IRL.icecoolmadness
Bluelighter
It really is easy, that's why I've done that job for ~15 years, automatic updates don't usually cause any problems. Most Linux distributions come with fairly secure default settings now, so you'd have to mess something up rather than not fix something to make it insecure. Just doing basic maintenance like keeping up with updates will keep out 99% of hackers & the other 1% are probably busy with better targets. Anyway, they messed up somehow & got hacked.
I think it'd be a very desperate law enforcement sting operation to go after people posting reviews of mostly legal clearnet vendors. Not saying I trust the new site, I don't even trust them enough to look at it, it seems even more suspect than the old one, but I doubt it's LE running it.
You should work on the assumption that everything is compromised, but if you start really believing it then it's paranoia.
Of course I do not automatically believe that any such web application is ran by people with ulterior motives, be it LE or someone/thing else - I just assume so to keep myself secure - I think we agree on that one.
There is of course distinction to be made between keeping the insfrastructure, servers as well as making the code secure. For web applications of such nature - its all or nothing. As DS correctly pointed out - maintaining privacy of the users is a difficult task indeed , on all 3 aforementioned fronts.
As for police going after the users - look up operation Ismene.