14 ms·
Twitter warns that private tweets were public for years
- beachie 8y agoI had the pleasure of interviewing the anonymous developer of the fastest organically growing decentralized p2p app notabug.io I feel its relevant to this conversation. Why are we not switching to decentralized content sharing platforms? :S https://electronicsforu.com/resources/cool-stuff-misc/future-decentralised-web-part-1 https://electronicsforu.com/resources/cool-stuff-misc/future... https://electronicsforu.com/resources/cool-stuff-misc/future-decentralised-web-part-2 https://electronicsforu.com/resources/cool-stuff-misc/future...
- soared 8y ago> Why are we not switching to decentralized content sharing platforms? Because that site looks like a phishing site for reddit accounts. How is 100% cloning another site's design acceptable at all?
- beachie 8y agoGeez! It's a design that all are familiar with, UX 101 and facebook does it all the time! No one 'cloned a site' the whole backend infrastructure is different. Did you read it at all?
- soared 8y agoFacebook doesn't copy and paste the css of competitors. That site did. I didn't read any of the interview, I just went to the site like most users would.
- beachie 8y agoAlso HN looks like a clone of reddit!
- go1dfish 8y ago> How is 100% cloning another site's design acceptable at all? 1. The design is open source under a CPAL license which notabug abides by https://github.com/reddit-archive/reddit/tree/753b17407e9a9dca09558526805922de24133d53/r2/r2/public/static/css https://github.com/reddit-archive/reddit/tree/753b17407e9a9d... 2. a goal of notabug is to support existing reddit stylesheets with minimal/no modifications; this requires dom compatibility and minimal CSS changes in the base design. 3. reddit is abandoning this formerly open source design in favor of their new design by default.
- MoronInAHurry 8y agoThe top post on notabug right now is "Tampermonkey script for auto-voting on notabug, lets level the playing field". The site has like 10 users and it's already destroyed by bots. Anarchy isn't a good approach to running a site if you want anything useful to come out of it.
- beachie 8y agoThe way I see it, it looks like the original internet, remember 4chan? the rise of bulletin boards? We can't all be complaining about the current services being exploitative or broken without being a part of a solution. I'm all ears to move away from decentralization if there is a better solution. Currently, there are none.
- HashHishBang 8y agoNot having a solution for a hard problem doesn't disqualify people from pointing to an obviously bad one and calling it out. This jank old.reddit.com fork is not the solution.
- isostatic 8y ago"In the year 2015, 4 years before the global explosion of privacy-awareness dialogues" Really, what's happened in the last 3 weeks? "starting in the wake of facebook’s Cambridge analytical scandal" That was November 2017
- thrillgore 8y agoWe really need regulation here.
- the_duke 8y agoThis is the actual source: https://help.twitter.com/en/protected-tweets-android https://help.twitter.com/en/protected-tweets-android.
- miracle2k 8y agoSo basically, the issue was that the settings screen in the Android app would toggle the "account is private" setting off when updating unrelated settings; however, the setting itself, if turned on, worked fine.
- deleted 8y ago[deleted]
- sixothree 8y agoAt this point it should probably be illegal to call something "private" when there is no guarantee of protections.
- deleted 8y ago[deleted]
- the_duke 8y agoSeems to have been a bug where some settings were reset accidentally. Of course this shouldn't happen, but I can see how something like this could easily slip through.
- woodrowbarlow 8y agotwitter uses the word "protected", only the article's author ever used the word "private".
- sixothree 8y agoWas it really a good faith effort to make them protected?
- scarejunba 8y agoYes, it was a bug that revealed them.
- throwaway5752 8y agoSpecific to Twitter for Android (not web or iOS device clients)
- hcnews 8y agoShouldn't this involve lots of penalties? This has the potential to change/ruin lives drastically. A prudent consumer never trusts what the companies say nowadays. However, that shouldn't absolve the company of falsely claiming private product when it isn't so.
- the_duke 8y agoA prudent consumer also doesn't send 'live-destroying' messages on a public, hosted messaging platform, regardless of a private setting... Note that this isn't even about DMs.
- thrillgore 8y agoI know this is a common disclaimer but this sounds like victim blaming. It says "private" it should mean private and not quote unquote private.
- kemitche 8y agoIt's absolutely victim blaming. It's true that it's a reasonably good practice to assume that databases will be leaked. That doesn't mean that when a company loses control of private data that the company holds no blame.
- ben_w 8y agoI know someone with a common name who was first on gmail with that name. He gets a lot of emails that are meant for different people of the same name. One of those others was accused in the Lloyds bank libor scandal, and the email came from the law firm they had hired. Non-software people don’t have the faintest idea how computers work, and more than non-lawyers the law or non-economists money.
- drngdds 8y agoIf companies can't be trusted to act carefully and responsibly with users' data, then I think that's a problem with the companies.
- bilbo0s 8y agoJust my own opinion, but at this point I think it's prudent to assume that pretty much anything you send out into the digital network world is public. If it's not something you would want the world knowing you said, don't put it out there. Security breaches happen. Bugs happen. Sometimes law enforcement just comes by and says, "Give me everything that user X has ever done." In short, sh!t happens. "Everything I do on the net can be authoritatively attributed to me personally." That's the thought we should all have in our heads before we send any post, or send any text, or send any email, or send any photo, or etc etc etc. We shouldn't rely on some company, that's using us to make money, to protect our privacy.
