3 ms·
It's worth noting that this information was already available publicly before f8.
by milkshakes 17y ago
It's worth noting that this information was already available publicly before f8.
- tewks 17y agoSet your privacy settings on lockdown and then put your own Id in instead of "4". This is undesirable behavior.
- milkshakes 17y agoI agree. However, this isn't a new development. It's just more in your face now.
- tewks 17y agoWas this true for all users or just "4" prior to f8?
- milkshakes 17y agoWith a valid sessionkey, I could get a list of the public events that any user was invited to, as well as the ones they RSVP'd for.
- smokinn 17y agoAre you sure? I'm checking myself and nothing is available other than my profile photo. /[my id]/events data (empty) Maybe his privacy settings aren't as stringent as mine?
- milkshakes 17y agoIt only works with publicly listed events
- ori_b 17y agoBut you could already look at publicly listed events and find out who was attending. This - in principle - isn't exposing any more information than what was previously there. It just makes it easier to access. Sure, it still sucks. But it's not a major new security breach. All that it exposes is already there.