7 ms·

Leaking URLs to the Clown

65 points by guavaroo 2y ago

egypturnash 2y ago
So, if you were thinking about using that particular app to read some feed containing something relatively private, guess what, they're reading it too. Which one? No names were named at any point in this post.
- cxr 2y ago
  Artykul <https://artykul.org/ https://artykul.org/>
  - glenngillen 2y ago
    I doubt it is this one. A quick read of that page and there's a few features that immediately had me assuming data would be synced to the cloud.
    - deleted 2y ago
      [deleted]
    - lilyball 2y ago
      The cloud syncing stuff says "if you want", which implies it's opt-in behavior.
    - draw_down 2y ago
      [dead]
    - rhaps0dy 2y ago
      But it has the "all articles are available offline and without an internet connection" exact quote in the landing page, and nothing else seems to do.
- probably_wrong 2y ago
  It's not hard to find out which one it is, though. I don't want to name names but the post gives a clear hint.
  - _2d30 2y ago
    > I don't want to name names Why??
    - RobRivera 2y ago
      WHATS THAT ONE WORD!!? You know, that character trait for DnD that determines how gullible your character is? LIE ability was it? Row 3 d20 to LIE check?!
  - DonHopkins 2y ago
    Why not name names? Who are you trying to protect, and why do they need protection from their own misdeeds, and why don't their users and everyone else deserve to know? They don't respect people's privacy, but deserve to have their own corporate privacy respected for some reason?
    - maxbond 2y ago
      It's possible that it's more of a personal ethic and a view towards their own actions (something like, "I don't disparage others") rather than that they view this company as deserving protection.
      - userbinator 2y ago
        The proliferation of "I don't disparage others" is how we got into this mess in the first place.
    - probably_wrong 2y ago
      Because I don't have all the facts and I can't put the genie back in the bottle. I think there needs to be a balance between "if you really want to research this alleged invasion of privacy then you should look here" and "that guy is bad, everybody go harass him". I haven't seen the logs and I haven't read the company's website in detail, so I'm not going to point the finger at someone for what could be a misunderstanding. Maybe the website does point out this behavior. Maybe it's a badly configured script. Maybe it's as bad as described. I certainly don't know and I'd rather not join an internet mob until I've done my due diligence.
- n3t 2y ago
  Searching for "all articles are available offline and without an internet connection" (with the quotes) in your favorite search engine might help.
  - Tao3300 2y ago
    It's the third result for me, after Rachel By the Bay and... your comment.
    - deleted 2y ago
      [deleted]
- IncreasePosts 2y ago
  I feel like this happens every time we see one of her blog posts - she tries very hard to not provide any kind of specific information about anything she is writing about. Maybe it is to stop fanboys from harassing her when she trashes their favorite product or company, but it is the same technique used by people who are just making up stories.
  - lolinder 2y ago
    > Maybe it is to stop fanboys from harassing her when she trashes their favorite product or company, I assumed the opposite: she knows that she has readers who will go trash on the developers of whatever random app she happens to be criticizing and doesn't want to be responsible for inciting an internet mob. In this case she provided enough information that anyone who was seriously concerned about their feed reader could easily find out if it was theirs—searching for the quoted text turns up the guilty RSS reader, her post, and a rip-off of the guilty reader which re-uses their marketing blurb. That's easy enough for someone who's motivated to find out if they're safe, but maybe not enough for a mob to form?
turnsout 2y ago
Can’t tell if “clown” is an incredible typo in the submission or some comment on the owner of the offending platform, but either way I’m all about it
- glompers 2y ago
  Elastic Compute Clowncar braking in 3, 2, 1
- astrodust 2y ago
  Cloud to Clown substitution plugin?
- 0xcde4c3db 2y ago
  I don't have some exquisite etymology to link to, and I can't speak to Rachel's personal context, but I'm quite confident that anti-corporate Americans of a certain age will read "the clown" as a reference to Ronald McDonald, in much the same way that "the mouse" means Mickey Mouse, i.e. Disney.
  - gryfft 2y ago
    From the title I thought this was going to be about security issues with McDonald's WiFi.
- Lammy 2y ago
  I assumed Facebook i.e. Clowntown
- rhaps0dy 2y ago
  It must just refer to the Cloud in a derogatory way, not the particular platform. It sounds so similar.
