3 ms·

You're basically saying, "nobody cared about their material security weakness until someone did something bad with it" How is that not true of every single sec

You're basically saying, "nobody cared about their material security weakness until someone did something bad with it" How is that not true of every single security/privacy incident, ever? If the situation was, "everyone knew 23andMe was storing non-deidentified genomic data on an unsecured S3 bucket, and this was fine until [insert villian] took it" it would be the same, and people would be justifiably pissed off. This feels like a completely correctly handled story in the media, your personal anecdote about working with Facebook notwithstanding.

closeparen 8y ago
You can’t recast HN’s comment system as a material security weakness just because you learn that people who disagree with you can also read your public comments.
- JumpCrisscross 8y ago
  > You can’t recast HN’s comment system as a material security weakness just because you learn that people who disagree with you can also read your public comments This is a false equivalence. Hacker News comments are public. (HN also doesn't sell ads.) Facebook messages and private content usually aren't. Just because "the API's that were used there were available to the entire world" doesn't mean "everyone knew exactly what they were." Everyone didn't know what they were capable of. A very small section of the technologically literate did, and most of them were profiting off the status quo.
  - closeparen 8y ago
    >Facebook messages and private content usually aren't. Sure, that's not the same as public access, but it's equally blown out of proportion. Users must be empowered to delegate access to the software of their choosing. Facebook offering read_mailbox as an option on its OAuth consent screen is exactly as evil as Fastmail offering IMAP.