I think it is unreasonable to blame site when you allow sharing data by certain separations. Like in social media set your friends' friends to be able to see yo

I think it is unreasonable to blame site when you allow sharing data by certain separations. Like in social media set your friends' friends to be able to see your data. If one of these friend's friend is bad actor. Is it really on the site to prevent them seeing the data?