  - codetrotter 2y ago
    As a former would-be user of the cloud-to-butt extension, “clown” is a term I can truly get behind.
cxr 2y ago
> read some feed containing something relatively private, guess what, they're reading it too Everyone needs to accept the fact there's no such thing as a private URL. There are URLs that can be originally communicated to you privately—through a private channel, that is—but insisting on holding onto some (wrong) belief that we can or should be able to mint URLs that themselves possess some "private" quality goes against the fundamental design of the Web and what a URL even is. (Yes, this does mean that every podcaster that implements subscriptions by giving one feed URL to free listeners and having listeners who pay for premium content use a different URL is fundamentally broken. Yes, this does mean that that big engineering organization that implemented file uploads and read/write access through slugs consisting of unguessable 128+ bit tokens is also wrong.)
- vilhelm_s 2y ago
  The issue is that the company can track what you are reading.
  - magicalhippo 2y ago
    Unless there's an explicit reason not to, you should indeed assume that men in the middle will look at what you pass by them. Then you have to decide for yourself if you're OK with that or not. I know Microsoft looks at my files when I put them on my OneDrive. I take that into account when I decide what to put there. I know Google reads my mail when Thunderbird sends it through their SMTP servers. I know it'll be read by some unknown parties along the way to the recipient. I take that into account when I write my mail. If I pasted a URL into a feed reader, I'd most certainly assume the app, and by extension its creators, would access that URL and read what's there. I'd take that into account when using the app.
    - vilhelm_s 2y ago
      She didn't think there would be anyone in the middle! She expected the app to access the URL, and it did, but she didn't expect it to also send a copy to its creators. Like, what if you discovered that each time you send an email, Thunderbird also sends the email address you were writing to to a server owned by Mozilla?
Sabinus 2y ago
There is approximately zero point in calling out the bad behaviour of anonymous applications.
- ben0x539 2y ago
  It's probably not a callout post and more of a venting/"talking about my day" kinda post.
- ergonaught 2y ago
  Wanted to post it. Posted it. If you think more "point" than that is necessary, you are deeply confused about a great many things.
  - Sabinus 2y ago
    Why didn't you want to post a couple more characters of the app name you were examining? Of all the comments here what was the point of only replying to that one?
morgante 2y ago
Sorry, but I just don't see the "bad behavior" in polling a URL you purposefully requested it to retrieve. URLs are not secrets. Don't treat them as such.
- vilhelm_s 2y ago
  She expected it to retrieve the URL to her own device, but it also sent it to the company that makes the app. That like if Chrome sent Google a list of all URLs you visit, people would definitely be angry about that.
  - evilduck 2y ago
    > That like if Chrome sent Google a list of all URLs you visit, people would definitely be angry about that. I have bad news for you… the general public won’t care. https://www.tomsguide.com/news/microsoft-edge-is-sending-all-your-visited-pages-to-bing-how-to-turn-it-off https://www.tomsguide.com/news/microsoft-edge-is-sending-all...
    - ziml77 2y ago
      That doesn't prove that people don't care, just that Microsoft doesn't care about people.
  - jojobas 2y ago
    Except Chrome indeed sends up all URLs you browse, at least by default/outside of incognito mode.
    - Dylan16807 2y ago
      Are you talking about encrypted sync data or something else?
      - magicalhippo 2y ago
        Both autosuggest[1] and Safe Browsing[2] sends URLs or "portion of" URLs home to Google. At least Google is fairly transparent about it, if you look for it. And I'd trust them way more than a tiny company making a "dime a dozen" app. [1]: https://support.google.com/chrome/answer/13730681?hl=en#zippy=%2Chow-we-protect-your-data%2Chow-the-address-bar-works https://support.google.com/chrome/answer/13730681?hl=en#zipp... [2]: https://support.google.com/chrome/answer/13844634?hl=en&ref_topic=9845306#zippy=%2Chow-safe-browsing-works https://support.google.com/chrome/answer/13844634?hl=en&ref_...
impure 2y ago
I thought every feed reader did this. Well the ones with a server anyways.
westcort 2y ago
I made a bookmarklet that makes reading articles easier so that no browser extensions or reader apps need to access the data. Here is the link: https://news.ycombinator.com/item?id=40588645 https://news.ycombinator.com/item?id=40588645

