{"action":"closed","issue":{"url":"https://api.github.com/repos/mozilla/activity-stream/issues/2306","repository_url":"https://api.github.com/repos/mozilla/activity-stream","labels_url":"https://api.github.com/repos/mozilla/activity-stream/issues/2306/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/activity-stream/issues/2306/comments","events_url":"https://api.github.com/repos/mozilla/activity-stream/issues/2306/events","html_url":"https://github.com/mozilla/activity-stream/issues/2306","id":216209334,"number":2306,"title":"This feature is leaking private URLs to external servers","user":{"login":"Frogging101","id":1252192,"avatar_url":"https://avatars3.githubusercontent.com/u/1252192?v=3","gravatar_id":"","url":"https://api.github.com/users/Frogging101","html_url":"https://github.com/Frogging101","followers_url":"https://api.github.com/users/Frogging101/followers","following_url":"https://api.github.com/users/Frogging101/following{/other_user}","gists_url":"https://api.github.com/users/Frogging101/gists{/gist_id}","starred_url":"https://api.github.com/users/Frogging101/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Frogging101/subscriptions","organizations_url":"https://api.github.com/users/Frogging101/orgs","repos_url":"https://api.github.com/users/Frogging101/repos","events_url":"https://api.github.com/users/Frogging101/events{/privacy}","received_events_url":"https://api.github.com/users/Frogging101/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2017-03-22T21:11:03Z","updated_at":"2017-04-03T19:02:20Z","closed_at":"2017-04-03T19:02:20Z","body":"A few days ago, I was looking at my server logs when I noticed odd requests for files that were only shared privately with a small number of people. The requests came with a non-descriptive \"node-fetch\" user agent, from AWS IP addresses with generic EC2 PTR records. No identification whatsoever.\r\n\r\nUnderstandably, this was very concerning to me. The URLs they were requesting are not publicly searchable; they were only posted in private chat rooms, in some cases as far back as October 2015. And yet, somehow, they are being downloaded years later by unidentified bots that couldn't possibly know about them.\r\n\r\nI began to investigate how the URLs could have been obtained. Other members of the community reported similarly odd requests from the same IP addresses and the same user agent. Eventually, I discovered that a member of our community (in which most of us are Firefox users) had enabled the Activity Stream feature.\r\n\r\nI briefly installed Activity Stream (and I note that Firefox didn't ask for a confirmation before installing, as it usually does with Add-ons) to see what would happen. The node-fetch bots immediately hit my servers after doing so. That answers that. Now, what to do about it?\r\n\r\nIn my opinion, the browser should **not** be using external servers to query URLs from the user's history. I consider this an invasion of my privacy both as a Firefox user, and as an Internet user who shares content privately among his friends in the expectation that it will not be viewed by anyone else.\r\n\r\nAnd as a server administrator, I expect that any legitimate service properly identifies itself when making requests. Questionable automated queries from a generic user agent with a generic EC2 PTR record frankly looks malicious.\r\n\r\nThe user agent in question is `node-fetch/1.0 (+https://github.com/bitinn/node-fetch)`\r\nAnd these are the IP addresses I observed:\r\n\r\n> 34.208.116.58\r\n34.208.145.186\r\n34.208.189.48\r\n34.208.205.177\r\n35.160.36.119\r\n35.162.12.21\r\n35.162.69.232\r\n35.163.110.98\r\n35.164.86.234\r\n52.25.175.133\r\n52.27.19.41\r\n52.27.248.59\r\n52.33.67.85\r\n52.33.93.150\r\n52.35.88.44"}}
{"actor":{"display_login":"jaredkerim"}}