7 ms·
Notion leaks email addresses of all editors of any public page
- DropDead 6mo agoBig companys need to start caring more security and privacy of its users and employees
- bitmasher9 6mo agoI think we’ll start seeing consulting agencies advertise how many vulnerabilities that can resolve per million token, and engineering teams feeling pressure to merge this generated code. We’ll also see more token heavy services like dependabot, sonar cube, etc that specialize in providing security related PR Reviews and codebase audits. This is one of the spaces where a small team could build something that quickly pulls great ARR numbers.
- contractlens_hn 6mo agoThe same vertical-specialist logic applies in legal tech. Law firms are drowning in contract review — NDA, MSAs, leases — and generic AI gives them vague answers with no accountability. The teams winning there aren't building 'AI for lawyers', they're building AI that cites every answer to a specific clause and pins professional liability to the output. That's a very different product than a chatbot.
- dgb23 6mo agoWhat is needed there are custom harnesses that don’t let the LLM decide what to do when. Use their power of pattern matching on data, not on decision transcriptions.
- delecti 6mo agoDoes SonarCube use LLMs these days? It always seemed like a bloated, Goodhart's law inviting, waste of time, so hearing that doesn't surprise me at all.
- estimator7292 6mo agoThe problem is that they don't "need" to. There's no consequences for not caring, and no incentive to care. We need laws and a competent government to force these companies to care by levying significant fines or jail time for executives depending on severity. Not fines like 0.00002 cents per exposed customers, existential fines like 1% of annual revinue for each exposed customer. If you fuck up bad enough, your company burns to the ground and your CEO goes to jail type consequences.
- rafram 6mo agoThis kind of response went out of fashion after Enron. Burning an entire company to the ground (in that case Arthur Andersen) and putting thousands out of work because of the misdeeds of a few - even if they were due to companywide culture problems - turned out to be disproportionate, wasteful, and cruel.
- knome 6mo agothe answer to that is a functional social safety net for the innocent employees to land in, not allowing companies to violate the law with impunity.
- rafram 6mo agoYou’re describing a system where taxpayers foot the bill for data breaches.
- wry_durian 6mo agoThat's exactly backwards. In the current regime, it's precisely the billions of people who are affected by data breaches (and who happen to be taxpayers!) who are footing the bill.
- matheusmoreira 6mo agoNot at all. Make the guilty corporation pay for all of it.
- fnoef 6mo agoNah. They care about profits only, the sooner the better, so everyone can cash out and move to their next “venture”
- estetlinus 6mo agoI don’t think ”caring about profits” applies to any company 2026?
- phyzome 6mo agoPeople need to start voting in politicians who will meaningfully punish corporations who don't.
- autoexec 6mo agoMore importantly people need to start voting out politicians who refuse to. It's easy to elect people because of things they promise, but its what they actually do that matters.
- account42 6mo agoWe already do vote out parties when they do unpopular stuff. And then vote them back in to vote out the other party when they also does unpopular stuff. This isn't a solution.
- subscribed 6mo agoSo not sure where you are from, but over here both main parties and almost all press and TV would viciously push back (and actually are trying to do it right now with another party). The reason for it is very simple: big companies bribe politicians and.... buy ads in media.
- account42 6mo agoVoting isn't enough when all the options to vote for won't do anything about this.
- steve1977 6mo agoMaybe the board and shareholders of big companies need to be held accountable financially instead of being able to hide behind legal constructs.
- ksidosjcosjcisj 6mo agoAnd on that day, Satan will be skating to work.
- hluska 6mo agoDid you really start an account to post this shit?
- ksidosjcosjcisj 6mo agoYep. Problem?
- resident423 6mo agoCompanies will only care if they have a reason to. People need to start caring about their privacy and security and be willing to change product if they have to. We can blame companies and insist they start caring, but this makes no difference to them, people complain for a while and then they move on and the earnings remain unchanged.