65 points by guavaroo 2y ago

So, if you were thinking about using that particular app to read some feed containing something relatively private, guess what, they're reading it too. Which one? No names were named at any point in this post.

cxr 2y ago
Artykul <https://artykul.org/ https://artykul.org/>
- glenngillen 2y ago
  I doubt it is this one. A quick read of that page and there's a few features that immediately had me assuming data would be synced to the cloud.
  - deleted 2y ago
    [deleted]
  - lilyball 2y ago
    The cloud syncing stuff says "if you want", which implies it's opt-in behavior.
  - draw_down 2y ago
    [dead]
  - rhaps0dy 2y ago
    But it has the "all articles are available offline and without an internet connection" exact quote in the landing page, and nothing else seems to do.
probably_wrong 2y ago
It's not hard to find out which one it is, though. I don't want to name names but the post gives a clear hint.
- _2d30 2y ago
  > I don't want to name names Why??
  - RobRivera 2y ago
    WHATS THAT ONE WORD!!? You know, that character trait for DnD that determines how gullible your character is? LIE ability was it? Row 3 d20 to LIE check?!
- DonHopkins 2y ago
  Why not name names? Who are you trying to protect, and why do they need protection from their own misdeeds, and why don't their users and everyone else deserve to know? They don't respect people's privacy, but deserve to have their own corporate privacy respected for some reason?
  - maxbond 2y ago
    It's possible that it's more of a personal ethic and a view towards their own actions (something like, "I don't disparage others") rather than that they view this company as deserving protection.
    - userbinator 2y ago
      The proliferation of "I don't disparage others" is how we got into this mess in the first place.
  - probably_wrong 2y ago
    Because I don't have all the facts and I can't put the genie back in the bottle. I think there needs to be a balance between "if you really want to research this alleged invasion of privacy then you should look here" and "that guy is bad, everybody go harass him". I haven't seen the logs and I haven't read the company's website in detail, so I'm not going to point the finger at someone for what could be a misunderstanding. Maybe the website does point out this behavior. Maybe it's a badly configured script. Maybe it's as bad as described. I certainly don't know and I'd rather not join an internet mob until I've done my due diligence.
n3t 2y ago
Searching for "all articles are available offline and without an internet connection" (with the quotes) in your favorite search engine might help.
- Tao3300 2y ago
  It's the third result for me, after Rachel By the Bay and... your comment.
  - deleted 2y ago
    [deleted]
IncreasePosts 2y ago
I feel like this happens every time we see one of her blog posts - she tries very hard to not provide any kind of specific information about anything she is writing about. Maybe it is to stop fanboys from harassing her when she trashes their favorite product or company, but it is the same technique used by people who are just making up stories.
- lolinder 2y ago
  > Maybe it is to stop fanboys from harassing her when she trashes their favorite product or company, I assumed the opposite: she knows that she has readers who will go trash on the developers of whatever random app she happens to be criticizing and doesn't want to be responsible for inciting an internet mob. In this case she provided enough information that anyone who was seriously concerned about their feed reader could easily find out if it was theirs—searching for the quoted text turns up the guilty RSS reader, her post, and a rip-off of the guilty reader which re-uses their marketing blurb. That's easy enough for someone who's motivated to find out if they're safe, but maybe not enough for a mob to form?

turnsout 2y ago

Can’t tell if “clown” is an incredible typo in the submission or some comment on the owner of the offending platform, but either way I’m all about it

glompers 2y ago
Elastic Compute Clowncar braking in 3, 2, 1
astrodust 2y ago
Cloud to Clown substitution plugin?
0xcde4c3db 2y ago
I don't have some exquisite etymology to link to, and I can't speak to Rachel's personal context, but I'm quite confident that anti-corporate Americans of a certain age will read "the clown" as a reference to Ronald McDonald, in much the same way that "the mouse" means Mickey Mouse, i.e. Disney.
- gryfft 2y ago
  From the title I thought this was going to be about security issues with McDonald's WiFi.
Lammy 2y ago
I assumed Facebook i.e. Clowntown
rhaps0dy 2y ago
It must just refer to the Cloud in a derogatory way, not the particular platform. It sounds so similar.
- codetrotter 2y ago
  As a former would-be user of the cloud-to-butt extension, “clown” is a term I can truly get behind.

