Live data from Hacker News

The naughty username checking system used by Twitch

ghostbin.com

151–160 of 348 posts

Re: The naughty username checking system used by Twitch

#151
post #141

Earlier quoted context omitted.

I have a bus ticket from Stockholm with the serial of F4CK. Totally made my day back then to be honest.

No you see. The bus company put it there to tell you to F4Ck off.

Please note: HN is not Reddit.

Re: The naughty username checking system used by Twitch

#153
post #143

Earlier quoted context omitted.

I was in the UK recently and - if you can believe it - there was a car on the block I stayed whose plates contained 666. Also, have a feelin you meant to do 1312. What’s the issue with 4444, though?

> What’s the issue with 4444, though? https://en.wikipedia.org/wiki/Tetraphobia

Woah, had no idea!

> When Beijing lost its bid to stage the 2000 Olympic Games, it was speculated that the reason China did not pursue a bid for the following 2004 Games was due to the unpopularity of the number 4 in China. Instead, the city waited another four years, and would eventually host the 2008 Olympic Games, the number eight being a lucky number in Chinese culture.

Thought this was particularly interesting.

Re: The naughty username checking system used by Twitch

#154
post #93

We had to do this for a link shortening system (to make sure random base64 didn't contain profanity). It was a pretty fun problem. Not just the implementation, but doing the math to make sure it didn't make our shortened links easily enumerable. The implementation wasn't too bad, but we set up logging initially to spit out any random strings it decided to block. I demo'd this in front of the whole company and live ta…

> to make sure random base64 didn't contain profanity I would have said "why bother" until this happened to us. A customer rang us up in a fury because some demo/ random data that we generated happened to have the word "penis" in it. They were convinced we must have put it there because we thought he was a cock. It was very difficult to defuse the situation.

Reminds me of this great story https://thedailywtf.com/articles/The-Automated-Curse-Generat...

Re: The naughty username checking system used by Twitch

#155
post #11
post #5

I have a hard time believing this was / is the real version used. It doesn't seem broad enough. More likely it was a kind of smoketest that made sure that a more automated keyword checker was working. It does remind me of the XKEYSCORE (Snowden leaks) that used keywords to bubble up potential threats from emails etc https://www.businessinsider.com/nsa-prism-keywords-for-domes... .

It also mostly checks for English naughty words and not much else. People can have fun in lots of other languages, so it would seem this is a small sample.

Bunch of ineffective entries too, all patterns containing underscores won't ever match.

Re: The naughty username checking system used by Twitch

#157

Why is all of this implemented in SQL? Wouldn't it be better to do it in code with dedicated methods to filter stuff out? IMO logic inside of SQL queries just adds unnecessary complexity, implementing this in code would've been maintainable and testable.

Boss: "Hey Bob! People started spamming one of our boards, we are currently busy doing other things and cannot deploy new client, can you make filter with these 3 words and deploy it ASAP?"

Bob: "Sure no problem if it's only temporary"

--few months later

Chief architect:

"People are spamming more and more, we should design new system for these 234 new bad words, I need team of 7, two backend guys, 5 frontend guys and 4 weeks. It will also require minor rewrite of few external components."

Boss: "geez we're in the middle of sprint right now, Bob can you add these 234 words to existing filter? Make sure it's in production before lunch, thanks" (checks watches) "I have to go now, meeting with customer, bye".

Re: The naughty username checking system used by Twitch

#159
post #36

Is there a blog or something where someone is going through the dump and summarizing?

Your best bet atm is to just look through reddit/hn comments/posts people make as they find stuff. The leak's too big for one person/team to quickly find all spicy stuff.

https://sizeof.cat/post/twitch-leaks/

Re: The naughty username checking system used by Twitch

#160

Earlier quoted context omitted.

That's amusing, but I think it also highlights the effectiveness of the strategy. WNKR is excusable and defensible. WANK would not be. Edit: But I'll concede that when your outputs are only four characters long and end users will actively interact with them (write them down, type them again later, etc.), additional safeguards might be appropriate. Or simply omit all alphas and use only numerics.

> Or simply omit all alphas and use only numerics. You're still not out of the park with numerics - people with 1313 or 6660 or 4444 or something will complain a lot. The possibility of a 666 in some new biometric government IDs in my country rose a massive stink from church...

My girlfriend got a new bank account and when she received her account number it contained 666. She asked for a different number and they changed it without charge.
Post reply on HN