The source article does a much better job explaining. It doesn’t seem like the author of this article understood what they were describing.

Apparently, the problem is that all you need to know to access the shared data is the DNS hostname, and the DNS hostname is intentionally shared with third-party DNS resolvers and unintentionally published through services that collect unsecured DNS requests. It kind of makes sense that you would want to put the shares on different DNS domains because they’re different browser security origins and that makes it more difficult for cross site scripting, and then if the DNS domain already uniquely identifies the share, why put something more in the path? But putting a required unique value in the path would have prevented this because the path is sent encrypted to Facebook’s servers only.

The best way to not have your private information leaked by AI is to not use it.

Join me next week for more cybersecurity tips

This isn’t even regular Facebook casual abuse of user data.

This is just straight up slop coded failure to even consider security.