Not sure what the problem is. I have complete control over the privacy settings of all my accounts. After reading the post, I think the problem is the poster made a choice before this not to use the privacy features.
If, on the other hand, Google had said "heres our new Google Buzz feature, heres how to turn it on, heres the privacy settings and heres how you can add everyone|people you talk to regularly|manually add" then I'd be perfectly happy. Opt in is better than opt out, as far as privacy is concerned.
To the best of my knowledge they prompt you and ask you who you want to follow. This was the case for me. They don't automatically follow - unless you click the OK button.
Turning off buzz is literally one click away at the bottom of the screen. I know because I used it.
This is also shown in the Google buzz demo video.
Responsibility lies on you when you decide not to edit the follow users and check privacy setting when its right in front of you the first time. The only way forward is to click OK, thats what you did like everyone else who is complaining and going ra ra about privacy.
Upon proceeding in to Gmail, I found that I was participating in Buzz, with IIRC 14 follows.
My more general reaction to this situation, including a similar, serious security implication for a close family member, I'll comment on elsewhere in this thread.
Briefly: You fucked up bigtime, Google. The people truly responsible for this need to be terminated.
I didn't watch the Google Buzz demo video, because I'm not interested in Buzz. I shouldn't have to watch something I'm not interested in to find out how not to take part in what I'm not interested in. It also took me quite a while to figure out where the turn off button was - since its not in the normal settings, where I would expect to find such things.
There were already messages there. They were almost all about how to turn off buzz.
Clearly you have option to edit your followers list and change privacy setting (which was the complain I was referring to). If you choose not to do anything about that and ignore the prompt and go ahead click OK. Should you not take some responsibility for it? I am not denying that google auto following is not in bad form I am just pointing out that changing/editing it is extremely easy and right in front of you.
As for turning off buzz. It is at the bottom of your gmail window. One click away, but not obvious.
Oh right, "we don't like his comment, let's get rid of it." Jesus, people, behave.
He's making his case based on his knowledge of the situation and he's doing so in an educated manner.
Me, personally, I'm in his same situation. I can't understand how people got automatically added to that Buzz thing. The link appeared in my Gmail account and I never clicked it, NEVER. I just turned it off when I learned how.
We can't have two-sided conversations in HN anymore. Either you bash Buzz/Google or get the hell out of this thread.
Basically, what is happening is the same thing that happens at twitter by default. People follow other people, and followers, NOT contacts, are shared. People can see who is following you, but they can't see your contacts.
So, when someone joins Buzz, Google suggests they follow certain people, and sets them up. These are people they have in their contacts list. These people in turn have also done the same thing, most likely. Followers, like on Twitter, are shared publicly.
Basically, a lot of people were following people when they really didn't want to be, and despite the ability to prevent it, they accepted the defaults.
Google has made changes to make it more obvious, but from my own experience, and from everything I've read, seen, or done, is that this was all preventable. The problem was, people didn't take the time to read, or understand, what was happening, just happily clicking along.
Of course, that's probably just as dangerous. Should Google have handled it differently? Yes. Did they betray users privacy? Possibly, depending on if you accept that users using software have a certain level of responsibility, or that the software is supposed to assume you don't know what you are doing.
Edit: More information this morning, and I feel vindicated. =)
I set up a profile on one account ahead of time. This was very easy to do; Google Reader encourages it at various places.
When I logged into GMail and got the "Buzz" welcome screen, it offered "Try Buzz" and "No thanks." I clicked "No thanks" and it took me to GMail, but the Buzz UI was enabled anyways. When I logged into second account that was a contact of the first, it received a notification that the first account was following the second, with a link to the first account's profile and list of followees/followers.
Now, this part is a bit foreign to many people, but imagine that the fact you email someone is a secret and potentially damaging to you. Maybe you are a whistleblower talking to a government regulator. Someone I know had a stalker added to their Buzz followers along with people she didn't want the stalker to learn about (because stalkers will try to get at their victims through their friends and family). Maybe you don't want certain people aware of your sexual orientation, or your religious or political activities.
At this point, the damage is already done. Before Thursday night, there was no clear notification or way to opt-out of the public followers list until after it had been created and then broadcast to a list of people. By the time you got around to checking out Buzz, realizing that your information had been disclosed, and figuring out how to remove it, it could easily be too late. Note that Google did not "suggest" people to follow and then let users "accept" these defaults. They were added without the user's knowledge or consent.
Worse, if you found the "Turn off Buzz" link in the GMail footer and clicked it before blocking your followers, changing your profile settings, etc., then all your information is still public but hidden from your GMail pages! It's then much harder either to discover the problem or to fix it.
And Google has admitted to some outright bugs that made the situation worse for the "Fuck you Google" blogger. For example, people still appeared in the "Following you" list on Google Reader even after they were blocked and you set your Reader shared items to private; they couldn't actually see your shared items then but it appeared to the user that they could. Also, before Thursday there was no way to block a user who did not have a public profile.
