My driver's license is scanned every time I buy beer. I'm under no illusions that it's not quite readily available in any number of leaks or disclosures.

If that sounds defeatist, maybe it is. Nothing online is private. Once it's in a database, it's only a matter of time before it's exposed. History has proven this again and again.

That's becoming the norm now, presumably because of concern that people are taking leaked scans from one site, and using it to commit identify fraud (eg. getting KYC scans from crypto exchanges and using it to apply for accounts at other crypto changes, for money laundering purposes).

Just look at Facebook. Users with real names sharing all kinds of inane schizo nonsense, extremism, building echo chambers without realizing it, becoming completely divorced from reality as perceived by the majority of people around them in meatspace, because they section themselves off in cyberspace.

I linked the plain HTTP version... which seems to rely on a series of redirects; potentially TOR:

    ~ $ curl -vLsq http://archive.today/U5Tah |& grep -Ei 'location:|title'
    < Location: https://archive.today/U5Tah
    < onion-location: http://archiveiya74codqgiixo33q62qlrqtkgmcitqx5u2oeqnmn5bpcbiyd.onion/U5Tah
    < location: https://archive.ph/U5Tah
    <title>archive.ph</title>

https://jarv.is/notes/cloudflare-dns-archive-is-blocked

Joining in with some other comments on this thread, if the stamp of a certified person was required to submit/sign apps with more than 10K or 100K users and came with personal risk and potential loss of licensure, I imagine things would change quickly.

I'm personally not for introducing more gatekeeping and control over software distribution (Apple/Google already have too much power). Also not sure how you'd make it work in an international context, but would be simple to implement for US based companies if Apple/Google wanted to tackle the problem.

I think the broader issue is that we as a society don't see data exposure or bad development practices as real harm. However, exposing the addresses and personal info of people talking about potentially violent, aggressive or unsafe people seems very dangerous.

"Don't let Toyota's 'reliable car at a reasonable price' marketing fool you, they're all about money." Yeah, but does that preclude them from selling me an actually reliable car at a reasonable price?

https://www.bet.com/article/pe65fc/apple-s-black-diversity-c...

To me this feels as if people widely thought that the Apollo Program was intended to prevent people from traveling to the moon, or Magna Carta was meant to prevent barons from limiting the king's power, or Impressionism was all about using technical artistic skills to depict scenes in a realistically detailed way.

I think sometimes confusion about Section 230 maybe points to some legal soft spots.

I think there's a trend — good or bad — for courts to see websites as accountable for users' activities on the site when those activities are systematic and collectively illegal or jeopardized, when the website is seen as encouraging the activity.

It's not hard for me to imagine a court deciding that the intrinsic nature of the website encourages systematic libel, and is therefore is somehow involved in the creation of post content.

Even more specifically, I'm not sure the "good faith" clause of Section 230 even applies to something like Tea in the case of libel, should libel be there.

Now, actually showing libel is another thing, but that's also easier for me to imagine today than even a year ago, especially in the presence of a data breach where posters are exposed.

I guess I don't see Tea as being held legally responsible for anything about the content of user posts, in the US at least, for the reasons outlined in that article. But I also wouldn't be surprised if it did happen.

The problem is the demand is there for such groups and I see posts that range from, “this guy tried to get me to get in his car”, or “man exposed himself to me”, to “man has twice approached children at my child’s school” or “I was drugged and raped after meeting with X on Y dating app”.

Lots of sexual attackers are known to multiple women.

Fact is that in lots of countries rape kits don’t get processed, it’s hard to secure a conviction, many serial sex offenders walk free and many women don’t want to go through a reliving of their trauma in court.

As a result these kinds of groups are very useful, not just for women who are actively dating, but for women who are simply existing in day-to-day public life. We have a president and a supreme court judge who both have been accused of serious sex offenses and nothing happened.

Is there a chance that some man who has done nothing wrong, gets accused by a woman in these groups? Yes of course there is a chance that could happen, but many would prefer to not take the risk of dating someone that has been accused of being a sex offender and the vast majority of posts with confirmation by multiple women confirm that bias.

These groups help keep women safer than without them. There’s a good reason why many women just don’t date at all any more. Covid lockdowns reminded them that they don’t really need it and it’s more hassle than it’s worth.

Sadly the vast majority of men are fine (not all men), but not enough call out the bad and dangerous behavior of a minority of their friends and peers. Until that happens women will be drawn to these apps and groups to try to be safer and not be a part of a sex crime statistic.

That's Pure. And they have more than 5$ I believe.

The issue is they decided to roll their own extremely questionable service and insecurely store sensitive images in a public bucket

Multiple SAAS vendors provide ID verification for ~$2/each. They should have eaten that fee when it was small and then found a way pass it onto the users later

Have you seen who has the blue checkmarks on Twitter/X now? I'll give you a hint, it's not the people who argue in good faith.