- amazingamazing 6mo agoI've been toying around an architecture that sets things up such that the data for each user is actually stored with each user and only materialized on demand, such that many data leaks would yield little since the server doesn't actually store most of the user data. I mention this since this sorts of leaks are inevitable as long as people are fallible. I feel the correct solution is to not store user data to begin with. some problems I've identified: 1. suppose you have x users and y groups, of which require some subset of x. joining the data on demand can become expensive, O(x*y). 2. the main usefulness of such an architecture is if the data itself is stored with the user, but as group sizes y increase, a single user's data being offline makes aggregate usecases more difficult. this would lend itself to replicating the data server side, but that would defeat the purpose 3. assuming the previous two are solved, which is very difficult to say the least, how do you secure the data for the user such that someone who knows about this architecture can't just go to the clients and trivially scrape all of the data (per user)? 4. how do you allow for these features without allowing people to modify their data in ways you don't want to allow? encryption? a concrete example of this would be if HN had it so that each user had a sqlite database that stored all of the posts made per user. then, HN server would actually go and fetch the data for each of the posters to then show the regular page. presumably here if a data of a given user is inaccessible then their data would be omitted.
- yellow_postit 6mo agoI’ve always liked this idea but I think it eventually ends back up with essentially our current system. Users have multiple devices so you quickly get to needing a sync service. Once that gets complex enough, then people will outsource to a third party and then we are back to a FB/Google/Apple sign in and data mgmt world.
- requilence 6mo agoDisclosure: I work at Anytype. This is the architectural bet we took, so I'll answer your four problems directly. Premise: treat it as certain that the server will eventually be compromised, subpoenaed, or misconfigured. So the server must hold nothing that can be decrypted or linked to a specific user's content. Users hold their own encryption keys, the server stores ciphertext, and there is no UUID→identity mapping at the sync layer. Sync runs over any-sync, which is peer-to-peer-capable; intermediate nodes see ciphertext. On your four problems: 1. O(x*y) joins - pushed to the client, because the server can't decrypt enough to do them. 2. Offline members - eventual-consistency sync and CRDT. 3. Client-side theft - if an attacker has the user's keys, they have the data. Intentional: no server-side gate to break means no server-side gate to exfiltrate at scale. We're considering optional 2FA at the infrastructure layer as an additional barrier to data retrieval. 4. Unwanted modifications - content is signed with user keys and validated on read. Real cost is on the product side: no server-side AI over your notes, no server-side full-text search, slower cold-start, and harder to build product analytics (no access to user data). Granular ACLs are also harder — permissions are enforced by key possession, so revoking access often requires key rotation rather than a permission-flag change. But the exact bug this post is about (a server endpoint that maps a public UUID to an email) is structurally impossible in this model, because there's no such mapping on our servers to misuse. any-sync and our data format (any-block) are MIT, if you want to poke at how it works: https://github.com/anyproto https://github.com/anyproto
- VladVladikoff 6mo agoThe tweet is only a few words, you really need an LLM to write that for you???
- RomanPushkin 6mo agoIt has been an issue for at least 5 years. I remember one dude from HN deanonymized me around 5 years ago by looking at my notion page.
- matheusmoreira 6mo agoLooks like we're gonna have to go full CIA mode and shift into maximum OPSEC if we want any semblance of privacy. Gotta compartmentalize everything...
- varispeed 6mo agoInteresting that people immediately think of workarounds instead of rejecting the governments and corporations behind the thing. Year by year Overton Window moves, workarounds become more and more involved and eventually people will give up and become just living datapoints on corporate/government dashboard.
- matheusmoreira 6mo agoRejecting the government is insurrection, it's the same as becoming a terrorist.
- steve1977 6mo agoA terrorist works with terror (fear). Also at least in democracies you can reject the government without physical violence.
- matheusmoreira 6mo ago> A terrorist works with terror (fear). Extreme, yet I can't deny its effectiveness. How do you radicalize a decadent, apathetic population? People who literally do not give a shit about important issues because they have too much to lose, because they'd have to give up their comfortable lifestyles? Terrorists attack them directly, breaking the illusion that their almighty governments can protect them. They gave up all those freedoms, paid all those taxes, sacrificed their principles, all in the name of security... Only to discover they aren't safe at all. Quite ironic, really. No wonder governments worldwide are willing to pull out all the stops against terrorists. > Also at least in democracies you can reject the government without physical violence. Doubt. To me it seems democracies exist just to give people the illusion of choice, not to give them any real power. The reality is people are manipulated by the mass media, their very wants and desires are shaped by it. Censorship is growing world wide, even in "democratic" governments, because they want to reserve the right to shape the population's collective mind. And when even that fails, it turns out every politician answers to the corporations anyway. They literally buy laws via lobbyists. If by some miracle some law gets passed to benefit people at the expense of corporations, the lobbyists swoop in and neuter it with hidden loopholes and fine print.
