kevcampb

Last week Claude seemed to trigger /feedback automagically in a session, even though we've got that turned off in our org settings. Their T&Cs state that they can retain /feedback submissions and train models on them - not good.

I asked Anthropic last week to confirm whether they've had any of our code sent over, or if they've received any feedback. They've stopped responding to my support requests.

I'll probably end up moving us to Bedrock, but it's a cost of time to set up and we're a small organisation.

Seems it was not the official Anthropic plugin, the article has been revised

Anthropic's supply chain potentially being compromised feels like it should be bigger news

Any recommendations for alternatives for just Confluence and JIRA?

I've been looking at switching to Notion and Linear, but just haven't had the time to complete evaluation.

Worth reminding everyone of previous discussion when Atlassian opted-in all customers by default for their data to be used for model training.

https://news.ycombinator.com/item?id=47833247

This goes live on August 17. If you haven't switched it off your company IP will be used to train their future models.

They've just been released

https://security.snyk.io/vuln/SNYK-DEBIAN13-NGINX-16732761

https://security.snyk.io/vuln/SNYK-ALPINE323-NGINX-16722461

So it seems that Snyk is taking almost a week to get advisories out for an RCE

It seems that Snyk isn't picking this up on our docker images. They have a vulnerability published for the nginx binary itself.

https://security.snyk.io/vuln/SNYK-UNMANAGED-NGINX-16679754

But they've not released any vulnerability for the Alpine or Debian packages.

Does anyone know what's happening here? Seems concerning that there's a 2 day old RCE not being picked up.

That's on Google apps, that's not on Chrome. That's not Chrome sending your browsing data or content from inside webpages to Google.

This seems somewhat specious - it's also quite possible that they just altered the wording to make it less verbose. Does anyone have access to the link "Learn more about on-device AI"?

If Chrome starts sending data from the browser back to Google, that's going to be a huge compliance issue. If you work for a company that processes customer data in the browser, you're going to need to ban Chrome.

"Your available data contribution settings will be available no later than May 19, 2026."

So let me guess, they're hoping that we forget about this by then, so that they can scoop up our data? I can't think any other reason for it.

Unfortunately that one has a subheading of "From August 17, the outfit will collect customer metadata by default unless you pay for the top tier"

It's not just metadata, it's all "in-app data"

I really wish I could find a better source to link to for this. By default, all free and paid customers are being opted-in to their data being used for AI training.

All your Confluence pages, Jira tickets, etc.

https://support.atlassian.com/security-and-access-policies/d... describes how to disable this, but it also appears that the setting to disable this doesn't exist (it's not visible on any of our instances).

Which works out at $100 USD / year. You might think that's trivial, but when you start provisioning multiple environments over multiple projects it starts to add up.

It's a shame that Google haven't managed to come up with a scale to zero option or serverless alternative that's compatible.

This is terrifying. Github was the one provider I did not expect to make such an action. We're now playing whack-a-mole with vendors to try and ensure that our company IP doesn't end up being used to train a model.

That's a mixpanel breach if the unauthorised access was mixpanel staff accounts.

If someone phishes your gmail account, there is no gmail breach.

Possibly because OpenAI have just made a post stating there has been a breach https://openai.com/index/mixpanel-incident/ and implicating Mixpanel as the cause

The title here is misleading. The original article does not state breach and at no point have Mixpanel used that term.

Google converted my mum's Gmail account to a workspace account automatically. Now she can't use her bedroom alarm clock because it's connected to my dad's Gmail account and you can't share access to workspace accounts. It's stupidly maddening.

And yes I realise that an IoT alarm clock is ridiculous, but that's not the point.

> This is pulling the content of the RSS feeds of several news sites into the context window of an LLM and then asking it to summarize news items into articles and fill in the blanks?

This is awful. It's cutting out any money going to the news agencies that go out there and write news. If they didn't exist, Kagi wouldn't work.

If you read the proposal, this is for providing automated defences against social engineering attacks - eg: phishing. It's incredibly benign.

That's not how it's presented on Elon's twitter post, certainly. The replies are just layers and layers of conspiracy theories.

For context, this is likely related to an Elon Musk tweet earlier today https://x.com/elonmusk/status/1887185381797343504 quoting Ian Miles Cheong

> Can someone explain to me why the Department of Defense provided $9,147,532.00 to Reuters for "ACTIVE SOCIAL ENGINEERING DEFENSE (ASED) LARGE SCALE SOCIAL DECEPTION (LSD)"