Wow! Just wow! Just as I think the situation cannot get any worse, the OP reveals even worse things going on. I know the UX of this blog and the lack of capitalization is going to turn many people off! But I urge you to power through and read the whole OP anyway.
Use reader mode, block Javascript or whatever it takes. Give the author a break. They're a teenager. What kind of websites were you making as a teenager? I'm sure one of those dark background websites with MARQUEEs and BLINKs with glaring contrast colors! So give them a break. Behind the annoying UX is an article about serious and appalling privacy and security issues.
Like read this:
> i raised this with chris, who's a full-time staff member (not a teenager), and he insisted that exposing physical addresses and sensitive info was "just a vuln" not a breach. said he's "never heard the term 'data breach' used that way" and... also relied on chatgpt instead of actual legal advice.
Actually this Chris guy has a point. I don't call it breach either. It's PII data exposure but it is a serious exposure. So I don't 100% agree with the OP but the cavalier attitude towards security coming from the staff of a legitimate organization is appalling.
It's just mind boggling that an organization handling PII data has such appalling privacy and security lapses and they still remain arrogantly indignant about it making bold claims about laws they don't understand, why, because ChatGPT told them so? Cherry on top is they are employing teenagers to answer legal questions! Not kidding! Just read the OP! Unbelievable!
> Actually this Chris guy has a point. I don't call it breach either. It's PII data exposure but it is a serious exposure.
At least California defines it as
> unencrypted personal information, as defined, was acquired, or reasonably believed to have been acquired, by an unauthorized person.
So I guess if you authorize the entire world to read the data, itâs not a breach.
If nobody reads the data it is not a breach.
Hello, Chris here!
Nobodyâcertainly not any adult staffâat Hack Club relied on ChatGPT for legal advice. Nor do we employ teenagers to answer legal questions, we have actual legal counsel for that! Or in my personal case I ask my wife, who is a law professor, and then she asks ChatGPT (just kidding).
There is too much nonsense in this post to rebut line by line, and these conversations have all been had to death within Hack Club (we put a lot of time into transparently and publicly discussing our programs, problems, and decisions). Here's the short version of this saga:
- The author found a serious vuln in one of our programs introduced by a junior engineer
- We take vulns seriouslyâespecially the serious ones! It was fixed immediately by a senior engineer upon report (within a day?)
- The author insisted that their test of the vuln to access their own address was a data breach, therefore obligating us to notify all 5,000 participants of this "breach" as per GDPR
- We judged this to be Prima Facie incorrect. A lawyer has since confirmed this judgment.
- It is, in fact, bad practice to notify users for every vulnerability. If this were the norm, you would inundated with notices from practically every software product you interact with. Almost all of these notices would be virtually non-actionable by the user, and they would wash out the few notices of breaches which are actionable. There is a good reason why the GDPR does not demand notice for vulns; mass notices are reserved for incidents where there is a known exfiltration of a meaningful amount of user data!
- The author was ultimately banned from the community not for their opinions on this matter, but because of a long streak of unrelated conduct issues that culminated in a spree of saying horribly abusive things to multiple other members of the community.
â They have been pursuing a grudge against the organization ever since. They are not a reliable narrator, this post is a fantasy version of events that casts them as a martyred hero.
Hack Club is an oddly-shaped organization with operations that often raise very real security concerns, but these are wrapped up in a complex web of tradeoffs that are very much still evolving as we refine and expand our core infrastructure. We are not Google, and it is a mistake to import reasoning from that kind of environment when analyzing our security/threat model. Nonetheless, privacy/security is something we think about and invest extensively in. In the past year we have started an organization-wide bounty system, moved all PII storage into a central "identity vault", and consulted extensively with a very fancy lawyer who specializes in corporate compliance with the growing raft of online privacy laws around the world. The good news is, according to that lawyer we already do almost everything we need to be compliant; we just need to publish a privacy policy! We are actively iterating on a mostly-finished draft of this document with our counsel, but it is taking time because, well, this stuff is very complicated. We serve or have served teenagers in almost every country, and GDPR is just the most prominent of many laws that are now on the books worldwide.
So was kids' data exposed or no?
Not exposed but hackclub's security practices always seems to make it easy to access if you want to.
The short answer is no.
As a longtime member of hackclub, I can confirm that while OP may have been banned, most of her points are completely valid and I can find most of the original sources for them. Point-by-point:
> - We take vulns seriouslyâespecially the serious ones! It was fixed immediately by a senior engineer upon report (within a day?)