cxr 2y ago

> read some feed containing something relatively private, guess what, they're reading it too Everyone needs to accept the fact there's no such thing as a private URL. There are URLs that can be originally communicated to you privately—through a private channel, that is—but insisting on holding onto some (wrong) belief that we can or should be able to mint URLs that themselves possess some "private" quality goes against the fundamental design of the Web and what a URL even is. (Yes, this does mean that every podcaster that implements subscriptions by giving one feed URL to free listeners and having listeners who pay for premium content use a different URL is fundamentally broken. Yes, this does mean that that big engineering organization that implemented file uploads and read/write access through slugs consisting of unguessable 128+ bit tokens is also wrong.)

vilhelm_s 2y ago
The issue is that the company can track what you are reading.
- magicalhippo 2y ago
  Unless there's an explicit reason not to, you should indeed assume that men in the middle will look at what you pass by them. Then you have to decide for yourself if you're OK with that or not. I know Microsoft looks at my files when I put them on my OneDrive. I take that into account when I decide what to put there. I know Google reads my mail when Thunderbird sends it through their SMTP servers. I know it'll be read by some unknown parties along the way to the recipient. I take that into account when I write my mail. If I pasted a URL into a feed reader, I'd most certainly assume the app, and by extension its creators, would access that URL and read what's there. I'd take that into account when using the app.
  - vilhelm_s 2y ago
    She didn't think there would be anyone in the middle! She expected the app to access the URL, and it did, but she didn't expect it to also send a copy to its creators. Like, what if you discovered that each time you send an email, Thunderbird also sends the email address you were writing to to a server owned by Mozilla?

Sabinus 2y ago

There is approximately zero point in calling out the bad behaviour of anonymous applications.

ben0x539 2y ago
It's probably not a callout post and more of a venting/"talking about my day" kinda post.
ergonaught 2y ago
Wanted to post it. Posted it. If you think more "point" than that is necessary, you are deeply confused about a great many things.
- Sabinus 2y ago
  Why didn't you want to post a couple more characters of the app name you were examining? Of all the comments here what was the point of only replying to that one?

morgante 2y ago

Sorry, but I just don't see the "bad behavior" in polling a URL you purposefully requested it to retrieve. URLs are not secrets. Don't treat them as such.

vilhelm_s 2y ago
She expected it to retrieve the URL to her own device, but it also sent it to the company that makes the app. That like if Chrome sent Google a list of all URLs you visit, people would definitely be angry about that.
- evilduck 2y ago
  > That like if Chrome sent Google a list of all URLs you visit, people would definitely be angry about that. I have bad news for you… the general public won’t care. https://www.tomsguide.com/news/microsoft-edge-is-sending-all-your-visited-pages-to-bing-how-to-turn-it-off https://www.tomsguide.com/news/microsoft-edge-is-sending-all...
  - ziml77 2y ago
    That doesn't prove that people don't care, just that Microsoft doesn't care about people.
- jojobas 2y ago
  Except Chrome indeed sends up all URLs you browse, at least by default/outside of incognito mode.
  - Dylan16807 2y ago
    Are you talking about encrypted sync data or something else?
    - magicalhippo 2y ago
      Both autosuggest[1] and Safe Browsing[2] sends URLs or "portion of" URLs home to Google. At least Google is fairly transparent about it, if you look for it. And I'd trust them way more than a tiny company making a "dime a dozen" app. [1]: https://support.google.com/chrome/answer/13730681?hl=en#zippy=%2Chow-we-protect-your-data%2Chow-the-address-bar-works https://support.google.com/chrome/answer/13730681?hl=en#zipp... [2]: https://support.google.com/chrome/answer/13844634?hl=en&ref_topic=9845306#zippy=%2Chow-safe-browsing-works https://support.google.com/chrome/answer/13844634?hl=en&ref_...

impure 2y ago

I thought every feed reader did this. Well the ones with a server anyways.

westcort 2y ago

I made a bookmarklet that makes reading articles easier so that no browser extensions or reader apps need to access the data. Here is the link: https://news.ycombinator.com/item?id=40588645 https://news.ycombinator.com/item?id=40588645