HN Reader

I think the issue with Flock isn't that they're a joke security wise the issue is that they exist. If you want to police somebody you don't have to police everyone. I'd argue watching my location at all times is unreasonable search.

I don't care that Flock was involved, I care that there's no consequence for it when any corporation does this. How can this not result in fines or jail time?

Although I don’t like Flock, I’m a bit skeptical of the claims in the article. Most screenshots appear to be client-side JavaScript snippets, not API responses from this key.

In the bug bounty community, Google Maps API key leaks are a common false positive, because they are only used for billing purposes and don’t actually control access to any data. The article doesn’t really prove ArcGIS is any different.

Has anyone had success getting their city to take down the Flock cameras? Ours just added them maybe a year and a half ago. They popped up in multiple nearby municipalities around the same time, I'm not sure if it was coordinated action or somehow pulled off at the county level.

Public camera feeds should be public

Sheer incompetence. I hope (probably in vain) that police departments and local governments become more savvy technical evaluators of fancy tech solutions.

There was a huge fracas re: ShotSpotter in my town, where both the municipality's CIO and auditor (+ their internal research capacity) were sidelined. It took a sad amount of handholding elected officials through ShotSpotter's technical claims for them to shelve a planned deployment.

Previous related discussion:

https://news.ycombinator.com/item?id=46355548

With respect to a different public organization with a reach of millions of people, I reported a similar vulnerability where there was an exposed key that services sensitive data. Usually, I don't bother but this time it was bad. I now understand how these things are left exposed for several months to years despite notification. The level of burnout or ignorance that leads to these vulnerabilities elicits harsh backlash where admitting there was ever a problem is worse than exposing a vast amount of people's private data.

Just a reminder here of this experiment using adversarial techniques to confuse the license plate readers. Just an experiment, may not be legal in all locations, check your local laws. https://youtu.be/Pp9MwZkHiMQ?si=nas4dOH4vKyAW_5h

Flock is fond of saying this:

> "I'm writing to you directly because I want there to be zero confusion about what's happening. Flock has never been hacked. Ever."

They are just lying at this point. If you get involved in advocacy related to flock you will likely hear their reps parrot this. Be ready to combat it with concrete examples like this!

I have a controversial question; In the UK, they have blade runners who take down CCTV. I would have expected a more aggressive response in the USA, considering the culture. Is this not happening?

I am apprehensive of the surveillance state and it's potential for misuse. However this disclosure content is less than ideal:

- It mixes two separate issues 1) embedded default API key and 2) unauthenticated token minting

- The bulk of the disclosure focuses on enumeration of sensitive data that is implied could have been exposed via the default API key, but what is actually exposed is unclear: "The 50 "portal:app:access:item" privileges reference private item IDs that cannot be inventoried without actively querying each one which I did not do"

- The default API key was for "development" and there is no assertion that live data existed in that environment (though it wouldn't surprise me)

- The default API key was fixed in June 2025, it is only the token minting that has not been.

- The token minting issue is only asserted to "grant access to the geographic mapping of Flock's camera network locations" which would certainly be useful as a source for unethical updates to https://deflock.me/ but obviously not nearly as sensitive.

(And I've always used bullets/lists in my communications, long before AI did this)

In a sensible world. This would both destroy the company and get the owners jailed.

I wouldn't be surprised if the code is just a Chinese stuff with a customisation on top

I love it when the entire HN comment section devolves into a mere public shaming square with absolutely no substance.

Do the MBAs now running tech just have a hardon for becoming the scifi dystopians they read as children?

Maybe it was on purpose. They might have been forced by the FBI to implement those keys, so they left everything open to be able to track the enforcers also. 53 = 52 states plus gov

Does anyone else feel like the LLM-tone of this article makes it difficult to understand what's actually important in it? It's not clear to me if the issue is ongoing (like it says) or that it's been resolved by rotating the API key (like it also says). And that's like, the most basic piece of information the article could have in it.

Who could have guessed that the greedy, opportunistic, evil corporation whose sole intent is to invade our privacy in the name of "security" would be run by incompetents in the security realm?

Then time for responsible disclosure or CFAA charges.

In fairness to flock, they just hired a CISO and are actively recruiting for a head of product security and privacy as well. So I'm not surprised they're dealing with some of this.

Edit: I'm standing by it. The person they hired for it has a good track record elsewhere. And much as I don't like what Flock is building as a company, at least they're building security in now, even if it wasn't front of mind for them in the past.

He's got his work cut out for him though.