8 ms·
Download Public User Data with Oink's Export Tool
- tonyrice 15y agoI honestly can say I have no clue what Oink is but this seems like something pretty serious.
- chime 15y agoWas Oink 100% public or were there private conversation/shares? If everything on Oink was public (like a public blog or Twitter before direct messages), then it doesn't seem like a big deal. It's just making it easier to snoop. Otherwise, wow.
- tonyrice 15y agoI agree, if everything was public then it doesn't seem like a big deal but they still should of made measures to assure that only the user gets their data in exported format.
- ErikHuisman 15y agoI can't find any options in the oink app to make stuff private. So yeah, everything is/was public.
- rickmb 15y agoPrivacy is not about whether something is public or not. It's about being in control of your data. This is the fundamental misunderstanding that seems to be rampant especially in countries like the US that lack basic privacy regulations. Just because information was public, doesn't mean that using it in certain ways without the permission of the person involved is not a breach of privacy. I seriously doubt this was a type of usages Oink users explicitly agreed to (and no, burying such provisions in the small print doesn't make it legal).
- Karunamon 15y ago>Privacy is not about whether something is public or not. It's about being in control of your data. Um.. that's not what the word means. It's possible for you to not be in control of your data but still have it be private, and vice versa. Google: Define: Privacy The state or condition of being free from being observed or disturbed by other people. The state of being free from public attention. That's what the dictionary says. >I seriously doubt this was a type of usages Oink users explicitly agreed to (and no, burying such provisions in the small print doesn't make it legal). Depends on how the site worked. For instance, look at Twitter - everything is public by default unless you go to your profile and check a box that says "Make my account private", and then nobody can follow you. Are you saying it would be a breach of privacy for Twitter to provide a zipfile containing all of my tweets I've ever made publicly? Which any person could get anyways by searching @myname site:twitter.com ?
- rickmb 15y agoPrivacy has a way broader social and legal meaning than the dictionary definition of the word. Narrowing it down to a oneliner from a dictionary is not particularly constructive. And yes, I would say if Twitter did that, it could well be a breach of privacy. It would almost certainly be a breach of the law in most Western countries. Just because you have access to the data, doesn't mean you can just do with it whatever you like without the consent of the owner. Once that zip-file spreads, making the Twitter account private becomes pointless. Why do so many people think copyright is something perfectly logical, but privacy protection, which has much more to do with protecting the rights of individuals, is something weird?
- speg 15y agoGo to https://twitter.com/#!/speg https://twitter.com/#!/speg and you can see all my tweets. How is that different than going to http://oink-prod.s3.amazonaws.com/speg-export.zip http://oink-prod.s3.amazonaws.com/speg-export.zip and getting all my Oinks. I never read the Oink privacy policy because I assumed everything was public. It's kind of weird that they let you download anybodies -public- data, but in order for it to be a breach of privacy, it would have to be private in the first place.
- mef 15y agoSite seems to be down. Google cache http://webcache.googleusercontent.com/search?sourceid=chrome&ie=UTF-8&q=cache%3Ahttp%3A%2F%2Fwww.cristinajcordova.com%2F2012%2F03%2Foinks-export-tool-data-privacy-breach-download-the-data-of-any-user-5%2F http://webcache.googleusercontent.com/search?sourceid=chrome...
- cristinacordova 15y agosorry, trying to get it back up.
- cristinacordova 15y agoIt should be back up now.
- drewinglis 15y agoIt's still down for me. =\
- cristinacordova 15y agostill seems I'm getting attacked by a single IP...
- ZanderEarth32 15y agoI never used Oink, but was there an option when creating an account to make it a private account, limiting access to certain types of data to certain users? If not, isn't everyone's uploads, reviews, pictures, etc. already available for anyone to see? Even if this is true, this still shouldn't be happening.
- cageyjames 15y agoPrivacy should always be the number one concern with apps and websites. This is simply just sloppy.
- siculars 15y agoNot when everything you put in is Public.
- cageyjames 15y agoRespect your users.
- ceejayoz 15y agoIs it disrespectful that Twitter makes my tweets publicly available via their API?
- cageyjames 15y agoThat doesn't answer my question.
- icebraining 15y ago"Respect your users" is not a question.
- ceejayoz 15y agoYou didn't pose one. I did, and you ignored it.
- filipmares 15y agoit was public on the site, not browseable. you needed to know the explicit url to your profile. there simply was no structure for it.
- 15y ago
- harryf 15y agoFiled under "How to make shutting down your service a memorable event"
- donohoe 15y agoRelevant piece for those who can't access the page: So, curiously, I tried replacing my username with Kevin Rose’s: http://oink-prod.s3.amazonaws.com/kevinrose-export.zip http://oink-prod.s3.amazonaws.com/kevinrose-export.zip (go ahead, click it). You’ll get a zip file of every item he has ever added, rated or reviewed. You’ll also get every photo he has ever uploaded to Oink.
- deleted 15y ago[deleted]
- samstave 15y agoLooking at all the pics that Kevin has uploaded made me incredibly hungry. He has eaten some nice looking meals.
- smackfu 15y agoHa. I thought the download service was pretty clever and well put together, but didn't notice that the link they gave you wasn't anonymized.
- tonywebster 15y agoI noticed this when I did my export as well, but when I saw the data, it was only public information. But makes for a good headline for this blogger it seems.
