From 45e02575b23a5f7a910fa864041cf79c12fb63a4 Mon Sep 17 00:00:00 2001 From: sel Date: Fri, 14 Aug 2026 12:38:40 +0200 Subject: [PATCH] feat: added comments to a blog post --- content/posts/harvester/index.md | 45 ++++++++++++++++++++++++++++++-- 1 file changed, 43 insertions(+), 2 deletions(-) diff --git a/content/posts/harvester/index.md b/content/posts/harvester/index.md index ec42bab..f68c45e 100644 --- a/content/posts/harvester/index.md +++ b/content/posts/harvester/index.md @@ -6,6 +6,8 @@ title = 'The "private" metasearch engine that sends user data to a knockoff Pala tags = ['investigations', 'privacy', 'fediverse'] +++ +**update:** basically everything in this document is outdated less than a day later; almanac is now defunct, and the logging of exact search queries has also been fixed. you may look at the appendix for Tiago's comments :3 + ## Introduction **hi and welcome back!!! :3** this time we will research & discuss a ridiculous violation of the privacy of possibly thousands of unknowing entities, happening through the websites `tiago[.]zip` and `estrogen[.]delivery`. @@ -109,8 +111,6 @@ update: as I was writing this, it was [updated](https://bookstodon.com/@keith/11 ### ... and you can't even opt-out -note: things in this section might be outdated by the time you read this; this represents the state of affairs as of writing this, on august 12th/13th 2026 - The same page mentions 3 ways one can opt out; 1 at the user level and 2 at the instance level: - add `#noindex` to one's bio, @@ -259,3 +259,44 @@ Some other sources and liveposts: - https://old.mermaid.town/@futzle/117086174531531720 - https://fedi.wasp.best/notes/aptptbsrdya9mskb - https://fedi.wasp.best/notes/apuy1uchy1aef5gf + +
+ Appendix: Comments + +(August 14, 2026) + +> As for #noindex, if you query note of profiles.parquet for that exactly, you’ll get zero results. However, with the query SELECT COUNT(*) FROM 'profiles.parquet' WHERE note ILIKE '%#%noindex%';, you will get 663 results (or 674 if you omit the hashtag, but those 11 people probably just don’t know that they need to make it a hashtag): + +this has been fixed yesterday! + +> This will be explained in some more detail in a later section, but all you need to know for now is that there is nothing Palantir-related on palantir[.]estrogen[.]delivery! It’s just a login page pretending to be a Foundry instance. + +it's a joke, if you try to log in it shows tenna's killed. i addressed this on an issue on metasearch's github + +also almanac has mostly been shut down + +> a “friendly knowledge base for gender-affirming hormone therapy” (just use transfem science bwaaa) (wiki[.]estrogen[.]delivery) + +this is my defunct wikimedia clone, the data is placeholders which you shouldnt rely on. nothing else links to it + +> Another thing that came up while digging through domain records was yuri[.]delivery, which just appears to be a site for looking at yuri. I don’t know if this site is related to Tiago or not, but it is in the same Cloudflare DNS zone (so there’s a chance that it’s managed by the same account). + +yep it's mine. + +> oh no. The request to the fake Foundry (fakedry?) instance includes our exact query. Both as a specific ‘query’ field and in the field for the URL. + +this is a bug and not supposed to happen, ill look into it. +should get fixed in a few hours + +edit: fixed. it was the site search feature i forgot to remove for metasearch +i assume it's an artifact from the plausible fork + +> By looking up one of the class names (bp6-input) on Censys combined with the path, we can find that this login page was taken from palantir[.]4x[.]rip (and slightly modified to add the “killed” thing): + +yes that's oomf, i asked them if i could steal it + +> happy phone. /ref + +NOOOOO DON'T JOIN THE HIVEMIND + +