janoelze

regardless of which side the author personally finds themselves on the privacy debate here; there's cameras directed baby's changing tables. the snapshots are hosted from the ipcrawl itself. it doesn't take a genius to put one and one together. this is potentially generating imagery you absolutely don't want to host from/on your domain.

thank you, appreciate it! the backend is really as lo-fi as you can imagine, a JSON storing the pieces positions, a directory of curated images, some light session management, a little math to track connected pieces in groups.

stack is vanilla JS and node.js web socket spaghetti code. only really works on desktop right now, but probably will figure out a way to get it to work on mobile.

Is anyone here running OpenClaw productively? What are you doing with it?

And additionally a failure to handle a responsible disclosure.

The DMCA takedown also suggests at least one user was not aware of that file being public. This all comes down to what that "sharing" action specifically looked like.

ChatGPT recently had a similar case with the sharing feature on conversations leading to publicly indexed convos. That incident would have also matched the implied definition of sharing here.

it's been 5 hours. even manual action to take down the most sensitive files should have completed about 3 hours ago at most. what is happening.

(weird to share any details about this incident to uninvolved parties via email anyway)

it's worse than you think – it's an admin password to the ~whole site~

admin passwords to dating sites, that's the stuff people get blackmailed with

really bad stuff in the results. very easy to find API tokens, penetration test reports, confidental PDFs, internal APIs. Fiverr needs to immediately block all static asset access until this is resolved. business continuity should not be a concern here.

it's an imperfect system, but UMA decisions can also be disputed again, up to two times iirc, which moves the dispute/decision to a different group of UMA whales. tbh, i think this is as good as it gets – unless you stay out of this completely.