My friends who work at Google are convinced these are real problems[1]. I think you are dismissing them way too quickly.
[1]: http://www.google.com/buzz/mbrubeck/HEN2DyJooNZ/This-looks-l...
First, I stand by what I said: People need to be aware, and made aware, of these things. Privacy is your business, and putting my privacy in the hands of someone else (and I'm not even referring to Google here) means I'm essentially giving up my privacy. Whistleblowers and other people who wished to remain secret should have taken more steps to ensure their privacy (accounts that can't be traced back to themselves).
Secondly, you don't make it clear whether either account said it auto-followed things before you logged in or not. Did it? Did Account 1 follow Account 2 without actually logging in with Buzz enabled, or was it only after logging in it auto-followed? Note: I realize the implications of either way; however, I'm just curious to know which it is for my own knowledge. Again, I'd rather not assume. You also make it seem as if you accepted the default privacy settngs Google set for you.
Next, I realize their were bugs in Reader that "Fuck you Google" made them aware of. Bugs happen. In this case, the bug was just a display bug and from my understanding, didn't actually share anything. In this case, the big problem was merely a display problem. Sure, this is a bug, and a serious one, but not the extent that anyone was suggesting.
Finally, everything I've seen from Google, including the link you sent, suggests that they had these settings in before hand, and that the privacy concerns were more from people that didn't look into the privacy settings before hand and accepted the defaults. The link you posted even described all the issues you described by fixing them merely through making them more visible.
So again, we come to it: The settings were made available. That they weren't flashing and in front of the users with big bold text with sound announcing themselves is a problem, but not to the same extent that "Google was display user's contact lists on their profile page."
However, that all being said, I still think we can learn a lot by this. But looking at it through the eyes of the mob-think that occurred these past few days won't teach us anything, and if anything, only promotes continued ignorance of privacy concerns on the internet.
So, I go back to what I was saying: did anyone using the privacy settings available have their privacy setting explicitly overridden, or was is just people not using the privacy settings available, and then getting run over when they realized what they had allowed opened?
Edit: I get downvoted for asking questions. Apparently, not following the torch-bearers blindly is frowned on.
What, exactly, should they have done to keep this from happening?
That's exactly what happened to me. I'm really pissed off with Google now. If they are going to throw this sort of crap at me, I will have to reconsider whether I want gmail and reader accounts.
The way to turn it off is a very small textual link in the footer of the page that says turn off buzz.
Important quote from http://news.cnet.com/8301-17939_109-10451703-2.html
"But all this does is remove active links, leaving your profile still publicly available, along with any public buzzes you might have made while trying Buzz out. In fact, you're still technically following people, and they're following you. Not OK."
I doubt the google programmers are stupid but I would say that they probably were excited by the new feature that they are proud of and didn't think that people would want to opt out of it before even trying it.
(since it didn't seem to come through when the other guy posted it)
Edit: And because it needs to be said here: I'm not suggesting enabling Buzz and then using existing privacy settings as a bases for how Buzz works is right. I'm just asking a question.
They are both Reader users, and did have limited sharing enabled there, but under what logic should those permissions ever extend to a completely new, different service with wholly different privacy concerns?
From this thread: http://news.ycombinator.com/item?id=1121034
Anyways, here is my take. Buzz isn't a new product so much as it's a new feature of Gmail. It's as much a new product as any new feature of Gmail is. It's also tied into most of the areas Gmail is, and tied into the rest of Google, and uses Google Profiles.
Google made the assumption that because this wasn't so much a complete new product, but rather an extension to an existing one, that it should use existing permissions. And looking at it that way, I can easily see them doing what they did.
What they didn't suspect, or expect I'm sure, is that people would see it not as a Gmail feature, but rather as a completely different system unrelated to Gmail and rather, tacked onto it.
I can see how Google looks at Buzz as merely an extension to Gmail. Gmail is, after all, their communications tool, including email, chat, and eventually (we know this is coming), Wave. Buzz is merely another way to communicate, and because so much of Gmail already includes so many other connections, Buzz being a framework to share things that Email, Chat, and what not are effective at, they built it with a familiar way of doing things. They then assumed (and I'm assuming all of this, mind you) that because they were building on top of an existing structure, that much of the privacy concerns that have arisen were already in use by the people that were concerned with it.
So, the question is, not whether Google was right or wrong, but rather, where do we draw the line? When does a new feature become a new product that requires new permissions, and when is a feature merely a feature that can use existing permissions. After all, there is so much that they do add where we don't blink an eye or concern ourselves with permissions or privacy, despite the potential for problems down the line.
I understand what they did, and why they did it (if my assertions are correct). However, there is more to learn here than to just say "Make everything private." The reality is, most users make assumptions about privacy (this is excellent proof of that), and so do companies. I honestly don't think Google went with Buzz and said "Let's destroy users privacy." I also hope this heightens people's awareness to the state or privacy on the web.
This is the question: if up until now, you had an option that set things to 'public', but they weren't really public, should a new feature unset your previous choices? Should a new feature change your privacy settings?