LJ security bug

[brooksmoses]

Reposting from epi_lj:

Some of you may have noticed that weird flash objects rendering as a big hunk of whitespace are showing up on some of your recent posts. I don't know for sure what's going on, but I *suspect* it's something busted with their new, "Your Journal - Your Money" feature. I'm hoping they fix it soon. (I have not opted in to that feature. It seems to be happening on lots of journals that are eligible for the feature, even though the people have not opted in, so, to be clear, this could happen to your posts even if you do not use that feature.)

I'm just posting about it because eeyorerin noticed that when it adds the objects, it also makes your post public. This could be a pretty big concern if you posted anything that you thought was going to be filtered or that you really didn't want public. I just tried this out myself, and it did indeed change the security from friends-only to public.

It also resets the usericon, tags, and mood when it does this.

Comments

[11011110.livejournal.com]

Thanks for the heads up — this one bit me too.

[txanne.livejournal.com]

And me. (Mris sent me.)

[arib.livejournal.com]

Likewise me. I have an adblock running on firefox, so I didn't see anything until a friend pointed it out.

(sent by rosefox

[rosefox]

When I went to Adblock the frames, it suggested blocking a URL beginning "http://livejournalinc..com". Yes, with two periods.

Oops.

[hobbitbabe.livejournal.com]

I had an entry set to public from this. Fortunately it was a boring one. Thanks for the heads-up.

[pantryslut.livejournal.com]

Sure enough, it just happened to me, with a seekrit post re-set to public. Not an important post, but still.

[redbird]

From what I've seen, via no_lj_ads, this has to do with embedded content and the lj-toys dot com domain, and is unrelated to the adsense thing. They also think they've fixed it. More info at this link on the meta_lj community