What? From the many, many #meta posts and other sources I cannot back this up.
> - The author was ultimately banned from the community not for their opinions on this matter, but because of a long streak of unrelated conduct issues that culminated in a spree of saying horribly abusive things to multiple other members of the community.
OP did say some bad stuff, but it wasn't a spree and was an isolated incident. I don't agree with her actions, but I see where she was coming from: she didn't feel heard and just wanted to get back at people she saw as having wronged her. She definitely shouldn't have done what she did but it was an isolated incident or two.
> â They have been pursuing a grudge against the organization ever since. They are not a reliable narrator, this post is a fantasy version of events that casts them as a martyred hero.
You'll note that in the article that isn't what she portrays herself as and she explicitly bookends the article with paragraphs of text praising the mission and all of the good hackclub has done. Which is it, is she rightfully praising the organization but rightfully getting angry about it or is she wrongfully praising the organization and wrongfully getting angry?
> Nonetheless, privacy/security is something we think about and invest extensively in.
Based on HQ's HCB, #meta, posts in #hq, and more this is not true in the slightest.
> In the past year we have started an organization-wide bounty system, moved all PII storage into a central "identity vault" Bounties were addressed in the article and last thing I heard PII is still massively distributed. If that isn't the case anymore, please actually make a post about it so the community is aware?
> consulted extensively with a very fancy lawyer who specializes in corporate compliance with the growing raft of online privacy laws around the world
That's good but again, make an announcement in hackclub?
> The good news is, according to that lawyer we already do almost everything we need to be compliant; we just need to publish a privacy policy!
The fuck?? No?? if this has happened in the last year, how angry has your lawyer about the numerous vulnerabilities that were pushed, not notified, underpaid bounties, and more? Oh, and don't forget you TAKING DOWN THE GDPR EMAIL AND NOT DELETING DATA??
> We are actively iterating on a mostly-finished draft of this document with our counsel, but it is taking time because, well, this stuff is very complicated.
I can definitely understand that. I really love hackclub and think the mission is amazing but at the moment I don't feel safe with my data in its hands.
If possible, could you link any of those posts, or post them through Prox2 in Slack? I'd be interested in reading it, because that's not the vibe I've gotten.
> OP did say some bad stuff, but it wasn't a spree and was an isolated incident. I don't agree with her actions, but I see where she was coming from: she didn't feel heard and just wanted to get back at people she saw as having wronged her. She definitely shouldn't have done what she did but it was an isolated incident or two.
If I remember correctly, she admitted that her ban was justified. But also, she didn't just do "some bad stuff", she did a lot of it - there's even a recent #meta thread referencing this exact post.
> You'll note that in the article that isn't what she portrays herself as and she explicitly bookends the article with paragraphs of text praising the mission and all of the good hackclub has done. Which is it, is she rightfully praising the organization but rightfully getting angry about it or is she wrongfully praising the organization and wrongfully getting angry?
Nuance does exist.
> That's good but again, make an announcement in hackclub?
Zach did.
> The fuck?? No?? if this has happened in the last year, how angry has your lawyer about the numerous vulnerabilities that were pushed, not notified, underpaid bounties, and more? Oh, and don't forget you TAKING DOWN THE GDPR EMAIL AND NOT DELETING DATA??
I'm more inclined to trust Chris than an anon account that straight up denies that internal conversations happened. You also seem to be regurgitating posts from earlier without seeing Chris's context.
[flagged]
My child has been involved in Hack Club for a number of years, and I support their mission. However, HC do seem to be lacking in "adult supervision", and I understand that is kind of their approach: having the kids figure stuff out on their own. However, there are things that kids, due to lack of experience, just can't figure out for themselves. For example, the reliance on ChatGPT and reluctance to use professional SMEs is a very "immature" attitude.
This sort of cavalier attitude is going to get them in trouble; I'm honestly surprised that this hasn't already gotten them into trouble. Hack Club has enough money that they can easily be a worthwhile target if any of their decisions turns out badly.
I'm going to be a bit oblique here because I don't want HC to take this out on my child, but at one of the HC events, the "figure it out for yourselves" lead to our child making decisions and taking actions that could have very easily turned into life threatening. Another situation led to our child being "ditched" in a foreign city and unsure how to get ahold of anyone on the ground to help.
Hack Club is a great idea, and I'm glad it exists, but I do think that the way it is currently organized is going to end badly.
Hello! This is Chris from Hack Club staff (the one cited in the post)
I addressed the post itself in another comment (https://news.ycombinator.com/reply?id=45921428&), so I'll skip that part.
