Technology

In any other engineering discipline this would he negligence.

Both the company, for failing to protect its users; and a large majority of its users, for doxxing and libel.

Its unfortunate that it happened this way, but now the people who are being libeled against and doxxed have the ability to find out about it where they didn't before.

I mean, it's on brand. The doxxing app is successfully doxxing people...

You get 89 cents in the settlement. Do you prefer to get a direct deposit or a check?

the entire UK government disliked this comment

This has been the case for a long time, so suddenly you have apps like Tea that encourage you to upload info of other people. So now even the few that take care not to upload their info can be nicely monitored. And the Gestapo does not even need to pay their informants for it.

This wasn't vibe coding, it's incompetant devops.

You have to go out of your way to make these buckets public like this. Several giant "Everyone will have access to this" warnings, re-authentication, a permanent warning symbol on the dashboard AND regular e-mails reminding you that you have a public bucket. I don't even think you can do this via the API, it requires a human to manually make this setting.

I'm guessing that they couldn't figure out how to configure the Access Control Lists and just made it public so that it would work. That's fine in a test environment, without any user data but it's pure incompetence to have a production system setup this way.

Now there are two of them. A second breach has hit the app.

The only thing that surprises me about this is that it didn’t happen earlier.

I'm way out of the dating game at this point, and also a man, so it's very likely that I'm just out of the loop

But I hadn't heard anything about this app until a couple weeks ago when I saw an article or two about it

Then about a week later this happened

So I kind of feel like maybe most of the assholes who did this were similarly unaware of it until it got some exposure and then it was on their radar.

I would certainly imagine that most women using this app probably weren't telling the angry misogynists in their lives about this app.

Ostensibly, a noble goal. Practice is a bit more fuzzy.

Also: nothing is ever new

And live in a cave! 😬

It would be nice if also they secured data too.

Fucking simple concept which major businesses are economically compelled to gaslight you out of.

So the problem is in economics.

Each such business provides all of their infrastructure, expensive, good and well-maintained (Google has its own Internet cables), which is not separated from their application services.

So one provider of infrastructure (in the wide sense, solving all the problems) usually serves many users of their own application and many application providers (I'm inventing terms) without their own infrastructure.

While user of an application generally can't switch infrastructure providers as they want. It's kinda technically fine and normal (there are NTP server pools, one could in the olden days search many FTP servers for the needed file, and so on), but doesn't happen IRL. Because there's no standard way for pooling resources and tracking them, and there's no applications using it.

So - the data model (cryptographic global person identities, globally identified by some derived hash posts (a post is, say, datetime, author, some tags, content, hash of it all, signatures, I dunno) (creation of a group or a vote or a changing of privileges or moderation can be a post too), for forming a representation for the user a group is "replayed" in the right order to know which user had a privilege to, say, moderate posts etc ; one can also generate group snapshots from time to time when replaying thus, by the group owner identity, to make it faster) is orthogonal to the service model. That's important so that it were fit for alternative service models, like sneakernet or offline-enabled mesh or anything delay-tolerant. Or at least a p2p kademlia DHT-based service model.

The service model - the core of it all is a tracker service. It works like a tracker in BitTorrent (or maybe Hotline, but that's old), except with signed announces, and it tracks search and storage and relay and maybe even computation services (which announce themselves to it). A search service gets storage services from trackers and indexes their contents (one can even announce objects to a search service similarly to trackers, might be better) to search by tags. A storage service just stores objects and yields them. A relay service must be harder, you the user must somehow announce (to trackers too?) which relay service you are registered on at this moment, a bit like SIP or like SMTP (only very temporary), so that messages to that relay service would reach you.

The client would just request a bunch of trackers for all things they need - to search for stuff for services, then request these services and merge their results. Forming a group representation is "searching for stuff" too, and then getting the objects referenced by index service responses from a bunch of storage services. To notify another user that you've sent them a message one can use a relay service.

I think it's easy to see that it's kinda primitive other than requiring proper cryptography. And it's a global system working over the Internet (except no, it doesn't exist). Similar to NOSTR, but I think better due to separation of data model and service model.

The advantages of this - one still can make any kinds of applications using such common infrastructure, but the resource-based feudalism we have this might hurt. Similar to how BitTorrent keeps working despite quite a few people not liking it.

The disadvantages - well, stuff will get lost, there are paid BT trackers but no paid BT peers, while in such a system paid storage and other services would be a thing (still much better than Facebook).

Posted on an article about an app encouraging different users to upload info about you without your consent. Yes, really simple.

don't upload it to the internet!

or use a smart phone

or corporate searches that track you

or go to any website with ads - they track you

hell don't even search the internet! your ISP tracks dns requests

or use a modern tv that tracks what is on your screen

or you can do custom phone from - just unlock the bootloader, root it, and install! then just setup pihole/adguard/self-host everything

it's simple, for privacy just go live in a yurt in the woods to not be tracked 24/7

I was today years old when I learned that Ashley Madison is still in operation

404media did a great piece about what happened. available as podcast too. https://www.404media.co/a-second-tea-breach-reveals-users-dms-about-abortions-and-cheating/

No, the direct opposite

Doesn't matter what side you're on, when you're extremist, you're extremist