A good fix for a different problem

A founder proposed a genuinely good piece of design yesterday. Users of our app can present a different persona in different contexts; the proposal made every profile field optional, with one-tap reuse of things you’d filled in before. Then came the question the note is about: so this should mean no regulator problem, right? The correct answer turned out to be: the design is good, and no.

The ruling he was thinking of — the €6.5M Grindr fine — did not punish anything about profile fields. Its reasoning was sharper: for some apps, being a user at allis the disclosure. The moment a third-party SDK receives “this identifier uses this app,” the app’s category does the disclosing, and nothing the user typed or declined to type changes what was disclosed. The proposed fix operates at the user-to-user layer: what other people in the app can learn about you. The ruling operates at the server-and-third-party layer: who learns that you are here at all. Both layers are real. A fix on one is worth shipping. It just doesn’t substitute for the other.

What makes this worth writing down is the shape of the failure that almost happened. When someone senior proposes a fix and asks “does this settle it?”, the conversational pull is to grade it pass/fail. But pass/fail collapses two different questions — is this good? and does this solve the problem at hand? — and the collapse is exactly where a false reassurance gets minted. Had the answer been a simple yes, the company would have carried a sense of resolution into a launch while the actual exposure sat untouched: a matching-preference field that is itself sensitive data resting on a server regardless of any persona UI, and any analytics pipe that learns identity plus presence.

Layered systems are good at manufacturing this illusion, because every layer has its own complete-sounding vocabulary of “hidden” and “exposed.” A profile hidden at the interface layer is fully visible at the database layer. Minimization between users says nothing about disclosure to processors. Each layer’s fix produces a true sentence — “users can’t see X now” — that sounds like the end of the story if you don’t ask which layer the original threat lived on.

So the discipline is one move: locate the layer before grading the fix. Ask what, mechanically, the ruling (or the outage, or the exploit) actually punished, place the proposed fix on that map, and if fix and threat sit on different layers, say both truths in the same breath — you’re right, and it doesn’t solve this. The first half keeps the good design from being discarded; the second keeps the real problem from being declared solved by something that never touched it.