> Adafruit accessed only information that Flux’s own systems made publicly available through a server misconfiguration

Does anyone have some more context about what happened here? An uncharitable analogy might be that I misconfigured my front door by not locking it, which doesn't give someone the right to walk in and look around - but I have no idea what Adafruit is specifically being accused of doing.

It certainly doesn't look like they've publicly released anything. My guess is they found a problem and have been following reasonable responsible disclosure guidelines. However, the 90 days (or whatever time limit was given) is likely expiring and to head off publication, flux.ai is getting lawyers involved.

This is all 100% speculation, just based on checking the archive sites and search sites historical data and finding nothing.

what about if I knock on the door (send an http request), and someone comes to it and hands me a bunch of documents (sends an http response with data).

It often does when your front door is otherwise a business storefront. Without knowing the specifics of what was accessed, analogies really aren't helpful. And there seems to be zero context here, so this strikes me as the most plausible scenario: https://news.ycombinator.com/item?id=48368635

(I agree that Adafruit's statement itself is worded pretty terribly!)

That isn’t legal in most jurisdictions either. You’re not a lawyer.