We are building a Personal AI Assistant platform in Europe. Oh man. It is FREAKING HARD! We have now 20 paying users and it is amazing what those people do lol. You really can't make it up.
The complexity of building such a business is something I've really underestimated. Especially if you allow the harness to evolve. For our 20 users, no sandbox is still the same anymore. Everyone customized it, has crons running, built apps or automations.
And then jsut to think that Meta Muse went to a million users in literally no-time. I am not surprised at all.
On the other hand. Zuck has literally infinite money to spend. You'd expect better than, right?
Zuck: Yeah so if you ever need info about anyone at Harvard
Zuck: Just ask.
Zuck: I have over 4,000 emails, pictures, addresses, SNS
[Redacted Friend's Name]: What? How'd you manage that one?
Zuck: People just submitted it.
Zuck: I don't know why.
Zuck: They "trust me"
Zuck: Dumb fucks.
To be "fair", Zuckerberg is a mendacious little prick with a history
Did the Google guys ever get caught saying that? Or using their power over the company to unsend messages, oh I guess you can't do that with email, but with Messenger you can...
It's not, there are levels of scumbaggery and Meta is one of the absolute worst. Rigging elections all over the world, privacy violations everywhere, actively scheming to get kids addicted to slop media, privacy destroying recording glasses, the list goes on.
> But a central design decision for constructing URLs has made the links easy to discover. As a result, researchers from security firm Claroc said they were able to enumerate 6,800 links Muse users created for sharing conversations with others.
To be clear, did the users intended for these conversations to be shared with someone? Meta just created a guessable capability URL?
Or were all Muse users' conversations by default public, just behind an obscure URL?
It seems that Meta assigns a unique hostname to each shared conversation. For example:
> fiscal-review-b4a5ff.cf.metaaiusercontent.com
So when someone opens the link, the DNS resolution exposes the unique hostname. The original bug reporter found dozens of these URLs in passive DNS logs.
Sounds like it's the former: URLs are guessable/easily enumerable but their contents protected by auth unless they're "published" using the share feature
Lesson here is that the subdomain names can be queried due to passive DNS records, and putting stuff that is not supposed to be guessable in subdomain names is a bad idea.
I dont get why they bother with DNS and subdomains when they could generate a unique url. This would eliminate the possibility of easy reverse dns lookup.
I run an personal AI agent locally (hermes), and use a combination of local models and whatever model I can get for a reasonable price (usually deepseek).
After using it for a couple months, I'm converted. They're so good, the more you use it, the more useful it is; you internalise more of what it could be used for. It runs so many boring parts of my life, leaving me with more time to spend with my family.
I liken it to release of the first iPhone; it didn't invent any new technology, but packaged different bits of tech together in a way that was consumer friendly. I think we'll look back at OpenClaw/Hermes/Muse/Instinct in the same way.
I do worry about using purely cloud based offerings like Muse, I reckon there is a market for someone to package an consumer AI agent that lives on your home network.
Whenever this comes up, all I ever see are hand-wavy responses like this. "It does everything", "it changes your life." But how exactly? Because I can only see this being true for the terminally online.
> Muse, which Meta CEO Mark Zuckerberg said last month was “built from the ground up for privacy and security,”
> reported the findings through Meta’s bug bounty program on October 8 and also tried reaching people at Meta on LinkedIn, but got no reply either way.
Checks out
> The ease in discovering share links further justifies asking if Muse is worthy of the access it requires.
Sure but for most people they will not understand the consequences until it is hammered by constant notifications. And those will not happened until such law are mandating for the users to be notification left, right and center. After all Facebook is one of the original promoter of dark patterns in UX/UI.
It's worse. Even if you talk to them, explain in detail why and how Meta and their products are evil, they will just nod, frown, go "yeah, that's serious, someone should do something", and then they will turn around, check their Whatsapp messages and post a story on Instagram about their lunch.
Network effects matter and no you can't just 'email/call them'. Not everyone automatically has those. You can get it, but something like FB, loose connections, regaining contact (you literally don't have their email/phone numbers and don't tell me 'oh but you lost touch for a reason'), is a nice thing if its CEO wasn't who he is
Muse is the most obviously doomed claw-style bot because you already need to segment those things from ANY personal info, and Meta rolls into the room as the journal that will tell everyone what you write in it and says "trust me"
Part of a huge problem with FAANG companies. You can't be Meta and just ratfuck your users for decades and then ask them to trust you, just like you can't be Amazon and turn your storefront into Temu-lite and expect people to want to order products sight unseen with your Echo shit.
anyone surprised?
Did the Google guys ever get caught saying that? Or using their power over the company to unsend messages, oh I guess you can't do that with email, but with Messenger you can...
its not incompetent, its designed that way
To be clear, did the users intended for these conversations to be shared with someone? Meta just created a guessable capability URL?
Or were all Muse users' conversations by default public, just behind an obscure URL?
> fiscal-review-b4a5ff.cf.metaaiusercontent.com
So when someone opens the link, the DNS resolution exposes the unique hostname. The original bug reporter found dozens of these URLs in passive DNS logs.
After using it for a couple months, I'm converted. They're so good, the more you use it, the more useful it is; you internalise more of what it could be used for. It runs so many boring parts of my life, leaving me with more time to spend with my family.
I liken it to release of the first iPhone; it didn't invent any new technology, but packaged different bits of tech together in a way that was consumer friendly. I think we'll look back at OpenClaw/Hermes/Muse/Instinct in the same way.
I do worry about using purely cloud based offerings like Muse, I reckon there is a market for someone to package an consumer AI agent that lives on your home network.
I'll use personal agents for my laundry now. Thanks mate for the samples given
> reported the findings through Meta’s bug bounty program on October 8 and also tried reaching people at Meta on LinkedIn, but got no reply either way.
Checks out
> The ease in discovering share links further justifies asking if Muse is worthy of the access it requires.
That's all you could justify?
Part of a huge problem with FAANG companies. You can't be Meta and just ratfuck your users for decades and then ask them to trust you, just like you can't be Amazon and turn your storefront into Temu-lite and expect people to want to order products sight unseen with your Echo shit.