kill9

I would have paid for an everyblock subscription. Sad to see NBC News shut it down.

Well played.

That's a quote from "a former G+ product manager". His credibility is beside the point anyway... this was a hypothetical feature mentioned in the article that conveniently illustrated a potential privacy concern.

(To your prediction of how this feature might play out in reality I would say that you are probably right, but also that I don't give two shits about what my friends buy OR about what they publicly review.)

What we know for certain is that Google is aggressively pushing its users onto G+ and that is the real heart of the problem. It's a bait-and-switch. I have no intention of using Google as a social network and I have no guarantees that I will be able to opt out of current or future features. The writing is on the wall -- Google will be social. That upsets some people.

It's not just about having a profile or not. Google seems to be changing services to require G+.

For example, you can no longer comment on YouTube or write a review in the Play store without a G+ profile (or at least I can't). This means that activity in those Google properties is no longer pseudonymous. That is very unappealing to some.

You don't seem to appreciate what a major change G+ will be for some of Google's users. I for one would never want the following scenario from the article to happen. Ever.

    "You'll go to search for a camp stove on Google, 
    and you'll find that your friend just bought one, and 
    you'll be able to ask him about it," says Dylan Casey,
    a former Google+ product manager who now works at Path 
    Inc., a smartphone-based social network.

Had I known that Google would one day decide to go social and share my private life, possibly without my consent, then I would have never "gleefully accepted the thousands of dollars worth of free services" in the first place. Fact is that this is a change of direction for Google and people have every right to voice their opinion about it... just like the TOS with Instagram... How is this any different?

I doubt tptacek will publicly reveal ways to exploit this (or any) vulnerability.

EDIT Well... he might, but I've never seen him do it. He's a security professional, after all.

Yes, this page has a real torches-and-pitchforks feel to it. It's quite absurd.

The howls of derision from people who flat out say they don't even use the framework and clearly don't understand the vulnerability are particularly ridiculous.