- Tiberium 6mo agoApparently this is officially documented at https://www.notion.com/help/public-pages-and-web-publishing#how-visitors-interact-with-your-notion-site https://www.notion.com/help/public-pages-and-web-publishing#... buried in a note: > When you publish a Notion page to the web, the webpage’s metadata may include the names, profile photos, and email addresses associated with any Notion users that have contributed to the page.
- chinathrow 6mo agoThis is, as a notion user with public pages, beyond stupid.
- huflungdung 6mo ago[dead]
- ArchieScrivener 6mo agoDon't attribute to stupidity what can be explained by malice.
- gib444 6mo agoThis phrase needs way more traction.
- sph 6mo agoYes! I’ve always maintained Hanlon’s razor needs to be reversed in matters of computer security.
- protocolture 6mo agoTheres just a higher form of malicious stupidity, where the people who own these platforms can be selectively, maliciously stupid where it comes to security.
- EMM_386 6mo agoThat's just ... absurd. The flaw itself is absurd but then just accepting it as "by design" makes it even worse.
- hohithere 6mo agoAny self hosted solution?
- Throwaway838333 6mo agoAnytype
- Pi9h 6mo agoI’m building Docmost, a self-hosted alternative to Notion and Confluence. It’s open-source, easy to self-host and feature-packed. GitHub: https://github.com/docmost/docmost https://github.com/docmost/docmost.
- bryanhogan 6mo agoI'm not sure DocMost is a Notion alternative, it's just a note-taking tool without many of the features that give Notion its unique position. I'm always disappointed by note-taking tools calling themselves a Notion alternative when they do not provide an alternative to Notion and are instead just another note-taking tool with a simple UI. If you want to be a Notion alternative provide the things that make Notion great, e.g. the database functionality. It's okay to be a simple colaborative notes tool, but that is not a Notion alternative.
- Pi9h 6mo agoPerhaps try it first before dismissing it as just a “note-taking tool,” which it isn’t. We have support for team-spaces, permissions, diagrams, real-time collaboration, comments, page verification workflows, AI, SSO/LDAP, search, audit logs, API, public sharing, and a lot more. Btw, we have plans to introduce a database-like feature.
- tweetle_beetle 6mo agoConfluence and Notion are not equivalent products. Docmost looks to be similar to Confluence - a full fat wiki, but the whole point of Notion was its database-like features.
- SadErn 6mo ago[dead]
- georgespencer 6mo agoNotion’s macOS app is some of the worst software I’ve ever used. If there is a platform design idiom, they likely break it without a second thought.
- breakfastduck 6mo agoWell thats because it isn't really a macOS app. its just the web app.
- uxjw 6mo agoIt loves to hog disk space for some reason. An hour after installing, service workers are using 7gb. I have very few files uploaded so I don’t know what it’s caching.
- ksidosjcosjcisj 6mo agoWebwrapper apps should die a quick painful death and those involved in deciding that a given app should be a webwrapper should stub their toes on furniture corners every 30 minutes of their lives. These apps are a disease and no one should be using services that offer them.
- rvz 6mo agoIt's Electron. The lowest common denominator.
- staticassertion 6mo agoIsn't this very typical? Also, what is the proposal?
- lioeters 6mo agoRecently I checked back on Notion after a year or so of not seeing it. I was going to recommend it to someone as an example of hypertext, but I see now it calls itself an "AI workplace that works for you" and "Your AI everything app". This company means nothing now, seriously what happened.
- skydhash 6mo agoMaybe I'm a computer nerd. But I know Unix and I'm so happy that I can avoid such software in my daily life.
- argee 6mo ago> I was going to recommend it to someone as an example of hypertext What does this mean?
- thatxliner 6mo agoThey’ve basically positioned themselves as a workplace app for years now. A fully integrated project management and documentation really is just asking for AI to be part of it
- homeonthemtn 6mo agoI think it does all of this really well... Especially as someone coming from the dystopia of permissions management that is Atlassian, I really like notion.
- ksidosjcosjcisj 6mo ago
- linsomniac 6mo agoVery timely. I literally ran a Claude prompt "compare and contrast Notion vs Obsidian" and flipped over to HN while it was thinking, and this comes up. Thanks HN!