I would really like to know more about these incidents at HC events. We have a lot of very complex tradeoffs within hack club involving security/privacy/safety for exactly the reasons you identified (ie, giving teenagers a very high level of agency/responsibility in running programs). However, staff try to be extremely conscious of these tradeoffs and highly attentive to the realistic risk vectors that come about in our operations.
No teenager will ever (ever!) have anything 'taken out' on them by myself or anyone else that works here. Any time things go wrong or almost go wrong, we just want to know so we can manage that risk in the future. If you are willing to share, please reach out at cwalker@hackclub.com
The incident has already been discussed with organizers at the time.
> the "figure it out for yourselves" lead to our child making decisions and taking actions that could have very easily turned into life threatening
I haven't heard about Hack Club until this very story, so forgive my ignorance, but what exactly happened here? According to their website, it seems to be about a community for teenage programmers, who build open source projects together, sometimes during events. Looking around at the types of events they host, nothing really looks life threatening at all? I'm not doubting your experience, just curious how a bunch of programmers could end up in a life threatening situation during those sort of events.
During Hack Club's IRL Hackathons, teens can get their parents to sign a "freedom waiver" to allow them to leave the hackathon venue and explore the city (they usually happen in high profile cities like NYC or Boston) without supervision. I assume what happened to them was they got lost during this optional exploration period
No, that was not the situation, it happened at the event.
As someone who is part of the Hack Club community, I would urge caution before blindly trusting this account.
- This person has also used their access to attempt to extort the admins and their Airtable data, demanding a bounty payment for access they were previously given. - In her arguments about the program leads earning higher bounties, they had said that they both did bounties for Coinbase and Google, neither of which being non-profits - Many of her arguments are flawed in other ways.
Theo (yes the ffmpeg guy) also commented on it in a livestream, and I would just point to that:
> This feels really in the weeds of something we are not supposed to see externally. It is a lot of writing for what seems like clueless people doing backend
>As someone who is part of the Hack Club community, I would urge caution before blindly trusting this account.
As the parent of a Hack Clubber, a lot of what is said here rings true to our experience with the Hack Club leadership.
They created a new website just for this topic, and named it "kill yourself LLC". Not something you'd do if you wanted to be taken seriously, just IMO. Smells more like a KiwiFarms user.
However there's still no excuse for these problems if they are describing it correctly. When you're storing the home address of thousands of users, (1) you shouldn't do that at all for this type of organisation and (2) you should be very careful to protect it and (3) the first several times it gets stolen, you should think harder about whether your protection is working and there should never be a several+1th time.
I am not the OP but I think I know the back story behind this name and if I'm not wrong, it is related to events that went down in hackclub revolving a suicide attempt in HC being taken unseriously.
As someone who is/was also a part of the hack club community, this article is mostly correct. I've seen most of these events occur second hand as well in real time and can mostly corroborate with the accuracy of the article, except the minors in legal roles part. The community is severely mismanaged, data leaks happen often in very predicable ways and it does seem as if much of it is symptoms of vibe coding.
For context, this is the Theo clip: https://files.catbox.moe/1i7w08.mp4
It's a really long article so he only seemed to read a few paragraphs about the security vulnerability and then said the line while scrolling too fast to read all of the other points. Can't blame him, not going to lie.
Companies should quickly realize that ChatGPT can go both ways - it can turn a "script-kiddie" into fully fledged hacker if vulnerabilities continue to be this sloppy. I am fairly certain that low-skill hacker sweatshops already heavily rely on LLMs to quickly exploit trivial vulnerabilities like these.
Like it or not but I feel like account logins, PII and payment stuff will have to be handled by central big orgs. Ideally, I would like that to be a competent open-source government service. For now it is big companies like Google that can shove its SSO around in accessible manner to other sites.
I'm usually the type to be annoyed at hn people who nitpick about articles but.. this is unreadable.
It's an article by a teenager. We weren't making any great websites as teenagers either. I remember websites with glaring contrast and moving marquees and blinks everywhere. At least the author here writes full words without abbreviating every word. So the author is already writing better than what I wrote as a teenager.
May I suggest you use reader mode to remove the annoying flashing background? If you can get past the annoying UX of the article, it has interesting stories about serious issues.
I just wanted to jump in as Hack Club cofounder and say Hack Club acknowledges this post-- itâs written by a young person we are familiar with: they were banned from Hack Club for harassing transgender kids, and they then recently tried to extort Hack Club for money, threatening to create problems and drama like this after we refused.
