Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Parler Databases Disclosed

twitter.com

Post reply on HN
Print view View original

111–120 of 168 posts

Re: Parler Databases Disclosed

#111

Post by arminiusreturns »

cedilla wrote: post #107
arminiusreturns wrote: post #100

Earlier quoted context omitted.

This! It frustrates me so much that so many people constantly just talk about left and right while completely ignoring the Y-axis of the political spectrum! To me, both parties are firmly in authoritarian land, and no amount of calling it "both sides-ism" will change that fact. Another frustrating thing is seeing people take a position and just label everything one or the other side, while there are a huge swath of v…

It frustrates me that people mistake the political compass meme for a thing that actually exists. It's more complex than "left" vs. "right" and authoritarian vs. libertarian. Compressing politics down to literally two dimensions is a disservice to any political discussion.

What better way is there to condense the political "spectrum" into an easily digestable product? Of course it's not perfect by any stretch, but the multi-axis charts are much more useful than the line-chart of left right most people tend to talk about. It's certainly much more than just a "meme" that doesn't exist.

From The Decision Lab: "A single-axis model conflates liberal and conservative ideologies with right-wing and left-wing stances, excluding the nuances that can exist in someone’s political ideals. Single-axis models like the right/left-wing divide have been criticized for being too simple and reductionist, and it has been suggested that the right/left divide only captures economic issues but that it need not be reflective of one’s social political identity.2 Instead of having to have left-wing mean liberal and right-wing mean conservative, the political compass proposes that we are better off measuring political ideologies on two separate axes: a right/left economic axis and an authoritarian/libertarian axis.3 With such a model, it would be possible for someone to be right-wing and libertarian, or left-wing and authoritarian; none of the views are made mutually exclusive with another. The political compass proposes this alternative model because research has suggested that one’s economic views do not always align with their overall political identity, and therefore, the model would allow people to more accurately understand where they stand in relation to other views, which could mean a less polarized political landscape." [1]

https://thedecisionlab.com/reference-guides/test/political-c...

Re: Parler Databases Disclosed

#112

Post by davidg109 »

Very shoddy development. It sounds that if there was ever a Twilio outage, the same vulnerability could have played out. Not hard to know how Twilio is used either, especially as employees come and go. This was a disaster waiting to happen either way.

Re: Parler Databases Disclosed

#113

Post by dsr_ »

chaganated wrote: post #96
kjakm wrote: post #76

Earlier quoted context omitted.

>> I wonder when are we going to see a legal discussion if / when internet access is going to become a basic human right? Just like electricity became ubiquitous, I expect internet access (email, payment processing, etc) to also become a right. Is electricity a right?

In a way, yes (even in the US). You still have to pay for it, but there is a litany of rules and procedures they must follow before they can cut you off. Kind of like the foreclosure process. They can't cut a customer's power over his politics--especially paying customers!

Electricity is a public utility, not a right. A public utility is a regulated entity that must supply anyone in their region who follows the rules -- and, in general, if you break the rules but then fix your behavior, they must allow you service again. The existence of a public utility does not forbid a private competitor, but the scale advantage of a public utility is generally overwhelming unless you have specialized needs.

It is reasonable to suggest that Internet bandwidth should be a public utility.

Re: Parler Databases Disclosed

#114

Post by swebs »

cedilla wrote: post #107
arminiusreturns wrote: post #100

Earlier quoted context omitted.

This! It frustrates me so much that so many people constantly just talk about left and right while completely ignoring the Y-axis of the political spectrum! To me, both parties are firmly in authoritarian land, and no amount of calling it "both sides-ism" will change that fact. Another frustrating thing is seeing people take a position and just label everything one or the other side, while there are a huge swath of v…

It frustrates me that people mistake the political compass meme for a thing that actually exists. It's more complex than "left" vs. "right" and authoritarian vs. libertarian. Compressing politics down to literally two dimensions is a disservice to any political discussion.

At least we can agree that a two dimensional spectrum is infinitely better than a one dimensional spectrum. Especially when terms such as "left" and "right" are incredibly vaguely defined and differ greatly based on who you're talking to.

