Stop Flock

Rare concert recordings are landing on the Internet Archive

Fiverr (gig work&#x2F;task platform, competitor to Upwork) uses a service called Cloudinary to process PDF&#x2F;images in messaging, including work products from the worker to client.Besides the PDF processing value add, Cloudinary effectively acts like S3 here, serving assets directly to the web client. Like S3, it has support for signed&#x2F;expiring URLs. However, Fiverr opted to use public URLs, not signed ones, for sensitive client-worker communication.Moreover, it seems like they may be serving public HTML somewhere that links to these files. As a result, hundreds are in Google search results, many containing PII.Example query: site:fiverr-res.cloudinary.com form 1040In fact, Fiverr actively buys Google Ads for keywords like &quot;form 1234 filing&quot; despite knowing that it does not adequately secure the resulting work product, causing the preparer to violate the GLBA&#x2F;FTC Safeguards Rule.Responsible Disclosure Note -- 40 days have passed since this was notified to the designated vulnerability email (security@fiverr.com). The security team did not reply. Therefore, this is being made public as it doesn&#x27;t seem eligible for CVE&#x2F;CERT processing as it is not really a code vulnerability, and I don&#x27;t know anyone else who would care about it.

Tell HN: Fiverr left customer files public and searchable

I wrote to Flock's privacy contact to opt out of their domestic spying program

Claude Code Routines

jj – the CLI for Jujutsu

Spain to expand internet blocks to tennis, golf, movies broadcasting times

The future of everything is lies, I guess: Work

OpenSSL 4.0.0

Google, Microsoft, Meta All Tracking You Even When You Opt Out

40% of lost calories globally are from beef, needing 33 cal of feed per 1 cal

5NF and Database Design

For the first time in the U.S., renewables generate more power than natural gas

Turn your best AI prompts into one-click tools in Chrome

Fuck the cloud (2009)