For clarification, as many misunderstand: though the "yes" and "no" links didn't really work as advertised (turn Buzz on / off), they displayed nothing that wasn't public already.
To use Buzz, you need a public Google profile. This was true on Day 1, and it's true now. Any info that was revealed was already googleable, public information that the user filled out explicitly for a public page.
edit: downvotes? What, don't like the truth? If I've got something wrong, speak up.
The Data that was exposed was in effect, who your top 6 or so most emailed contacts are. That data was never made public before.
How would you feel if somebody took the top few contacts in your address book and shared them all with each other? That is exactly what Google has done.
As a freelancer would you want the email addresses of your top 6 clients all exposed to each other?
Would you want to explain to your current significant other why you are now following your ex-girlfriends Google buzz? Would you want them to have each others contact info?
Would you want your top six most emailed contacts to be publicly available to your current employer?
Whether people opted in to this behavior via some obscure, hard to understand TOS agreement or not is immaterial. The end result is just poor design though and through.
While I agree that such a data display would be a big problem, it's simply not true about Buzz.
The Data that was exposed was in effect, who your top 6 or so most emailed contacts are.
Only if you have the box which says it makes your following-list public to people following you checked and they set up their public profile. If it's not checked, then no, they can't see the data. Try checking someone you're following who has that box un-checked, and all you'll see is their public profile page and whether or not they're following you.
Again. It's opt-in, and only shows things which are public anyway. If you see a request to make things public, like Buzz offered from day 1, then for the love of God, READ what's being made public. Especially if you have sensitive data on the account, or use it professionally. It was idiotic of them to check the box by default, but individuals are still responsible for leaving it checked.
edit:
The original notification: http://img694.imageshack.us/i/buzzflaw.jpg/ Note that it says "people you follow, and people who follow you". Editing your profile via the edit link before approving allowed you to turn off the "people you follow" display, and now there's a checkbox right on that popup (which should've been there to begin with, but still).
edit2: bah, static link fail. Updated link. Original source: http://is.gd/8Fduj
Just because the option is there and is easy for techies to find doesn't mean that it is reasonable to expect actual not particularly computer literate users to figure it out and uncheck the box if they don't want it.
Thank you for the reply. I was under the impression that the list was public by default. From the link you included this appears to have been the case.
The default behavior shouldn't be to make that list public. I think that is where people are taking issue.
1. Clicking yes/no at the splash screen didn't disable/enable buzz (for everyone), it just showed or didn't show the tutorial. I clicked "no" and buzz was enabled.
2. The subset of my contacts that clicked "yes" became exposed to the public. Are you claiming my address book was previously public?
3. Didn't Google make the public profile for me? I sure didn't. You make it sound like that was a steep barrier to entry to buzz?
"The subset of my contacts that clicked "yes" became exposed to the public."
Not on your profile.
"Didn't Google make the public profile for me"
It didn't. If you never set up a google profile or a buzz profile, Buzz displays a placeholder profile to your contacts with the sentence "This person does not have a public profile." where the name usually is. If you had a Google Profile, your contacts are shown a placeholder profile with your name and a link to your Google profile.
Certainly in the latter case and maybe the former, your following/follower lists are displayed to you on your placeholder buzz profile, but these are not displayed to anyone else looking at the profile.
So turns out you're totally wrong. I just went to the settings page to kill Buzz completely now that they've added the ability, and the default option is worded as such:
"Show the list of people I'm following and the list of people following me on my public Google profile Learn more"
So that list of followers (people who simply didn't read the splash page and blindly picked "yes") WERE exposed to the public.
Although I don't remember creating a profile, I wouldn't rule it out, so I'll take your word for it.
This was all much less terrible than I thought. If no private data was exposed, this was mostly just an inconvenience rather than a horrible breach of privacy, which I'm glad to hear.
I completely agree with 1 (which I'd mentioned in my initial comment). I thought it meant enable / don't enable too, at first, and was extremely disappointed when this turned out to not be the case. I wouldn't have minded the auto-enable setup if they hadn't made it so hard to actually disable it, and if they had an "opt-out" link like we thought they had.
They've effectively addressed this by having a simple completely disabling link now, but I still don't like how it requires deleting your public profile. What if I have a public Picasaweb page?
I'll admit, I pulled a tl;dr on the welcome screen; I typically do, welcome screens are rarely worth more than a quick scan. Expecting the "no thanks" link to refer to buzz is pretty much my mistake, though it could've been clearer.
edit: and as others have addressed (carbon8 this time), 2 and 3 are still incorrect, even from the beginning.
Comments
For clarification, as many misunderstand: though the "yes" and "no" links didn't really work as advertised (turn Buzz on / off), they displayed nothing that wasn't public already.