You've never visited X (formerly known as Twitter)?

Men's driver licenses were not distributed online. Only women's driver licenses were distributed online.

Where you come from, people arent allowed to share their own experiences interacting with third parties without the third parties consent?

Sounds pretty oppressive, but there are absolutely many jurisdictions where that is not the case.

Even the open platforms creep me out. I don’t like seeing unverified accounts of crime in Nextdoor, I think if you see some crime you go to the police. I had a series of in person interactions with a woman which seemed creepy in retrospect, her Nextdoor was full of creepy stuff including screenshots of creepy online interactions. At least this gives everyone clear evidence they should keep away.

Or in this case, sharing personal information about yourself...

…is clearly not the US, which has probably the most expansive understanding of “freedom of speech” in the world.

Edit: 100% are murder victims

https://bjs.ojp.gov/female-murder-victims-and-victim-offende...

2020 USA Per Capita Count of Mortality Event: Assault(Homicide), Female: 0.00139%

https://datacommons.org/tools/visualization#visType%3Dtimeli...

I think this is called "the police"

Sure any individual discussion about an individual might justifiably refer to that person as "crazy" or "ghetto trash". But the nature of online spaces, and the nature of the public discourse that tends to bring these phrases and discussions into the public eye very quickly starts painting people with broad brushes.

People also feel attacked because often times discussions tend to confuse useful rhetorical devices for conveying a point with justification for a behavior that has harmful impacts on the broader group. For example, it was pretty common to here the "bowl of M&Ms where one M&M is poisoned" analogy in the height of the "Me Too" movement. It's a useful rhetorical device for explaining why someone would fell cautious about a strange man, and why they wouldn't start from a position of trust. But it's also a terrible way of generally treating men in your life, and a terrible broad philosophy for organizations and governments to follow.

And we know this rhetorical device makes bad policy and at large is harmful to innocent people because another time in recent history when that analogy was really popular was immediately after the Sept 11 attacks when talking about Muslims in general and immigrants from Muslim countries. Surely no one would find it strange that Muslims might dislike and feel personally attacked by "people talking about crimes and terrorism done by other Muslims" in the same way that many online spaces talk about "sexual abuse/harassment done by other men". Surely we wouldn't be surprised if people felt attacked or disliked an app for sharing anonymous and private information about suspicious Muslims right? Or let's say someone noticed that black people are statistically 2x as likely relative to their population to be the offender of a violent crime[1]. You'd reasonably expect people to be bothered by an app that excluded black people from signing up and was entirely about strangers providing un-verified experiences with black people under the premise of keeping people safe.

Ultimately, people are bad at statistics and really bad at understanding the degree to which a small minority of individuals can affect a large majority of people by virtue of repeat offending. So it can be true both that lots of people have completely valid awful experiences with members of a given broad group, and that members of that group feel unfairly maligned when discussion about those experiences paints with broad, unqualified strokes.

[1]: https://bjs.ojp.gov/document/cv23.pdf

There are countries where "false defamation" could be a term of art. Japan, for instance, where spreading rumors about someone that hurt their reputation is actionable even if those rumors are true. If your boss is having an affair, for instance, and you tell all your coworkers, he can successfully sue you.

1. To prove that the factual claims made by the defendant were false, and that the defendant should have known they were false

2. That you suffered actual damages from those claims

Very hard to make happen on a dating app.

Do modern men need an app to understand this?

In some cultures, mentioning dating apps will immediately lead to negative assumptions and connections are done through vetted networks and specific establishments where "hunting" activity is allowed, some with even more boundary pushing that would be impossible in Western culture.

So much for the "anonymous" app.

What's the bar they cannot clear?

Just as Parieto indicates that the bulk of male sexual assaults are done by a few, also indicates that the bulk of female assaults and claims of sexual assault are also done by a few.

Apps like Tea only paint all men as abusive thugs. If this were done, say to black people, this app would have been shut down and a lawsuit in federal court filed. But men are OK to harass, libel, and demean.

Good on anonymous for exposing this obvious double standard. And I hope they get sued by everyone.

But regardless i do understand the appeal. Dating apps suffer from basically being a low-information market place. There are of course the malicious people, which everyone has an interest in removing from the app. However even ignoroing that its a bit of a lemons market (if you excuse how dehumanizing the metaphor is). Its very hard to tell if someone is a good date just from their profile, and people who are good dates end up in relationships and exit the market quickly while bad dates stay in the market for a much longer time. Allowing some sort of review system does solve that problem - its worked in other domains, like uber drivers or what resturant to go to. So i certainly understand the appeal of why people would want this.