This post should not be taken seriously because the implication is wrong: Hack Club is compliant with data protection rules and is very careful with student data; Unlike almost every where else teenagers hang out on the internet, Hack Club does NOT monetize or sell student data or allow advertising to young people.
During one of our many summer programs, we had a situation where some studentsâ info was accessible publicly by mistake, and as soon as it was reported, we fixed it. No one accessed it and we apologized. You GOT us, ok? It happens and the young programmer responsible feels really badly about the fact that it keeps getting brought up in new and twisted ways.
We work around the clock with a fully trained staff to make sure that there wonât be any problems and to address them immediately if they come up. As Iâve stated in the past, this original post is from a disgruntled student was banned for really ugly behavior and yet they continue and it's sad to see it getting amplified here.
Ella wasn't transphobe as she was herself transgender
Prove it.
For all of you discussing the chatgpt, this was after borderline harassing an intern who quoted ChatGPT as a joke in her DMs. There was no legal advice. There used to be a previous version with receipts and screenshots if I remember correctly, with very, very extensive discussions within Hack Club (to the order of thousands of messages of critical discussion).
Please take what's said here with a grain of salt. This is the same person who attempted to extort Hack Club out of thousands by using an airtable token they previously had (all tokens have since been examined as to whether they are truly necessary).
> another asked: "if you found a security vulnerability within hackclub, severe or major, given how they have currently handled reports so far, would YOU report it and go through the same process and payouts that previous people have experienced?"
> the answer from most people was a resounding no.
Popular request is for the program to be expanded. I don't know about the "resounding no".
> teenagers are positioned as "independent contractors" to avoid employment protections, holiday pay, and wage floors. this isn't "scrappy nonprofit" energy - it's child exploitation dressed up as opportunity.
It isn't a full-time job.
> email compliance failures
Recently, email sending has been revamped, and there are tools to subscribe to individual mailing lists.
Criticism isn't ever censored - there's anonymous reporting, a public forum channel for feedback (which only has temporary threadlocks upon very inflammatory or irrelevant discussion), and you can discuss it anywhere else within the Slack.
I could keep going, but the raw truth is that this misses a lot of context for independent observers.
> This is the same person who attempted to extort Hack Club out of thousands by using an airtable token they previously had (all tokens have since been examined as to whether they are truly necessary).
I could be wrong, but I don't think that was OP.
> Popular request is for the program to be expanded. I don't know about the "resounding no".
Do a poll then. I for one agree with that and don't think that most people would report it.
> > teenagers are positioned as "independent contractors" to avoid employment protections, holiday pay, and wage floors. this isn't "scrappy nonprofit" energy - it's child exploitation dressed up as opportunity. > > It isn't a full-time job.
It quite literally is?
> Recently, email sending has been revamped, and there are tools to subscribe to individual mailing lists.
That I'll give you. They did recently revamp that and make it be functional.
> Criticism isn't ever censored - there's anonymous reporting, a public forum channel for feedback (which only has temporary threadlocks upon very inflammatory or irrelevant discussion), and you can discuss it anywhere else within the Slack.
Not true. Thread locks are often for 6 months to a year and the posts often aren't even inflammatory, just anti-HQ.
If you do want to actually talk more, contact me on my alt at https://hackclub.slack.com/team/U09Q734PGUU.
Not sure if it is just me, but the background animation absolutely kill my browser (Chrome) and scrolling is _super_ laggy.
I would highly suggest to block JS while you're only browsing. It loads fast, most trackers won't load and better security as most browser exploits leverage JS all the time
Exactly this. I was surprised to see these comments and then I realized that NoScript blocked the JS (as it should have). The web is so much nicer without JS.
The worst part to me is the lack of a scroll bar. Had to dust off the pgup/pgdown keys to check my progress in the article.
I have a RTX Pro 6000 as my main GPU currently, and this website pins it to ~40% utilization! Never seen a website do that before, some sort of kudos to the webmaster is deserved.
It still renders smoothly though and doesn't go above 40C so I guess it could have been worse.
40% might just mean nothing because your core is probably not running at full clock.
With that website open, runs at 2850 MHz to be specific, it normally idles at 400-500 MHz with ~20 processes (firefox, gnome-shell, alacritty, etc, etc) using the GPU
FWIW it's smooth on my $150 android shitbox.
Get a daily email with the the top stories from Hacker News. No spam, unsubscribe at any time.