> November 13, 2025 — Initial disclosure sent to Flock Safety security team
> November 14, 2025 — First follow-up requesting confirmation of receipt
> November 19, 2025 — Second follow-up; Flock Safety finally acknowledges receipt
> January 7, 2026 — Vulnerability remains unpatched (55+ days)
> I am withholding specific technical details to prevent exploitation while the vulnerability remains unpatched. However, its existence more than 55 days after responsible disclosure with no remediation, demonstrates a systemic pattern of credential mismanagement.
There was a huge fracas re: ShotSpotter in my town, where both the municipality's CIO and auditor (+ their internal research capacity) were sidelined. It took a sad amount of handholding elected officials through ShotSpotter's technical claims for them to shelve a planned deployment.
* https://medium.com/@ajay.monga73/why-developers-still-hardco...
…and of course they do the exact opposite. All a bunch of bullshit from inception.
He seems to enjoy spreading factually misguided "statistics" [0] about how Flock is "solving crime". OK buddy.
I mean, just look at how he enagages with those replies. If that's at the helm of YC? WTF.
I used to hold YC in very high regard, but these days I don't think they're materially different from any other investing shop when it comes to values.
On the bright side, they also hire dang, so that's one against 100 million.
https://medium.com/@Arakunrin/the-post-ipo-performance-of-y-...
The most likely outcome is failure, the second most likely outcome is an acquisition. Going public is a distant third
One has to wonder whether these passwords were that way purposefully to avoid accountability for privileged partners. Most of these systems are deployed with grant money that it comes from the department of justice.
https://www.ci.staunton.va.us/home/showpublisheddocument/134... (PDF)
My favorite part:
> [Activists are] also trying to turn a public records process into a weapon against you and against us.
As if people are not simply asking for something to which they are entitled through legislation.
Adults that didn’t grow up.
- someone who screams about the 1st amendment whenever they’re told they’re being an asshole
So annoying.
That being said I also don't wonder if there is a point where we're just crowdsourcing the police state?
"For their own safety", as they'd have us believe.
Quis custodiet ipsos custodes?
there is no reasonable expectation of privacy in a public setting, nor should there be. anyone arguing there should be is giving up basic rights because they're scared.
the issue is when public feeds get recorded and are allowed to be viewed at a later date. the data retention is the issue, not the privacy.
Edit: I'm standing by it. The person they hired for it has a good track record elsewhere. And much as I don't like what Flock is building as a company, at least they're building security in now, even if it wasn't front of mind for them in the past.
He's got his work cut out for him though.
This phrasing implies that the "building security in now" part improves (or decreases the awfulness of) what you don't like.
If what you don't like = bulk, systemic surveillance (of people not suspected of a crime) - how does fixing broke security make that less awful?
https://www.opb.org/article/2026/01/08/bend-flock-cameras-ai...
So, whether it's vendor A or Vendor B municipalities don't care. What they want is the capability. The municipalities have the backing of the communities -with few odd exceptions because most people in most communities want LE to "catch the perps."
https://www.nwprogressive.org/weblog/2025/11/a-preliminary-v...
https://www.cityofevanston.org/Home/Components/News/News/667...
My hope is that https://www.eff.org/deeplinks/2025/11/washington-court-rules... will make Flock get the fuck out of Washington state.
Sedona (with a handy timeline of how they accomplished it) https://livefreeaz.com
Bend, OR https://www.opb.org/article/2026/01/08/bend-flock-cameras-ai...
Hays County, TX https://www.kxan.com/news/hays-county-votes-to-terminate-flo...
Lockhart, TX preemptively rejected them https://www.kxan.com/news/local/caldwell-county/lockhart-cit...
Working on it in our city. Flock has been their own worst enemy—once people know the name of the company, they start seeing it in the news regularly. Start talking to people, show up at city meetings.
In the bug bounty community, Google Maps API key leaks are a common false positive, because they are only used for billing purposes and don’t actually control access to any data. The article doesn’t really prove ArcGIS is any different.
Moreover, university students in programs like architecture are given access to many map layers as part of the school's agreements with the organizations publishing the data. Without that access, students wouldn't be able to pick up the skills needed to do the work they will eventually be hired for. And if students can get data, then it's pretty much public.
Privacy is becoming (or already is) nearly impossible in the 21st century.
privacy while engaging with the digital world is
it isn't hard to be private. you just can't live in or go near cities/towns as much.
I anticipate the apathy to continue, and the bill to be passed along as some form of regressive tax.
a lot of the oregon towns/cities decided to cancel or not renew their contracts though, so I think they just let em get broken and then didnt pay to repair them.
Not to mention the risk of dealing with trigger happy and corrupt cops.
There is zero chance of any amount of government in these United States cooperating in any fashion large enough to change the actual Constitution. Zero.
I don't get why we treat this any differently. The only difference is they're not as obvious.
stalking requires some kind of menacing or whatnot. i seriously doubt a judge would grant a restraining order just because you think someone is following you without any interaction.
>Stalking is a crime of power and control. It is a course of action directed at an individual that causes the victim to fear for their safety, and generally involves repeated visual or physical proximity, nonconsensual communication, and verbal, written, or implied threats.
If being pervasively spied on by an increasingly fascist government doesn't make you fear for your safety you might want to brush up on your history...
...this is completely up to interpretation. again, just being followed isn't a crime nor does it violate privacy as long as it occurs in public space.
i could say someone on the subway was stalking me because they have the same schedule as me and commute at the same time.
fuck_flock•11h ago
> "I'm writing to you directly because I want there to be zero confusion about what's happening. Flock has never been hacked. Ever."
They are just lying at this point. If you get involved in advocacy related to flock you will likely hear their reps parrot this. Be ready to combat it with concrete examples like this!
shreddit•5h ago
Am i breaking into your home when you leave the door wide open? /s
doublerabbit•4h ago
It's how urban exploration folk get away exploring abandon buildings here in the UK. If you can prove you didn't create damage to gain access; a grey area.
> Trespass (Civil Matter): In England and Wales, simple trespass is typically a civil matter between you and the landowner. You cannot be arrested for civil trespass alone, but the landowner can sue you for damages or an injunction, and police may get involved if you refuse to leave when asked.
Terr_•5h ago
chrisldgk•4h ago
The part you mentioned is at around 7:29.
conductr•46m ago
House guest: but sir, where are all of your belongings?
Flock CEO: oh that, well I leave my front door open at all times. My home has never been broken into