Comment by JumpCrisscross | Hacker News Reader

Comment by JumpCrisscross | Hacker News Reader

Parent Full thread

> pretty likely the guy blocked the author after seeing them link a blog post insulting his work, no?

No.

“Joshua runs two Bluesky accounts: @iceblock.app, the account of the ICEBlock app, and @joshua.stealingheather.com‬, Joshua's personal account. His personal account had DMs closed, but the ICEBlock account had DMs open, so [the author] sent him DMs there” about the upcoming blog post.

Joshua reacted to the blog post by blocking the author on the ICEBlock account.

When, “a few days later…[ICEBlock’s] server was still running Apache 2.4.5,” the author “decided to give [Joshua] a deadline to patch his server before [the author] publicly disclosed the vulnerability.” The author sent this deadline to Joshua’s “@joshua.stealingheather.com” account.

“An hour and a half” after the deadline was communicated, Joshua blocked the author from his personal account, too.

It's pretty clear the developer blocked him from the @iceblock.app account because of the blog post criticizing him, and then blocked him from the other account after he said to not respond but got a page of text back instead. It had nothing to do with the vulnerability report.

Now, the blog post seems to be reasonable criticism to me so I don't think the developer should have blocked him for it. But I don't know, no one has ever written a blog post about me, and I'm not receiving death threats and being threatened by the federal government.

At the end of the day, the author is trying to frame this interaction along the lines of, "Sensitive user data is at risk, and I was blocked for no reason other than for letting the developer know" -- the first part has not been proven to be true, and the second is obviously not true.

> then blocked him from the other account after he said to not respond but got a page of text back

The point is the developer didn’t block “the author after seeing them link a blog post.” They received the disclosure and then blocked the author (on that account).

So what? The guy probably feels harassed. He doesn’t know the author from Adam.

The "disclosure" was a big waste of time. It was vague and ill-informed, nothing that came after seems to give the impression that they actually knew what they were talking about.

The only serious vulnerability that might have applied would have required the man to be using Apache as a reverse proxy to another server, which is just _extremely unlikely_ considering where it was hosted and what it was being used to do.

Reply on news.ycombinator.com