Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The naughty username checking system used by Twitch

ghostbin.com

Post reply on HN
Print view View original

41–50 of 348 posts

Re: The naughty username checking system used by Twitch

#41

Post by throwaway984393 »

rhema wrote: post #5

I have a hard time believing this was / is the real version used. It doesn't seem broad enough. More likely it was a kind of smoketest that made sure that a more automated keyword checker was working. It does remind me of the XKEYSCORE (Snowden leaks) that used keywords to bubble up potential threats from emails etc https://www.businessinsider.com/nsa-prism-keywords-for-domes... .

It seems you are assuming that software is usually written well, or as well as it can be. It's much more likely to be the opposite.

Re: The naughty username checking system used by Twitch

#43

Post by gipp »

woodruffw wrote: post #29
rhema wrote: post #5

I have a hard time believing this was / is the real version used. It doesn't seem broad enough. More likely it was a kind of smoketest that made sure that a more automated keyword checker was working. It does remind me of the XKEYSCORE (Snowden leaks) that used keywords to bubble up potential threats from emails etc https://www.businessinsider.com/nsa-prism-keywords-for-domes... .

Someone in another thread mentioned that these might be part of corpus generation for an ML model. That would make more sense to me.

Based on the filepath given in this very thread, it seems plain that that's the case (safety-ml\offensive-usernames\data_pull\sql\bad.sql).

Re: The naughty username checking system used by Twitch

#44

Post by Waterluvian »

phamilton wrote: post #34

We had to do this for a link shortening system (to make sure random base64 didn't contain profanity). It was a pretty fun problem. Not just the implementation, but doing the math to make sure it didn't make our shortened links easily enumerable. The implementation wasn't too bad, but we set up logging initially to spit out any random strings it decided to block. I demo'd this in front of the whole company and live ta…

Fascinating! I guess an easy solution is to inject non alpha characters into any generated string. I imagine a constraint was that you wanted them to be easy to type?

Re: The naughty username checking system used by Twitch

#45

Post by alkz »

msdrigg wrote: post #18

Whats this one about? CREATE OR REPLACE FUNCTION is_blasphemy (VARCHAR) RETURNS BOOLEAN STABLE AS $$ SELECT replace($1,'_','') SIMILAR TO '%p(o|0)rc(o|0)di(o|0)%' OR replace($1,'_','') SIMILAR TO '%p(o|0)rc(o|0)mad(o|0)nna%' $$ LANGUAGE SQL;

that should actually be porcAmadonna

Re: The naughty username checking system used by Twitch

#46

Post by nazgulsenpai »

fsckboy wrote: post #31
Igelau wrote: post #22

Earlier quoted context omitted.

Some near the end looked like they might be in another language, but I won't be the one to find out. It used to be "if I search for this term, am I accidentally going to wind up getting goatse or something?" The good old days. Now it's "if I search for this term, is the FBI going to kick my door in?"

I was pedantic about it in the good old days too, it's goatse.cx and not goatse you need the domain to make the goat-sex joke work

Woah, 20+ years later and I literally had no idea until now. Learn something new every day, but somehow this one is shocking because of how obvious it is and how long it took :)

Re: The naughty username checking system used by Twitch

#47

Post by pchristensen »

phamilton wrote: post #34

We had to do this for a link shortening system (to make sure random base64 didn't contain profanity). It was a pretty fun problem. Not just the implementation, but doing the math to make sure it didn't make our shortened links easily enumerable. The implementation wasn't too bad, but we set up logging initially to spit out any random strings it decided to block. I demo'd this in front of the whole company and live ta…

We did a similar thing at Groupon after a customer’s coupon code contained an F bomb.

Re: The naughty username checking system used by Twitch

#48

Post by somebodythere »

woodruffw wrote: post #32
smoldesu wrote: post #6

Earlier quoted context omitted.

I feel bad for the Amazon employee who came into work one day with this project sitting on their desk.

My understanding from talking to {current,former} {Amazon,Twitch} employees is that Twitch has retained a decent amount of engineering independence. For better or worse, it's unlikely that some rando at Amazon ended up with this particular PHP file on their desk.

Twitch is to Amazon as Quebec is to Canada.

Re: The naughty username checking system used by Twitch

#49

Post by phamilton »

Waterluvian wrote: post #44
phamilton wrote: post #34

We had to do this for a link shortening system (to make sure random base64 didn't contain profanity). It was a pretty fun problem. Not just the implementation, but doing the math to make sure it didn't make our shortened links easily enumerable. The implementation wasn't too bad, but we set up logging initially to spit out any random strings it decided to block. I demo'd this in front of the whole company and live ta…

Fascinating! I guess an easy solution is to inject non alpha characters into any generated string. I imagine a constraint was that you wanted them to be easy to type?

SMS is the biggest constraint. Unicode characters trigger lower segment char limits (effectively doubling the cost of a 71 char text message). And also it's important that the links can be clicked on a smartphone. So url-safe base64 (some shorteners use base62). And numbers can be N4u6hty too, so you gotta catch those cases.

Re: The naughty username checking system used by Twitch

#50

Post by jfrunyon »

woodruffw wrote: post #32
smoldesu wrote: post #6

Earlier quoted context omitted.

I feel bad for the Amazon employee who came into work one day with this project sitting on their desk.

My understanding from talking to {current,former} {Amazon,Twitch} employees is that Twitch has retained a decent amount of engineering independence. For better or worse, it's unlikely that some rando at Amazon ended up with this particular PHP file on their desk.

This ain't PHP...
Post reply on HN