ETA: Oh my god, this JUST HAPPENED TO ME. As I was editing the LJ version of this entry, I was redirected to an edit page for someone else's private entry. It was a user I don't even know. WHAT THE SHIT, YOU GUYS.
Reblogged from
starlady :
PSA: Massive LiveJournal Privacy BreachThere are multiple reports out that LiveJournal's latest code push has created a bug wherein users can, at random, view and edit other users' entries.
This includes private and screened entries, by the way. People are also reporting being given access to the edit pages for other users' profiles, icons, account settings, etc. For more information, click that link and the others it gives you -- there are links to the actual bug reports in lj_releases, and links to journal entries by other users who are trying to analyze the shape and scope of the problem.
This was clearly an accident on the part of LJ. But the fact is that as of now, LJ has made no official statement to address this. They haven't apologized or explained what happened, they haven't told us what steps they're taking/have taken to correct the problem and/or prevent it from happening again. I don't know the extent of it or whether it's been resolved or not. They haven't even acknowledged that it's happening.
Meanwhile, back at the ranch, some Dreamwidth users are having trouble with importing stuff from LJ, or crossposting to it. DW staff was quick to make a post addressing the problem and apologizing for the delay. They've explained what's causing the trouble, and assured us all that they're in the process of adjusting the code that facilitates these tasks to accommodate the changes LJ has made. Whereas the LJ staff has been very occasionally responding to its users' (generally panicked) comments and questions by
telling people to go open a support request so that the Support people can deal with it (read:
it's not my job to help you with this), DW's staff has been responding to comments and questions in a sensitive and human way that shows actual attention. And they've done all this without ever once criticizing Livejournal.
When I grow up I hope I'll be that classy. In the meantime, I will be deleting my Livejournal account (I'm leaving it up for a day in the hope that some of you will see this entry, but taking down all my other entries). If you see the sense in this choice or are at least into considering your options,
dw_codesharing is choc-a-block with free codes. The staff are awesome, ads are nonexistent, site glitches are rare, and the water is warm. Hope to see you there.
ETA II: It now appears that LJ staff are dismissing and actively lying about the problem, almost in the same breath. Per
the latest post in lj_maintenance , the official word is that a) the problem was only happening for about three minutes and has long since been resolved; and b) okay, yeah, a lot of people were able to access private and potentially sensitive information they weren't supposed to see, sure, but the staff haven't heard of any instances where site content was actually *tampered* with, so really the problem "had no effect on security." Those are their exact words. In my eyes this couldn't be clearer: the Livejournal staff just don't care that their users' privacy was compromised. Protecting our private content is no longer something that this company takes seriously. For more info, see all the ETAs at the end of
this post by
eruthros.