- freedomben 6mo agoFor a personal knowledge base? I would stay far away from anything proprietary for personal notes. I love logseq though I'm increasingly worried it's abandonware
- Saris 6mo agoObsidian is at least storing in markdown. Although some plugins probably add additional formatting that isn't standard.
- linsomniac 6mo agoMy use case isn't likely to be a personal knowledge base, I've just never had any traction on that sort of thing beyond a blog/microblog. I'm wanting to use something specifically for organizing the building of a shop/ADU: todo lists, pinterest-like inspiration boards, costing spreadsheets...
- vovavili 6mo agoYou don't lose anything from the proprietary nature of Obsidian because it's just markdown files all the way down.
- freedomben 6mo agoYeah to clarify, I mean Notion was proprietary. Obsidian I would call borderline because as you mentioned, the markdown file storage format.
- zaggle 6mo agoLogseq was captured by VC a long time ago. They switched from open files to a database, their synching product is closed source (not selfhostable), and they have built-in telemetry.
- e-dant 6mo agoAre security vulnerabilities good marketing?
- colesantiago 6mo agoTransparency is a good thing?
- Grappelli 6mo ago[flagged]
- mschoening 6mo agoHi, this is Max from Notion. First: This is documented and we also warn users when they publish a page. But, that’s not good enough! Second: We don’t like this and are looking at ways to fix this either by removing the PII from the public endpoints or by replacing it with an email proxy similar to GitHub’s equivalent functionality for public commits. P.S: Some folks here have speculated that this should be a 1 minute fix. Unfortunately that is not the case. :(
- ktallett 6mo agoConsidering it was reported in 2022, and it is obviously an error, I don't think it is unfair for people here to have expected it to be fixed by now since it was first reported.
- mschoening 6mo agoI agree. We will do better.
- _kl 6mo agoCan you please share an update when you can? will this be prioritised and fixed or not.
- wferrell 6mo agoCan you share the warning? I made a public page and would say it was not clear to me this was a consequence of doing that. The warning as I remember it (a month ago) makes it sound like the information on this page is going to be public -- not - oh yeah the email addresses of everyone who edited this page will also be leaked.
- mschoening 6mo agoWhen you start contributing to a page you see this: https://cleanshot.com/share/trYdqYFZ https://cleanshot.com/share/trYdqYFZ This is pretty meh. We will deploy more explicit messaging while we mitigate this properly.
- ibrahimhossain 6mo ago[dead]
- jdgiese 6mo agoI love Notion and use it extremely heavily. I've also built a few integrations with Notion. I think it's a great app that uses AI very well, and they continue improving. Hopefully they fix this though! Also, their API has recently been upgraded quite a bit and now supports database views as a first class object. I have a few other small requests regarding their public API.
- rvz 6mo agoWhy people choose these services and have zero care about security is beyond me. Tells me everything I need to know about this industry. No regard or seriousness to security at all.
- shojivr 6mo agobecause majority dont care about their security and prefer conveniences
- qotgalaxy 6mo ago[dead]
- skissane 6mo agoI really dislike Notion. Its public API is full of bizarre arbitrary limitations, like a rich text database field can only contain max 100 “child blocks”, where each change in formatting consumes one child block-but its web UI doesn’t have this issue. Yes, I realise the undocumented private API that the web UI uses doesn’t have this issue either-but I shouldn’t have to, and I haven’t. I don’t love Confluence, but at least it doesn’t do this to me.
- O4epegb 6mo agoI reported this and several other issues with public pages almost six years ago. Some of them were fixed after many years - but they're very slow to handle it. I never received any bug bounty or anything. Here's a Reddit post just as confirmation: https://www.reddit.com/r/Notion/comments/hqyxid/possible_security_issue_comments_on_public_page/ https://www.reddit.com/r/Notion/comments/hqyxid/possible_sec.... I also reported it privately two months prior, of course.
- Akuehne 6mo agoTwo things. One, surely I'm not the only one who knew this data was being stored? Two, calling it a "leak" feels like a stretch when the data was publicly accessible by design from the start. Yes, some users probably didn't realize their edits to public pages were saved publicly, and that's a legitimate UX complaint. But some of the responsibility has to sit with the user. Otherwise we'd be running daily headlines about Meta "leaking" user data to every advertiser with a checkbook.