more important thing to tell the users about.

https://www.boards.ie/discussion/comment/117721079#Comment_117721079

You don’t warn anyone when you’re getting rid of evidence. I’d hazard a guess they’ll never reappear.

circular flexing

https://www.boards.ie/discussion/comment/117721101#Comment_117721101

No need to go scaremongering like that - the PMs will come back once they figure out the correct way to migrate them back over.

I’ve been banging this drum for a month now. Your personal data is at risk here. Whether it’s your email address being disclosed, deleted PM’s reappearing or the casual disregard for those concerned about the inadequacy of Canadian data protection laws, each and every person SHOULD be up in arms about this.

_Kaiser_

https://www.boards.ie/discussion/comment/117717781#Comment_117717781

Thanks for that......

Quoting a bunch of fancy titles of people you've "escalated" to means nothing especially when those people aren't working evenings or weekends either I presume, and then not even in our time zone.

You've (as with everything else in the last few weeks) offered no explanation for how this happened or how it happened that these PMs weren't actually deleted originally, taken no responsibility (especially as this one is entirely on you and the staff), and yet again it's a random hit and run "update" buried in the middle of a thread that completely fails to address the points raised (and which many impacted users probably won't even see) and as usual fails to engage with the users concerned.

I have no idea about your background or previous experience but it's unfortunately very clear that you have no idea how to run a site like this anyway.

MrMusician18

https://www.boards.ie/discussion/comment/117721325#Comment_117721325

I wouldn't hold my breath. Given that the site has no money and tons of problems and the crude simple solution solves the problem, I'd bet that you won't see these PM's back for months if ever.

In fact I'd bet that if people really need old PMs that they'll only be available on request.

Firblog

https://www.boards.ie/discussion/comment/117718419#Comment_117718419

batistuta9

"That's all on the talk to. companies, they should have been deleting the pms after they were dealt with."

How do you know the talk to companies weren't deleting the pms after a certain time? or didn't delete all the data when they closed their accounts?

Tow

@Boards.ie: Niamh, @Boards.ie: Odhran, @Boards.ie: GDPR

Thank you for removing the previously deleted Private Messages.

Can you confirm:

The messages have been fully deleted.

The Data Protection Commission, and the current and all the former Talk To companies have been informed their customers data has been exposed to an unauthorized 3rd party and exported outside the EU. Particularly Bank of Ireland and AIB?

Can you confirm the countries the data was exported to. The boards.ie address points to servers in America, while company Vanilla appears to be in Canada.

To the previous poster, you can see from the example screen shot I posted that at least Vodafone's reps deleted PM once they (though) they were dealt with. However, I can only assume their 'deleted' PMs were also resurrected.

@boardsiebob

Dyr

https://www.boards.ie/discussion/comment/117717781#Comment_117717781

We are treating this very serously, it's someone elses job to fix it. 🤔

https://www.boards.ie/discussion/comment/117722288#Comment_117722288

They must have money. The talk to prices alone were up there and it's only a forum at the end of the day.

Plenty of free software around and good hosting plans

banie01

https://www.boards.ie/discussion/comment/117724083#Comment_117724083

Just on this point.

Surely @Boards.ie: GDPR @Boards.ie: Niamh @Boards.ie: Odhran have an appointed DPO? Who reviewed the migration process, identified privacy concerns and considerations and advised on their mitigation?

It is a requirement as per article 37.5 of the GDPR. Now it does not have to be a Boards.ie employee, it can be a sub-contractor offering DPO as a service but it is a legal requirement and one that I'd presume Boards HO met?

Or is the rush to lay blame on Vanilla here another one of the pointers to an utterly incompetent migration process?

What did Vanilla's compliance officer say regarding the Boards migration plan and privacy concerns when they reviewed the plan and the DPO concerns from boards for instance?

Other than confirming that Canadian law offered parity with GDPR, what steps did boards and in particular whomever is Boards.ie's DPO take to ensure that all data was compliant with GDPR before any data transfer whatsoever was undertaken to Vanilla?

And post migration, what plan was in place by DPO to ensure continued compliance other than reliance on Vanilla?

banie01

https://www.boards.ie/discussion/comment/117722288#Comment_117722288

If people really need their data? I'd advise the fire in a Subject Access Request requesting all data posted by their account.

Boards(any Data controller) are legally obliged to respond without undue delay, and at most within 1 month. Now there are grounds to extend providing requested data for up to 2 months further but if such a delay is encountered? Boards (or any data controller) must still respond within the initial month to outline the reasons for any delay.

Quite often Subject Access Requests are used by customers to create admin headaches for companies rather than actually access pertinent data. It's not a course I'd advocate and I'm sure Boards will somehow get their shít together and fix their mistakes.