We could do better in our trade at encouraging best practices in this space. Every time there's a breach , the community shames the publisher . But the real shame is on us for not establishing better auditing protocols. Security best practices are just the start. You have to have transparent, ongoing auditing and pen-testing to sustain it.

The idea has merit. You have to relinquish some control to establish security. Look at App Store, Microsoft Store , MacOS App store -- they all sandbox and reduce API scope in order to improve security for consumers.

I'm more on the side of autonomy and trust, but then we have reckless developers doing stuff like this, putting the whole industry on watch.

even the most savvy consumers slip up, or are in a hurry. it's impossible to make a perfect security decision every time

Presumably the risk/reward still favors risky practices.

There will always be lowest-common-denominator users, but there is clearly some demand for an alternative to the biggest 5 websites...

You also need to consider the fact that Epic Games is big enough that they could have just used an exploit to sideload Fortnite back on the iPhone, and the lawsuit was basically PR to draw attention to the App Store's ambiguities. That in itself shows App Stores are slowly on their way out.

> We can reduce the latency of discovery and resolution by adding software protocols.

Can we? What does this even mean?

[Edit: i guess you mean the things in your parent comment about requiring including some sort of canary token in the DB. I'm skeptical about that as it assumes certain db structure and is difficult to verify compliance.

More importantly i don't really see how it would have stopped this specific situation. It seems like the leak was published to 4chan pretty immediately. More generally how do you discover if the token is leaked, in general? Its not like the hackers are going to self-report.]

Its not like anyone intentionally posts their entire DB to the internet.

Without personal and professional consequences, the default 1 year of credit monitoring for weak security is just the cost of doing business.

You could: - make Software Engineer a protected title that requires formal engineering education and mentorship as well as membership to your country's professional engineering body (Canada already does this) - make collecting and storing PII illegal unless done by a certified Software Engineer - add legal responsibility to certified Software Engineers. If a beach like this happens they lose their license or go to jail. And you easily know who is responsible for it because it's the PEng's name on the project - magically, nobody wants to collect PII insecurely anymore or hire vibe coders or give idiots access to push insecure stuff - bonus: being a certified Software Engineer now boosts your salary by 5x and the only people that will do it actually know WTF they are doing instead of cowboys, and that company will never hire a cowboy because of liability. The entire Internet is now more secure, more profitable for professionals, and dumb AI junk goes in the trash

I think you've misread that paper. The sexual assault survey wasn't limited to sexual assaults within a relationship or limited to one's sexual orientation.

Lesbians can be sexually assaulted by men.

Link to the related web standard https://www.w3.org/TR/vc-data-model-2.0/

A private way of doing this is absolutely 100% viable with some cryptography and government support. Apparently nobody gives enough of a fuck to even try.

As for the UK's new 'porn ID' law, people are going to die. People will take their own lives when their porn browsing habits are inevitably leaked. Private companies cannot be trusted to keep their hand out of the cookie jar, they WILL link peoples' histories to their real IDs.

The solution is that we need to make it so that the majority no longer trusts anything people say.

There will be no negative knock-on effects for this, I'm sure.

--

To be less glib, I don't really see a good outcome of this in the long term. If everyone developed the right level of op-sec given the amount of bad actors on the internet, we'd effectively never communicate with another person again.

With tech savvy it is possible to understand the dangers well enough to dismiss the common advice in certain cases, but if you don't have it — you had better listen to what others are telling you. If you wish to dismiss it, you are on your own.

But this case is more like you sticking your fingers into an electrical socket, after being warned continuously not to do that, and then crying that it was the utility company's fault for putting something dangerous in your face.

We've been told since the advent of the internet to not share personal information online. If you want to take the risk, you have to accept the consequences. However, in this case the story is even worse as the intent of these people was to violate that rule not just for themselves but for other people as well.

So if you upload your id to a flash in the pan website, who's fault is it when the rookie website turns out to have expectedly low security?

That's precisely my point.

> Most (by far) CVE's are not 'honest mistakes' or missed corner cases because rocket-science; they are just sloppy programming.

This is actually true, but it's true because we have way better tooling and safer languages, which means we don't see nearly as many buffer overflows or memory management issues.

It's not that you didn't have negligent programmers back then.

> Something that should never pass review. We DO know better but people ship things and hope for the best (including the case in this post etc).

That's not new though. We've seen similar things happen in the past multiple times.

20 years ago code review was literally a bunch of meetings in a room or talk with another developer in person. Having something like github where you make a pull request, passes the automated test suite and requires a code review, etc. simply wasn't done. If in 2005 that already existed it was extremely bleeding edge.

I do have concerns about the code quality issues introduced by the abuse of LLMs, but until right before that was a thing, definitely the code quality in general has improved a lot.