To use Buzz, you need a public Google profile. This was true on Day 1, and it's true now. Any info that was revealed was already googleable, public information that the user filled out explicitly for a public page.
edit: downvotes? What, don't like the truth? If I've got something wrong, speak up.
The Data that was exposed was in effect, who your top 6 or so most emailed contacts are. That data was never made public before.
How would you feel if somebody took the top few contacts in your address book and shared them all with each other? That is exactly what Google has done.
As a freelancer would you want the email addresses of your top 6 clients all exposed to each other?
Would you want to explain to your current significant other why you are now following your ex-girlfriends Google buzz? Would you want them to have each others contact info?
Would you want your top six most emailed contacts to be publicly available to your current employer?
Whether people opted in to this behavior via some obscure, hard to understand TOS agreement or not is immaterial. The end result is just poor design though and through.
While I agree that such a data display would be a big problem, it's simply not true about Buzz.
The Data that was exposed was in effect, who your top 6 or so most emailed contacts are.
Only if you have the box which says it makes your following-list public to people following you checked and they set up their public profile. If it's not checked, then no, they can't see the data. Try checking someone you're following who has that box un-checked, and all you'll see is their public profile page and whether or not they're following you.
Again. It's opt-in, and only shows things which are public anyway. If you see a request to make things public, like Buzz offered from day 1, then for the love of God, READ what's being made public. Especially if you have sensitive data on the account, or use it professionally. It was idiotic of them to check the box by default, but individuals are still responsible for leaving it checked.
edit: The original notification: http://img694.imageshack.us/i/buzzflaw.jpg/ Note that it says "people you follow, and people who follow you". Editing your profile via the edit link before approving allowed you to turn off the "people you follow" display, and now there's a checkbox right on that popup (which should've been there to begin with, but still).
edit2: bah, static link fail. Updated link. Original source: http://is.gd/8Fduj
Remember the facebook login debacle?
Just because the option is there and is easy for techies to find doesn't mean that it is reasonable to expect actual not particularly computer literate users to figure it out and uncheck the box if they don't want it.
And just because they didn't read the EULA on their software / contract at their job does not mean they are not bound by it.
I agree with the initial design errors, but there's never been a privacy leak in Buzz that people didn't tell to exist.
Thank you for the reply. I was under the impression that the list was public by default. From the link you included this appears to have been the case.
The default behavior shouldn't be to make that list public. I think that is where people are taking issue.
1. Clicking yes/no at the splash screen didn't disable/enable buzz (for everyone), it just showed or didn't show the tutorial. I clicked "no" and buzz was enabled.
2. The subset of my contacts that clicked "yes" became exposed to the public. Are you claiming my address book was previously public?
3. Didn't Google make the public profile for me? I sure didn't. You make it sound like that was a steep barrier to entry to buzz?
"The subset of my contacts that clicked "yes" became exposed to the public."
Not on your profile.
"Didn't Google make the public profile for me"
It didn't. If you never set up a google profile or a buzz profile, Buzz displays a placeholder profile to your contacts with the sentence "This person does not have a public profile." where the name usually is. If you had a Google Profile, your contacts are shown a placeholder profile with your name and a link to your Google profile.
Certainly in the latter case and maybe the former, your following/follower lists are displayed to you on your placeholder buzz profile, but these are not displayed to anyone else looking at the profile.
So turns out you're totally wrong. I just went to the settings page to kill Buzz completely now that they've added the ability, and the default option is worded as such:
"Show the list of people I'm following and the list of people following me on my public Google profile Learn more"
So that list of followers (people who simply didn't read the splash page and blindly picked "yes") WERE exposed to the public.
Although I don't remember creating a profile, I wouldn't rule it out, so I'll take your word for it.
This was all much less terrible than I thought. If no private data was exposed, this was mostly just an inconvenience rather than a horrible breach of privacy, which I'm glad to hear.
Thanks for clarifying!
I completely agree with 1 (which I'd mentioned in my initial comment). I thought it meant enable / don't enable too, at first, and was extremely disappointed when this turned out to not be the case. I wouldn't have minded the auto-enable setup if they hadn't made it so hard to actually disable it, and if they had an "opt-out" link like we thought they had.
They've effectively addressed this by having a simple completely disabling link now, but I still don't like how it requires deleting your public profile. What if I have a public Picasaweb page?
I'll admit, I pulled a tl;dr on the welcome screen; I typically do, welcome screens are rarely worth more than a quick scan. Expecting the "no thanks" link to refer to buzz is pretty much my mistake, though it could've been clearer.
edit: and as others have addressed (carbon8 this time), 2 and 3 are still incorrect, even from the beginning.