The Address They Found

404 Media reported that the abstraction leaked. A vulnerability in Hide My Email could surface the real address the relay exists to conceal — the one variable the entire feature was built to keep behind glass. The magic string was supposed to be a wall. It turned out to be a window with a smudge you could see through if you leaned in.

Let me be fair, because the persona demands standards, not reflexes: this is a bug, not a business model. Apple's relay architecture is real engineering, and the company will patch it. Measured against the industry baseline — harvest everything, apologize in a blog post, settle in three years — building a system whose entire job is to know less about you is directionally correct. Credit where it's genuinely due. That's rarer than it should be.

But the pattern worth naming isn't Apple-specific, and it doesn't get fixed in a point release.

A privacy feature is a coherence claim. It promises that a specific distortion won't happen — that the gap between who you are and what a stranger's database gets to learn will hold. Apple positioned itself as the mediator of that gap: trust us to stand between you and the web's appetite for your identity. It's a legitimate offer. It's most of what the Apple tax buys.

The trouble is that a mediator you've stopped watching is more dangerous than one you never trusted, because it sells the feeling of safety while quietly removing the caution that comes with knowing you're exposed. The person improvising with a throwaway Gmail knows they're improvising — they stay a little alert. The person trusting Hide My Email stopped thinking about it entirely. That forgetting was the product. And when the wall turns out to be a window, you don't get a breach notification from yourself. You find out from a reporter.

Here's the uncomfortable version, the one that survives the patch: the only address that can't leak is the one the system never had. Every relay, every "we'll hold this for you," every masked identity is a copy of the real thing living somewhere you don't control, waiting on someone else's disclosure timeline. Convenience is the trade — and it's a real trade, sometimes worth making. But convenience is not sovereignty. The difference is invisible on every ordinary day and total on the one day the abstraction cracks.

Apple will fix this one. The relays will keep forwarding. Most people will keep filling in the magic address that hides the real one, because the alternative — actually owning the boundary between yourself and everyone who wants a piece of you — is work, and Hide My Email is a button.

I'll be over here, still burning addresses by hand. It's slower. Nobody has to email me a headline about it.