[dkersten]

Actually, they did. I just re-enabled Buzz to check and they do allow you to view another persons followers. Couple that with auto following everyones gmail contacts and its easy to find a list of my gmail contacts without me having done anything. I don't share my contacts list anywhere else and I don't really think the world has to know what other gmail users I've ever emailed (one person Buzz auto followed for me was someone I'd emailed exactly once).

I count that as showing my personal information against.

[carbon8]

"they do allow you to view another persons followers"

If that person took the extra step of setting up their buzz profile.

And although your profile might show your followers/following to you, the profile doesn't show the same information to other users. See my comment here:

http://news.ycombinator.com/item?id=1127647

It is indeed confusing and the way it's designed gives the impression that it exposed gmail contacts, but ThinkWriteMute is absolutely right and it's disturbing that he's being downvoted.

"Couple that with auto following everyones gmail contacts and its easy to find a list of my gmail contacts without me having done anything."

The "following" terminology seems to be the source of most of the confusion, since it makes it sound like something new is being exposed when it isn't. If you haven't set up your buzz profile, the only information your followers can see is you name, picture and chat status updates and anything else that was public, which is what they could see before when they were still just "contacts."

[ThinkWriteMute]

Actually, they didn't. You need to read up on your facts. For instance here's a post that sums it up rather nicely:

"No, they didn't. People think that the "want to find out more?" screen was the opt-in point, but it wasn't. The opt-in point was when you made your first Buzz post, when you were told this meant creating a public Google profile."

[sounddust]

Actually, many people already had a public Google profile, either on purpose or because they tested a Google product in the past (I had a public profile, and I don't ever remember doing anything to create one). For all people who already had a Google profile, the list of people they were "following" (that is, an auto-generated list based on e-mail contacts) was automatically added to their public profile with no warning whatsoever.

But even for the people who didn't have one, there was no indication that if you tried out the feature, a list of people that you e-mailed frequently would be published to the public.

[Groxx]

...there was no indication that if you tried out the feature, a list of people that you e-mailed frequently would be published to the public.

Yes, there was. After your first attempt to post, this popped up (this is the original, not the newer one(s)): http://img694.imageshack.us/i/buzzflaw.jpg/

Note that it says "name, photo, people you follow, and people who follow you", while using the word "public" several times. Clicking "edit" let you uncheck the "people you follow / follow you" box that's since been made more prominent and on that popup.

edit: bah, static-link fail. Updated link. Original source: http://is.gd/8Fduj

[carbon8]

"For all people who already had a Google profile, the list of people they were "following".. was automatically added to their public profile"

No, it isn't. Although it indeed appears to expose your contacts, it actually doesn't. This was the case on accounts I set up the first day and, out of curiosity, I tested it again a couple days ago. See my comment here for details:

http://news.ycombinator.com/item?id=1127647

[dkersten]

It isn't now, but do we know for sure that it wasn't before they fixed the problems?

To test it earlier, I went to someone elses profile and checked out their list of followers. These people obviously set up their profile - but people here have stated that a profile may exist from other Google services and I don't know if what you say was the case from day one.

As far as I'm concerned, if, when it was released, Buzz was like it is now, there wouldn't be any problems.

[carbon8]

As I stated, "This was the case on accounts I set up the first day..." My subsequent testing summarized in that comment simply confirmed it.

[pierreb]

It does expose (by full name) any contact who comments on one of your Buzzes. It's far from being obvious when you are using Buzz for the first time that your comments will be seen not just by the Buzz author; it's also far from obvious initially for the Buzz author that his contacts will see each other if they comment. Finally, it's not clear at all who is seeing what. This all feels fuzzy and insecure as compared to good old email.

[carbon8]

"It does expose (by full name) any contact who comments on one of your Buzzes."

It's important to note, however, that unless the buzz message was shared with only specific contacts, anyone can comment on it. Sure, it's likely that a commenter is a contact, but it is entirely possible that they aren't a contact and came to the buzz via some other means.

"It's far from being obvious when you are using Buzz for the first time that your comments will be seen not just by the Buzz author"

It's pretty much universal for comments to have the same visibility as the item to which they are attached.

I could see how someone who isn't at all internet savvy might not realize this, but it's hard to say what they expect. For instance, Facebook, filled with the non-internet savvy, is even more liberal with comments, adding to your feed comments made by friends on things posted by non-friends.

"it's not clear at all who is seeing what."

Definitely. It's easy to see why people believe their contacts are being shared when they aren't and it's no surprise that others have accidentally shared their contacts when setting up their buzz profiles.

[pierreb]

"It's pretty much universal for comments to have the same visibility as the item to which they are attached."

But Buzz does not even quite work like that. Any commenter can extend the visibility to one of his contacts (a totally different set from the author's contact) by adding a @ reference to them in a comment. So even the author himself does not completely control the access rights.

[elblanco]

> Finally, it's not clear at all who is seeing what.

And when people went and figured it out, they have clearly said that they did not consent to that (or at least intend to consent)...which is the problem.