[sounddust]

Actually, many people already had a public Google profile, either on purpose or because they tested a Google product in the past (I had a public profile, and I don't ever remember doing anything to create one). For all people who already had a Google profile, the list of people they were "following" (that is, an auto-generated list based on e-mail contacts) was automatically added to their public profile with no warning whatsoever.

But even for the people who didn't have one, there was no indication that if you tried out the feature, a list of people that you e-mailed frequently would be published to the public.

[Groxx]

...there was no indication that if you tried out the feature, a list of people that you e-mailed frequently would be published to the public.

Yes, there was. After your first attempt to post, this popped up (this is the original, not the newer one(s)): http://img694.imageshack.us/i/buzzflaw.jpg/

Note that it says "name, photo, people you follow, and people who follow you", while using the word "public" several times. Clicking "edit" let you uncheck the "people you follow / follow you" box that's since been made more prominent and on that popup.

edit: bah, static-link fail. Updated link. Original source: http://is.gd/8Fduj

[carbon8]

"For all people who already had a Google profile, the list of people they were "following".. was automatically added to their public profile"

No, it isn't. Although it indeed appears to expose your contacts, it actually doesn't. This was the case on accounts I set up the first day and, out of curiosity, I tested it again a couple days ago. See my comment here for details:

http://news.ycombinator.com/item?id=1127647

[dkersten]

It isn't now, but do we know for sure that it wasn't before they fixed the problems?

To test it earlier, I went to someone elses profile and checked out their list of followers. These people obviously set up their profile - but people here have stated that a profile may exist from other Google services and I don't know if what you say was the case from day one.

As far as I'm concerned, if, when it was released, Buzz was like it is now, there wouldn't be any problems.

[carbon8]

As I stated, "This was the case on accounts I set up the first day..." My subsequent testing summarized in that comment simply confirmed it.

[pierreb]

It does expose (by full name) any contact who comments on one of your Buzzes. It's far from being obvious when you are using Buzz for the first time that your comments will be seen not just by the Buzz author; it's also far from obvious initially for the Buzz author that his contacts will see each other if they comment. Finally, it's not clear at all who is seeing what. This all feels fuzzy and insecure as compared to good old email.

[carbon8]

"It does expose (by full name) any contact who comments on one of your Buzzes."

It's important to note, however, that unless the buzz message was shared with only specific contacts, anyone can comment on it. Sure, it's likely that a commenter is a contact, but it is entirely possible that they aren't a contact and came to the buzz via some other means.

"It's far from being obvious when you are using Buzz for the first time that your comments will be seen not just by the Buzz author"

It's pretty much universal for comments to have the same visibility as the item to which they are attached.

I could see how someone who isn't at all internet savvy might not realize this, but it's hard to say what they expect. For instance, Facebook, filled with the non-internet savvy, is even more liberal with comments, adding to your feed comments made by friends on things posted by non-friends.

"it's not clear at all who is seeing what."

Definitely. It's easy to see why people believe their contacts are being shared when they aren't and it's no surprise that others have accidentally shared their contacts when setting up their buzz profiles.

[pierreb]

"It's pretty much universal for comments to have the same visibility as the item to which they are attached."

But Buzz does not even quite work like that. Any commenter can extend the visibility to one of his contacts (a totally different set from the author's contact) by adding a @ reference to them in a comment. So even the author himself does not completely control the access rights.

[elblanco]

> Finally, it's not clear at all who is seeing what.

And when people went and figured it out, they have clearly said that they did not consent to that (or at least intend to consent)...which is the problem.