Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notion leaks email addresses of all editors of any public page

twitter.com

Post reply on HN
Print view View original

111–120 of 162 posts

Re: Notion leaks email addresses of all editors of any public page

#111

Post by halJordan »

janalsncm wrote: post #94
mschoening wrote: post #87

Earlier quoted context omitted.

When you start contributing to a page you see this: https://cleanshot.com/share/trYdqYFZ This is pretty meh. We will deploy more explicit messaging while we mitigate this properly.

The warning is too vague. “May become visible” kind of sounds like Notion doesn’t know whether they will become visible or not.

It's definitely weasel wording. And moreover, it's honestly tiring to constantly have these weasel words carrying such weight, and then jackasses getting bent out of shape that they aren't given the benefit of the doubt anymore.

Re: Notion leaks email addresses of all editors of any public page

#112

Post by linsomniac »

linsomniac wrote: post #34

Very timely. I literally ran a Claude prompt "compare and contrast Notion vs Obsidian" and flipped over to HN while it was thinking, and this comes up. Thanks HN!

Thanks for the pointers everyone, there were quite a few that weren't on my radar. My use-case isn't a "personal knowledge graph", I'm building an ADU and so I'm looking for a lot of components: todo lists, inspiration boards, costing/spreadsheets, ordering lists, documents.

Notion looks to be pretty capable in that regard, so the knowledge graph options really fell short (Logseq, Obsidian, Joplin, Trilium, Craft). They are likely good if your use case is in their lane.

Anynote looks like a good option, except it doesn't have a web client, just the Android/iOS (and MacOS I guess?).

Milanote sounds like a possible option if my use were more inspiration-board heavy.

I'll probably give Anynote a try, but Notion really does seem to be a compelling product if it weren't for the jackassery that lead to this thread to begin with.

Re: Notion leaks email addresses of all editors of any public page

#113

Post by UqWBcuFx6NV4r »

chinathrow wrote: post #42
EMM_386 wrote: post #26

Earlier quoted context omitted.

That's just ... absurd. The flaw itself is absurd but then just accepting it as "by design" makes it even worse.

It's also trivially easy to fix. 1 min delete and deploy.

You literally don’t know that. Add this to the mammoth file titled “HN comments in which the author makes some completely unsubstantiated technical claim”

Re: Notion leaks email addresses of all editors of any public page

#114

Post by hresvelgr »

amaccuish wrote: post #96
freedomben wrote: post #35

Earlier quoted context omitted.

For a personal knowledge base? I would stay far away from anything proprietary for personal notes. I love logseq though I'm increasingly worried it's abandonware

https://anytype.io/ is the open-source CC of Notion AFAIK.

Anytype is a well-made product, but its data format is somewhat opaque and like Notion suffers from significant complexity. I switched to Obsidian last year, which while proprietary at least gives me the option to move my data somewhere else if I should need to. Anytype doesn't make it easy to get your data off its platform.

Re: Notion leaks email addresses of all editors of any public page

#115

Post by markdown »

csallen wrote: post #72
chinathrow wrote: post #69

Earlier quoted context omitted.

Of course they can fix it, come on. They can easily withold information they put out intenionally.

The whole point of that comment is that it's not that easy. There are potential side effects and consequences that are difficult to architect around.

Except it is.

If you can't easily architect around it, then don't do what you're trying to do.

"Oh I needed to disclose user data in order to make more money" isn't an acceptable excuse.

Re: Notion leaks email addresses of all editors of any public page

#116

Post by markdown »

mschoening wrote: post #75

Hi, this is Max from Notion. First: This is documented and we also warn users when they publish a page. But, that’s not good enough! Second: We don’t like this and are looking at ways to fix this either by removing the PII from the public endpoints or by replacing it with an email proxy similar to GitHub’s equivalent functionality for public commits. P.S: Some folks here have speculated that this should be a 1 minute…

> P.S: Some folks here have speculated that this should be a 1 minute fix. Unfortunately that is not the case. :(

Nonsense! It is a 1 minute fix. You just don't want to take a $ hit from inconveniencing users by breaking another part of your app.

Pull your thumb out and do the right thing. Implement the 1 minute fix, and then spend the rest of the week or month fixing the other parts of your app that might break as a result of fixing this.

Re: Notion leaks email addresses of all editors of any public page

#117

Post by bryanhogan »

linsomniac wrote: post #112
linsomniac wrote: post #34

Very timely. I literally ran a Claude prompt "compare and contrast Notion vs Obsidian" and flipped over to HN while it was thinking, and this comes up. Thanks HN!

Thanks for the pointers everyone, there were quite a few that weren't on my radar. My use-case isn't a "personal knowledge graph", I'm building an ADU and so I'm looking for a lot of components: todo lists, inspiration boards, costing/spreadsheets, ordering lists, documents. Notion looks to be pretty capable in that regard, so the knowledge graph options really fell short (Logseq, Obsidian, Joplin, Trilium, Craft). T…

I wrote a more detailed comparison of Notion vs Obsidian here: https://bryanhogan.com/blog/notion-obsidian-comparison

I kinda dislike where Notion is heading though, forcing more and more things on their users without any ways to disable them. But yes, it's capable to do what you are looking for.

Maybe Affine could also work though, you can self-host it and it's more customizable: https://affine.pro/

Re: Notion leaks email addresses of all editors of any public page

#118

Post by bryanhogan »

hohithere wrote: post #17

Any self hosted solution?

I'd say Affine or Obsidian.

Obsidian is built on-top of just markdown files, so you can do whatever you want with them. E.g. if you need multiplayer editing you could use 3rd party solutions or even something like HedgeDoc.

Affine is more closer to Notion and self-hostable.

Obsidian: https://obsidian.md/

Affine: https://affine.pro/

Re: Notion leaks email addresses of all editors of any public page

#119

Post by bryanhogan »

Pi9h wrote: post #49
hohithere wrote: post #17

Any self hosted solution?

I’m building Docmost, a self-hosted alternative to Notion and Confluence. It’s open-source, easy to self-host and feature-packed. GitHub: https://github.com/docmost/docmost .

I'm not sure DocMost is a Notion alternative, it's just a note-taking tool without many of the features that give Notion its unique position.

I'm always disappointed by note-taking tools calling themselves a Notion alternative when they do not provide an alternative to Notion and are instead just another note-taking tool with a simple UI.

If you want to be a Notion alternative provide the things that make Notion great, e.g. the database functionality. It's okay to be a simple colaborative notes tool, but that is not a Notion alternative.

Re: Notion leaks email addresses of all editors of any public page

#120

Post by danpalmer »

mschoening wrote: post #75

Hi, this is Max from Notion. First: This is documented and we also warn users when they publish a page. But, that’s not good enough! Second: We don’t like this and are looking at ways to fix this either by removing the PII from the public endpoints or by replacing it with an email proxy similar to GitHub’s equivalent functionality for public commits. P.S: Some folks here have speculated that this should be a 1 minute…

What are you doing to address the process/structural issues that allowed such a privacy issue to get to production?

What are you doing to address the support issues that allowed such a privacy issue to remain after being reported?

What are you doing to address the issues with the company's prioritisation framework that allowed such a privacy issue to remain for 4 years?

Which authorities are you reporting the privacy issue to in line with local requirements?

Post reply on HN