Zarobi

Wow that sucks… in my car the time is off by an hour half the year because I never bother to update it for daylight savings. I assume it keeps a timer running somewhere to keep it on track

Sounds like I’m not missing much lol. I just use my phone for that stuff

That doesn’t need the internet though right? Like a button on your key fob would achieve the same effect?

I’ve never seen a car like this. Mine was made in 2021 though so I must have caught the last ship car out lol. What kind of things do cars even use the internet for? I’m struggling to imagine it

I know, but a lot of people don’t click the article, they just look at headline + comments, so it’s still a reduction of visibility or an extra step. My comment is like exposing the endpoint right there front and centre. Plus, I don’t like being personally responsible for any data breach. Maybe it’s just a tiny thing but it felt like the right thing to do

Maybe I should remove that from my comment lol, I feel like I’m contributing to a data breach or something

I don’t know much about GDPR… is it illegal to have badly written software like this? Technically the user is bypassing normal usage and “hacking” the API

They probably meant 6 digit and it was a typo. The rest of the article references 6 digits. If it’s just an integer (highly likely) it would go up to 10 digits or roughly 2 billion max users. My old coworkers and I used to joke that hitting INTEGER.MAX_VALUE for your customer ID is a good problem to have

the API endpoint GET [redacted] will return user data for any account - not just your own account - so long as you supply a valid, five-digit user ID. It doesn’t perform any authorization check or ownership validation. “Just increment the number and get someone else’s data,” she wrote.

This data includes users’ email addresses, first and last names, country, dates of birth, and whether the account has been deleted, and the API exposes all 719,517 accounts on the prayer site. “With sequential user IDs and no rate limiting, an attacker could enumerate every single account on the platform,” the hacker explained. “One GET request per user. for i in range(1, 719518): scrape(). That’s it. That’s the exploit.”

My God, that’s horrific. Plus it doesn’t even delete your data if you delete your account, it’s still vulnerable.

I remove my own default upvote from my comments because I’m a weirdo

They do, but you can’t say “this isn’t medical advice” and then turn around and give medical advice. Especially to the point of discouraging seeing a doctor.

It didn’t used to. There was the whole “memories” thing that it kept between conversations. I hated it

They still have a good export tool, that’s a reliable canary for enshittification in my experience. See: how Google butchered their export tools to be as annoying as possible for “security” reasons. The harder it is to leave, the more they care about trapping you via friction rather than keeping you via good customer experience

This is a pretty good video that goes into the intricacies of it

youtu.be/2DOd4RLNeT4

Yes this is what A.I. does. It shows you a somewhat glitchy alternate reality where that photo is coloured in instead of black and white. So it might do seemingly strange things like upgrading technology and clothes and stuff to match what people wore when colour photos were a thing.

However, it’s relatively trivial to take the A.I. photo and use it as a colour-only layer in Photoshop, while preserving the original grayscale photograph as the source of truth. It might not line up perfectly but you can smudge it around a bit to fit.

I completely deleted my Reddit account, which is not a decision I took lightly, after more than 10 years of using that website frequently. I didn’t use any of the purge apps, my comments can be fossilized under [deleted] incase it helps anyone.

Makes me wonder if that’s a good indication of quality? I highly doubt bot accounts and astroturfers would ever delete their account, it’s too valuable for them. Deleted users are kind of verified human in a way.