3 ms·
Apparently this is officially documented at https://www.notion.com/help/public-pages-and-web-publishing#how-visitors-interact-with-your-notion-site https://www.
by Tiberium 6mo ago
Apparently this is officially documented at https://www.notion.com/help/public-pages-and-web-publishing#how-visitors-interact-with-your-notion-site https://www.notion.com/help/public-pages-and-web-publishing#... buried in a note:
> When you publish a Notion page to the web, the webpage’s metadata may include the names, profile photos, and email addresses associated with any Notion users that have contributed to the page.
- chinathrow 6mo agoThis is, as a notion user with public pages, beyond stupid.
- huflungdung 6mo ago[dead]
- ArchieScrivener 6mo agoDon't attribute to stupidity what can be explained by malice.
- gib444 6mo agoThis phrase needs way more traction.
- sph 6mo agoYes! I’ve always maintained Hanlon’s razor needs to be reversed in matters of computer security.
- protocolture 6mo agoTheres just a higher form of malicious stupidity, where the people who own these platforms can be selectively, maliciously stupid where it comes to security.
- EMM_386 6mo agoThat's just ... absurd. The flaw itself is absurd but then just accepting it as "by design" makes it even worse.
- chinathrow 6mo agoIt's also trivially easy to fix. 1 min delete and deploy.
- varenc 6mo agoI'm guessing it's not trivial to fix without breaking other things? The weakness seems to be that anyone can turn UUIDs into details like email. But I assume this functionality is necessary for other flows so they can't just turn off all UUID->email/profile look ups. And similarly hiding author UUIDs on posts also isn't trivial. Conceptually, I agree it should be easy, but I suspect they're stuck with legacy code and behaviors that rely on the current system. Not breaking anything else while fixing this is likely the time consuming part.
- chinathrow 6mo agoOf course they can fix it, come on. They can easily withold information they put out intenionally.
- csallen 6mo agoThe whole point of that comment is that it's not that easy. There are potential side effects and consequences that are difficult to architect around.
- markdown 6mo agoExcept it is. If you can't easily architect around it, then don't do what you're trying to do. "Oh I needed to disclose user data in order to make more money" isn't an acceptable excuse.
- mikae1 6mo agoSome CMSs do this in their RSS feeds as well. Can't recall which ones, but seen it.