- HectorRamos 15y agoTwitter's privacy breach: read the timeline of any (non-Protected) user by navigating to http://www.twitter.com/{username} http://www.twitter.com/{username}
- dolinsky 15y agoupdate2 - Apparently some usernames work and others don't I believe his account is the only one that is made public. Obtaining a list of usernames is as easy as a 'site:oink.com' search in google. curl -I http://oink-prod.s3.amazonaws.com/kevinrose-export.zip http://oink-prod.s3.amazonaws.com/kevinrose-export.zip HTTP/1.1 200 OK x-amz-id-2: 9lLlixkcIypVbEIPzp7lmAT3gqwxFS3h99pdgnipW5aZVmhy422YA06OaMT7KOXd x-amz-request-id: E6D61A351A455807 Date: Fri, 16 Mar 2012 17:23:28 GMT Last-Modified: Fri, 16 Mar 2012 17:22:17 GMT ETag: "799ee5f116bed2fac2893dda920a987a" Accept-Ranges: bytes Content-Type: application/zip Content-Length: 65492507 Server: AmazonS3 curl -I http://oink-prod.s3.amazonaws.com/thebucknutz-export.zip http://oink-prod.s3.amazonaws.com/thebucknutz-export.zip HTTP/1.1 403 Forbidden x-amz-request-id: D3BF734D33B46816 x-amz-id-2: exsDFYH6AcczbNuZWnlFW86EO9SP8EpwMDSwx9dGjSl9A24f3jXBobTRgOw+XNrC Content-Type: application/xml Transfer-Encoding: chunked Date: Fri, 16 Mar 2012 17:23:37 GMT Server: AmazonS3 update - seems that she had some success with links last night. Looks like they've fixed perms in the meantime. https://twitter.com/#!/cristinacordova/statuses/180708226696876032 https://twitter.com/#!/cristinacordova/statuses/180708226696...
- joliveira 15y agoMaybe that user is not available anymore or something else because if you try to download cristina-export.zip it sure works.
- dolinsky 15y agoIndeed it does. curl -I http://oink-prod.s3.amazonaws.com/cristina-export.zip http://oink-prod.s3.amazonaws.com/cristina-export.zip HTTP/1.1 200 OK x-amz-id-2: gIfqnrhzuVR2HJIhT8Msk37Pp96qabi6Amtq6ZG9makBlT/d5z+bYivF27tac16v x-amz-request-id: 9A1C02D63152317A Date: Fri, 16 Mar 2012 17:47:27 GMT Last-Modified: Fri, 16 Mar 2012 06:09:58 GMT ETag: "6326a2bc6724b1566530f34f5d96bf26" Accept-Ranges: bytes Content-Type: application/zip Content-Length: 212717 Server: AmazonS3 Wouldn't take much for someone to whip up a script to parse the search results to build a list of usernames to bounce off of. There's also a fair amount of item-specific data too.
- 15y ago
- kmfrk 15y agoCan you going to a restaurant and see your friends pull out their iPhone to snap photos of everything they eat and drink? I'd want to smack them at the back of their head. Good riddance to products like Oink, if it fosters habits like Rose's, if his photos are anything to go by.
- brown9-2 15y agoBtw, what was Oink about? I'd never heard of it before it was shut down and this Google story, so it's hard to find out anything about what the app actually was. They seem to be getting a lot more attention post-shutdown than pre.
- km3k 15y agoAccording to Oink's twitter account, "All of the data is and was publicly available." https://twitter.com/#!/oinkapp/status/179981032416755712 https://twitter.com/#!/oinkapp/status/179981032416755712
- kirbysayshi 15y agoI thought some weird cache from Oink's Pink Palace was found! Hadn't heard of this Oink until now.
- InclinedPlane 15y agoWell, if there's a silver lining to this it's a good thing the development team behind that product isn't going anywhere where data privacy breaches could be a big deal.
- benatkin 15y agoWhether or not it's public content and the privacy policy says it is, Oink botched it. If they were going to release all the data they should have said so. The archives not being generated until a user triggers the export indicates to me that it's just sloppy coding.
- icebraining 15y agoIf they were going to release all the data they should have said so. They didn't release anything new - all the data was already accessible from their website, and users were aware of that. They just made a zip out of it.
- stickfigure 15y agoAll the data is public. You could probably get it in a less concise form from Google. There is no story here, other than "Oink allows the public to download public data".
- newstartupidea 15y agoWhichever "pg" they have (not the real PG it seems) likes thai, vegan, vegetarian, indian including: Vegetable Delight, Tacos, Special Vegetable Curry, Pasta Primavera, and Damascus Hummus. Also noted a book "Notes from Underground". And provided a picture of some food labelled "Amazing". Four square ids in the export's contained csv can be mapped to real locations via Google by searching for: https://foursquare.com/ https://foursquare.com/ put_id_here All of the pg reviewed items were from restaurants in Columbia, SC. They should probably close this hole. BTW- Kevin Rose's favorite food is Filet Mignon at Switch Steak, 3121 Las Vegas Blvd. S (Inside Encore), Las Vegas, NV 89109 and he eats fries he likes frequently at Zuni Cafe, 1658 Market St (at Rose St), San Francisco, CA 94102
- ig1 15y agoFlagged because the title is misleading and unfairly besmirches the Oink team. All the data was public in the first place. EDIT: The title has been changed to something reasonable so I've unflaged it.
- cristinacordova 15y agoDo you mean you changed the title? I certainly didn't as I'm now blocked from editing the title of my own submission. Also, the post seems to still be flagged.
- ig1 15y agoPresumably one of the mods changed it
- cristinacordova 15y agoI see, thanks.
- joshaidan 15y agoI understand most of the data was public anyway, but why not at the very least use a randomly generated string instead of your username?