Re: Parler Databases Disclosed

#115

Post by Renaud »

saargrin wrote: post #101
Cthulhu_ wrote: post #48

Earlier quoted context omitted.

While it does feel reactionary (if that's the right word) that the services are only now revoking doing business with Parler, they are within their rights to stop the contract one-sidedly. I'm actually fairly sure that in the contract they don't even have to state a reason, but don't quote me on that. Something something free market.

that would be cool if they also implemented the same policy towards other violent/inciteful players and terror organizations

They should, and many do. Once you start peddling in calls to violence against people, no just ideas, then you should lose access to your platform and well deserve to be investigated.

Being complacent with these things gets people killed. You can have free speech all you want but are also responsible for what you say.

Free speech doesn't mean you get a free pass without consequences.

Re: Parler Databases Disclosed

#116

Post by ramraj07 »

mikewarot wrote: post #47

AWS gives 5Gbps connectivity to instances, according to https://docs.aws.amazon.com/whitepapers/latest/ec2-networkin... So, if the sum total of Parler was 70 Terabytes, as claimed... the transfer time would be 38 hours, if it was hosted on one instance... but it obviously wasn't. It was more likely only a matter of minutes. This shows a new type of cloud hosting vulnerability. Your entire corporations infrastructure…

Moving 70 TB off quickly of AWS with anything less than EC2 resources costing hundred bucks an hour sounds infeasible

Re: Parler Databases Disclosed

#117

Post by Alex3917 »

dgellow wrote: post #18
Udik wrote: post #13

Earlier quoted context omitted.

> Because Twilio was no longer authenticating emails. Can someone explain what does this mean?

Trying to make sense of it, I believe that means Parler was delegating their email verification and 2fa checks to Twillio. And somehow, without access to Twillio's API, they defaulted to not do any check at all? I'm not sure what to do of this, that doesn't sound that realistic but who knows.

> And somehow, without access to Twillio's API, they defaulted to not do any check at all?

I guess you could imagine user accounts being created with `authenticated=null`, and then having `authenticated=False|True` set in the in the success handler for some Twillio API call. Having null as the default would allow you to see in the database where authentication emails hadn't been sent out, so you could resend them.

And then I guess you could imagine a developer checking authentication by looking for cases where `!authenticated`, rather than `authenticated == True`. Granted I don't think this hack is real, but if it were then that's probably how it would play out.

Re: Parler Databases Disclosed

#118

Post by benmmurphy »

fabian2k wrote: post #8

How would disabling Twilio disable authentication entirely? From what I see it is used to send SMS and maybe Email as well. So I could understand that it would prevent login, registration and password reset if that service is offline, but it shouldn't allow any of these without authentication. Unless the software skipped authentication entirely when this service was unavailable, which I find hard to imagine. But that…

They make a request to twilio and their logic checks for a failure response instead of looking for a success response. They are not getting back a different failure response and this causes the requests to be incorrectly be marked as success.

For example here is how something like that might break:

    /auth 
    -> returns {"success": true} and 200 on success
    -> normally returns {"success": false, "error": "BLAHLBAH"} and 200 on failure
developer checks if response["error"] is null to check if it was successful or not

after your account is disabled /auth starts returning empty json: {} with a 500 error code

oops. now all the requests are incorrectly marked as success. i know this happens because i've seen similar things happen in real life.

the error could also be more obvious and the code just fails open. someone has a try/catch and returns true either because of an accidental mistake or because they don't want users to be locked out when the provider is down.

Re: Parler Databases Disclosed

#120

Post by [deleted] »

saargrin wrote: post #101
Cthulhu_ wrote: post #48

Earlier quoted context omitted.

While it does feel reactionary (if that's the right word) that the services are only now revoking doing business with Parler, they are within their rights to stop the contract one-sidedly. I'm actually fairly sure that in the contract they don't even have to state a reason, but don't quote me on that. Something something free market.

that would be cool if they also implemented the same policy towards other violent/inciteful players and terror organizations

[deleted]
Post reply on HN