The _really_ fun bucket squatting attacks are when the cloud providers themselves use deterministic names for "scratch space" buckets. There was a good DC talk about it at DC32 for AWS, although actual squatting was tough because there was a hash they researchers couldn't reverse (but was consistent for a given account?): https://www.youtube.com/watch?v=m9QVfYVJ7R8
Mountain View recently turned off their Flock installs after they discovered Flock had enabled data sharing without notice and other agencies were searching through MV data.
https://www.malwarebytes.com/blog/privacy/2026/02/flock-came...
> A separate “statewide lookup” feature had also been active on 29 of the city’s 30 cameras since the initial installation, running for 17 straight months until Mountain View found and disabled it on January 5. Through that tool, more than 250 agencies that had never signed any data agreement with Mountain View ran an estimated 600,000 searches over a single year, according to local paper the Mountain View Voice, which first uncovered the issue after filing a public records request.
A different town (Staunton, VA) also turned of their Flock installs after their CEO sent out an email claming:
https://www.aclu.org/news/privacy-technology/flock-ceo-goes-...
> The attacks aren't new. You've been dealing with this for forever, and we've been dealing with this since our founding, from the same activist groups who want to defund the police, weaken public safety, and normalize lawlessness. Now, they're producing YouTube videos with misleading headlines.
If you don't remember, Daniel Penny is the ex-Marine that killed a homeless man on the NYC subway then was found not guilty of criminally negligent homicide.
I'd go check the YNAB forums, there's a lot of v4 users who really hate the cloud version. I tried to switch and gave it up for two reasons:
- Import from v4 is super broken for credit card accounts and I ended up with weird positive balances that don't add up based on any combination of transactions. Forum advice was "start over".
- You cannot tag income as "available for next month", instead all income must be immediately budgeted. Which is different than the old YNAB advice of being a month ahead. Forum advice is to earmark it a special category then fix it when the next month lands (https://support.youneedabudget.com/t/63pgpp/budget-using-onl...).
- No side-by-side month view. You can only view one month at a time.
The differences were too much for me and the import was so borked that I immediately gave up and stuck with v4.