[colinrand]

What I find sketchy is that it is not easy to find out who is behind this service. The norm is an about us or a link to a parent site. Briefly skimmed the legalese (ToS & Privacy) and still not clear who these people or where they operate from. The linkedin link shows 8 people working there, mostly in BD from outside the US.

I don't think there is a nefarious purpose going on, i.e. getting people to sign up and stealing their info or payments, etc. However, it contributes to the erosion of trust on the internet. You're no longer sure if you're talking to a real dog in pajamas online or an AI pretending to be one.

[lancesells]

I find that a lot of Show HN (YC companies included) that make it to the front page have the same problems. I usually don't make comments on it but I find it crazy that someone would launch either a paid product or something that takes your private information without knowing where they exist or who they are.

[dannyw]

The FAQ https://generated.photos/faq directly answers this: it's made by the same company as Icons8, which has a long track record. The founder is Ivan Braun, who is indeed a real person (I've known him since the Icons8 days).

[colinrand]

Fwiw, I read the FAQ yesterday. It was either not there or else my blinders were on to not find anything.

[imposter]

This could just be a side-project by some guy working in a tech company with a 'no inventions/IP clause' in his contract. People prefer to stay anonymous in such cases, and launch silently, as to not pull attention from their main org. Not everybody can be a twitter-tech bro announcing his creations on ProductHunt and not get in trouble for it.

[upwardbound]

It could be an attempt at entrapment by a hostile foreign power attempting to get blackmail material on western engineers by tricking people into accidentally viewing CSAM, and then leveraging that to try to turn western engineers into unwilling foreign agents by blackmailing them with the threat of turning them in to law enforcement and/or ruining their marriage. I know this sounds like a conspiracy theory but this is an anonymous site, which is free to use, targeted at English-speaking engineers, which generates extremely sketchy content. Some of the comments in this thread make it pretty clear that this site generates CSAM some percentage of the time. If you use the site you are rolling the dice and might become guilty of a crime, putting yourself in a position to be a pawn of a N Korean or other foreign country's intelligence agency.

Edit: If you get contacted by a foreign intelligence agency attempting to blackmail you, please report them to https://www.inscom.army.mil/isalute/ and also to 1-800-CALL-FBI (1-800-225-5324).

[dontupvoteme]

> I know this sounds like a conspiracy theory

Yes but why North Korea? This sounds like US 3 letter propaganda from a decade ago

It would be China looking to Exfiltrate IP/Data as that data war has already begun. See : Azure keys.

[dontupvoteme]

Why's that bad? Should every URL be doxxable?

[hnbad]

Doxxing refers to private individuals not companies and organizations.

In Germany for example every commercial website (which is defined very broadly and applies to most websites) is by law required to have an imprint listing the person/org responsible for the website and how to contact them (an e-mail address is not good enoguh). This means you can go to any German business website and get the full address, EU VAT ID and registration number of that company.

Under the GDPR more broadly (which also affects foreign companies offering services to EU residents) every company is required by law to have a privacy policy and that policy must include whom to contact for concerns and requests regarding personal data of the user/visitor and who (which legal entity) processes and stores the data.

This is the opposite of doxxing. It protects private individuals by making transparent to them who they are interfacing with and who holds their data. This is necessary for informed consent.

Sidenote: the website/app's cookie notice is pointless as it's using the same "redirect to google.com if user says no" logic porn sites used to do (do they still do this?) for age checks. The app also works without accepting the terms, so either it can work without accepting them or (more likely) it doesn't actually wait for the user's consent. Either way it doesn't do anything and doesn't comply with any privacy laws I'm aware of that would require it.

[dontupvoteme]

Call it sitedoxxing then or urldoxxing.

It's the same attack, to deanonymize, to hunt people down from the internet because you don't like what they say or do.

Germany is the only country in the world with that Impresseum policy because of it's highly leagalistic Prussian background, and you would find that many in the hacking community (e.g. CCC) take huge issue with it

[hnbad]

The hacking community takes issue with it because it is overly broad and applies to sites any reasonable person would consider personal and non-commercial. The infamous precedent were early 2000s era personal homepages with banner ads on them to pay for the hosting. The presence of ads made them commercial and thus subject to the Impressumspflicht.

The CCC has a strong anarchist tendency unlike the US tech bubble which has a more libertarian (i.e. free enterprise) streak. They absolutely do not want companies to hide from accountability, which completely abolishing the Impressumspflicht would do.

Also note how I said the GDPR also requires transparency with regard to who processes and stores your data. This doesn't translate to the same requirements that exist for an Impressum but for companies and registered organizations it's enough to make them identifiable and recognizable, especially in combination with the Transparency Register, which is also part of EU law.

[dontupvoteme]

Fair enough, I'm just very aware of the doxx culture we live in and the insanity of the modern internet.

You're right legally, but obviously the GDPR is not fully followed -- Big Corpos just ignore it and pay the fine, and small companies can skirt it.

I don't understand your overall point about "data" though. Do you mean for free usage when people accept cookies from their logging, or just for customers of the API since you make an account?

In any case it looks like the FAQ now links to the parent company, but I could have imagined it just being a guy who didn't want to get doxxed or wanted to stay private.

I think being able to make a website or tool or thing and say "hey check this out" and stay anonymous is a key part of the internet, and frankly I don't mind if they make a small amount of money on the side. I know this is probably Ketzerei in Germany but in Anglo countries it's sometimes notoriously hard to track down corporate structure to people and such.

Germany is definitely incredibly pro copyright though so that probably plays a role.

[hnbad]

> I don't understand your overall point about "data" though.

Data about you is your data. The GDPR defines it as such. As long as data can be traced back to you, even through pseudonymization, it remains your data. This includes anything from IP logs to what you did in the app. If it's tracked, that generates data, the data is tied to you, so it's your data. Given that the app invites you to upload pictures, which themselves could be other people's data, it's very relevant to know who is storing, transferring and processing it and for what purposes.

> Germany is definitely incredibly pro copyright though so that probably plays a role.

Sure, to some degree. I'd also like to believe that we have a heightened cultural awareness of the dangers of governments and corporations having access to personal information when things go south. The biggest civil control mechanism of the East German government was what at the time would have been considered an excessive amount of data collection about anyone even remotely suspicious of being critical of the state (and anyone affiliated with them). And prior to that the NSDAP used intricate record keeping to identify "Jews" and suspected enemies of the state. It doesn't matter if it's a corporation that has the data or the government because fascism doesn't make this distinction. So the only way to protect data is to have full transparency over who has it and why.

[paint]

It's also prominently asking you to upload a picture of your face along the rest of the controls

[exodust]

You can upload any face.

Here's Kurt Cobain in a universe where he gets a regular office job, goes to gym, and never starts a grunge band...

https://generated.photos/human-generator/64e708a6190809000fb...