> Yeah, so, to be clear: I'm fairly sure Linux will also have its fair share of issues that I occasionally would have to repair.
Issues with account, login and passwords would be none of them. Sure, there are other areas of common issues at times, but I have never, ever had issues logging into any of the linux OS I ran for the last 23years or so.
I've had PAM break due to distro's ridiculous policy of updating the system in place allowing for invalid combinations of files to exist. I've had Linux distros break the booting process countless times.
I'm guessing it's not trivial to fix without breaking other things? The weakness seems to be that anyone can turn UUIDs into details like email. But I assume this functionality is necessary for other flows so they can't just turn off all UUID->email/profile look ups. And similarly hiding author UUIDs on posts also isn't trivial.
Conceptually, I agree it should be easy, but I suspect they're stuck with legacy code and behaviors that rely on the current system. Not breaking anything else while fixing this is likely the time consuming part.
But a user's email isn't always forbidden. The API endpoint which turns UUIDs into a user email presumably also has use cases where you do want to expose the user email. For example, when seeing a list of people you've already invited via email to collaborate with, or listing users within your organization, etc. So a user's email isn't always forbidden PII, it depends on the context.
The trouble is the UUID->email endpoint has no idea what the context is and that endpoint alone can't decide if it should expose email or not. And then public Notion docs publicly expose author UUIDs.
Their mistake was architecting things this way. From day 1 they should have cleanly separated public identifiers from privileged ones. Or have more bespoke endpoints for looking up a UUID's email for each of the narrow contexts in which this is allowed. They didn't do this, and they certainly should have, but fixing this mess is likely a non-trivial amount of work. Though I bet it could be done immediately if they really cared and didn't mind other things breaking.
I'm absolutely not defending their choice to expose emails in this way. They should have addressed this years ago when it was first reported, and I want them shamed for failing to care. But just trying to say it's likely not a one line fix.
You literally don’t know that. Add this to the mammoth file titled “HN comments in which the author makes some completely unsubstantiated technical claim”
It literally is easy to fix. For example they could shut down the servers. Which is what they should do immediately if there is no faster fix for a privacy leak like that.
Theres just a higher form of malicious stupidity, where the people who own these platforms can be selectively, maliciously stupid where it comes to security.
The fun fact about PHP is that, there is no Pipeline problem at all. You can serve your scripts the hell you like to do. You can scale as you wish, either with vertical or horizontal. You can use Apache, nginx, etc, no one cares.
Yeah, PHP is very simple to deploy, once you have either apache/nginx/caddy/$webserver and also PHP-cgi/PHP-fpm/$php-backend and also understand unix + permissions + files and a whole lot of other things. Or alternatively, learn how to use cPanel as a user, or worse, learn what (s)FTP is, or whatever the really low end web hosters use nowadays.
I wish others learnt the "boring" way of managing your own servers, setting things up as they should, deploy processes and what not, but realistically, some people just want to run one command/click a button and have it updated, and probably that's for the better too. This Laravel Cloud thing are for those, not for people who want to/know how to run their own servers.
Sure, but I pay real money both to Antrophic and to JetBrains. I get a shitty in line completion full of random garbage or I get correct predictions. I ask Junie (the JetBrains agent) to do a task and it wanders off in a direction I have no idea why I pay for that.
https://www.aviation-gadgets.com/photo/virgin-australia-boei...
reply