- throwaway0009 8y ago> That's the thought we should all have in our heads before we send any post, or send any text, or send any email, or send any photo, or etc etc etc. I worked for a large company that had gotten into trouble in the past, with written records used as evidence. All new employees were trained not to write anything down that we would not want to see on the front page of the WSJ. It was stressed that even content on personal devices could be subpoenaed and entered into the public record if issues arose.
- setquk 8y agoTotally agree. But where does that leave us with “The Cloud”?
- jtmarmon 8y agoThis headline/article are pretty misleading. It makes the issue sound like if you had "Protect My Tweets" enabled, your tweets were still public. From reading the original notice [https://help.twitter.com/en/protected-tweets-android https://help.twitter.com/en/protected-tweets-android] it sounds like the setting would just be disabled, which then made your tweets public. But not that Twitter's app would continue to say they were protected. That's a pretty significant difference (also by the fact that such a huge thing was not noticed for 6 years I'm guessing not many people were actually impacted) Also just for fun, I'd wager how it happened is that the developer had some "default request object" that had "true" as the default setting for this and merged it with the updated property values ;) a classic
- daveFNbuck 8y agoIf you don't check your settings before each tweet, there's not much difference for between your settings being changed and your settings not working correctly.
- pqz 8y agoPrivate tweets and profiles show a padlock next to the user's name... You don't have to go to any obscure menu to find out whether your tweets are public or not.
- fixermark 8y agoSometimes, I'm sad I quit using Twitter. There are some neat people sharing content there. But the more time goes by, the less sad I get. Their tech stack is and always has been a bit of a garbage fire.
- artursapek 8y agoName one startup that grew quickly and organically into a massive company which doesn't have a "garbage fire" tech stack.
- deleted 8y ago[deleted]
- Thaxll 8y agoIt most likely only take a bool in a DB to make something public.
- tomcam 8y agoI think they should swap priorities: they should begin spending as much time on privacy as they are currently spending on which conservative personalities to deplatform, and vice versa. Goodbye, sweet HN karma!
- jerf 8y agoI've noticed a hole in a lot of people's thinking where even if they thing to write automated testing or QA testing to ensure that a given thing is available to a certain user or role, there is often not a lot of thought given to writing tests to enure that users or roles that should not have access to the data can't get it. I'm not sure I've ever found a permission system without explicit testing that the denials work that didn't turn out to have gaping holes in what could actually be done. Generally, the code that hides the UI for what you're not supposed to be able to do works, since that's visible, but on something like the Web where the user also has fairly direct access to the message bus the application is using to communicate to the web server, that's not enough.
- jakear 8y agoTesting a negative is much more difficult. Testing the positive is “can this user access this private data using this procedure”. Testing the negative is “can any use access any private data using any procedure”. That’s almost impossible to verify.
- ddingus 8y agoThe very first words I wrote online sometime around 91 were visible for over 15 years. I pretty much don't put anything online I cannot live with.
- WilliamEdward 8y agoThis is a good principle in general but you didn't exactly put those words up on a site that promised "privacy/protection" did you? That's the difference here.
- ddingus 8y agoSpot on. Let's just say I knew better. Seriously. There was absolutely no way these companies were not going to exploit the crap out of both their position and data. None. How were they all built? As fast as possible, growth first, etc... I expect these kinds of things to boil down to risks and costs, ideally paid after the enterprise is big enough to deal. And a whole lot of us know it too. How else was it all going to go? I am a realist. There is no real privacy online. One can get close, but doing that is a lot of work, takes understanding, and is still a bit of a risk. Long ago I realized it is better to just not put things I can't live with online. Frankly, I won't do that electronically, unless it is very worth it. Edit: It is all still pretty new. We are leaving the honeymoon time. Bad things will happen, so will more regulation, and that crank will get turned a few times. My expectations are super low right now. That could change, but not yet.
- Bud 8y agoToo much to ask for the headline to include the word "Android", since it was only Android tweets that were affected?
- chinathrow 8y agoThe payout for this bug was $2940 on HackerOne [1]. I find that amount a bit on the low side. [1] https://hackerone.com/reports/472013 https://hackerone.com/reports/472013
- omouse 8y agoThis is why whenever you build software, you basically should encrypt any and all data and you should be extremely careful when it comes to permission checks. Especially if you are a company or startup, there's no excuse for not burning through a few thousand dollars more here and there to build more secure software that doesn't result in privacy blow-ups like this. I wonder if GDPR affects Twitter in this case and what % of their revenue can be taken as a penalty for treating users like shit.
- daveoscar 8y agoThe experts of Assignment Help 4 Me work to help the students in all ways. The professionals take up the complete responsibility of the students’ homework and other tasks and complete them efficiently for the students to score well. Get more info at https://www.assignmenthelp4me.com/ https://www.assignmenthelp4me.com/
- braydenmarco 8y agoGreat site and a great topic as well I really get amazed to read this. It’s really good.For Assignment Help visit our site AllAssignmentHelp. https://www.allassignmenthelp.com/ https://www.allassignmenthelp.com/
- louishill 8y agoGreat site and a great thort as well I really get amazed to read this. It’s really fine.For USA Assignment Help visit our site Casestudyhelp.com. https://casestudyhelp.com/usa/ https://casestudyhelp.com/usa/