Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitch is hacked, and its source code leaked

kotaku.com

Post reply on HN
Print view View original

121–130 of 325 posts

Re: Twitch is hacked, and its source code leaked

#121

Post by cheeze »

vineyardmike wrote: post #106
lamontcg wrote: post #73

Earlier quoted context omitted.

Conflating AWS security with twitch security is probably the wrong way to think about it. Within Amazon those are almost going to be two entirely separate companies, with very different security focuses. The idea that Amazon is monolithic and uniform wasn't true when I left there in 2006, and I'm certain it is less so now. And that isn't just that its related to the merger, but that fundamentally its different busine…

But does twitch not share the same Amazon wide git service? Could most of Amzn code be leaked or compromised? Seems like all of amazon internals that shares security measures is at risk...

I've heard (but don't have any actual evidence more than hearsay) that Twitch generally operates independently of Amazon/AWS. I'm sure that they share some things, but I wouldn't be surprised if their source was separate from the "main repo"

Re: Twitch is hacked, and its source code leaked

#123

Post by cheeze »

peterkos wrote: post #100
CoolGuySteve wrote: post #55

Earlier quoted context omitted.

"Sorry. Unless you’ve got a time machine, that content is unavailable." Too bad, it would be nice to see someone go through and document how Twitch works. I've never worked at "web scale" so I'd probably learn a lot.

A lot of it is probably hacked together -- like, embarrassingly hacked together lol

This is true about almost any company. Closed source generally means you can have lower standards.

Re: Twitch is hacked, and its source code leaked

#124

Post by oceanplexian »

ThePadawan wrote: post #81
ashtonkem wrote: post #60

Earlier quoted context omitted.

You completely misread me.

Oh I'm sorry, here's what I read: "Building apps is easy as long as you don't have millions of users. For that you have to actually think about bottlenecks, the larger architecture etc." (I agree with that) What I wanted to express is that lots of engineers I personally know instead say "Building apps involves thinking about every bottleneck in advance and optimizing for every possible user scenario and a global user…

"Building apps involves thinking about every bottleneck in advance and optimizing for every possible user scenario and a global user base, regardless if the number of users is only ~100."

I would advocate the exact opposite. If you need to scale to X users focus on making a great platform for X users, even if it’s only 100. If you try to over-engineer instead you’ll prematurely optimize and will make poor decisions that’ll come back to bite you when you actually DO need the scale and the requirements change.

Re: Twitch is hacked, and its source code leaked

#125

Post by holler »

runawaybottle wrote: post #75
lm28469 wrote: post #67

Earlier quoted context omitted.

Everything is just a crud app with a few extra steps.... yet you're not Zuckerberg or Dorsey

I’m so misread, Twitch is a lot of luck, so is all of these companies. Show me the the source code for luck. I don’t give a fuck if you leaked a video streaming crud app code lol.

You're missing the _hard work_ part. Sure there's always an element of "luck" in any story of success, but that mostly has to do with timing, and is much less weighted than the perseverance and hard work of the people building it.

Twitch is a full-featured, very mature application with many moving parts outside of just the video streaming, and building all those parts took an incredible amount of time and effort.

Re: Twitch is hacked, and its source code leaked

#126

Post by kuroguro »

dolores_ab wrote: post #83
dolores_ab wrote: post #11

Someone actually started streaming going through the code ... on twitch. https://www.twitch.tv/deepfrieddev

They were banned for 14 days -- https://www.reddit.com/user/coder_ent/comments/q2q24x/banned...

On one hand I understand why you'd ban that kind of content, on the other it's essentially public information now... what's the point.

Re: Twitch is hacked, and its source code leaked

#127

Post by retbull »

munk-a wrote: post #61
leros wrote: post #8

Earlier quoted context omitted.

It something I would expect security hardware to have automatically stopped. Even an employee shouldn't be able to download 125GB of stuff without flipping a safety switch somewhere.

Gosh - I've worked at shops where we handled multi-terabyte images and we'd regularly stream large chunks of that while debugging tools. I've also worked at places where data was king and 125GB of stuff might be a reasonable dispatch of data to help someone debug. The volume of data is irrelevant - source code is usually teensy tiny and of far more value to companies than, say, three months of livestream chat logs. I…

Yeah volume is a terrible metric to go by. I work as a data engineer and a lot of the time if I am working between environments or when migrating between data centers will have a copy of the data locally that I can write tests against or move to somewhere I can compare it to a running output. This would be possible to do entirely remotely I guess but not nearly as easy. (note I never do this with anything that contains PII)

Re: Twitch is hacked, and its source code leaked

#128

Post by errantspark »

nemothekid wrote: post #28
63 wrote: post #13

Earlier quoted context omitted.

> It's also strange that someone who has this level of access to what is presumably a multi-billion dollar company decided to just leak the data? Maybe they did try to ransom it, but I'd imagine someone with this kind of access inside Twitch must have had some creative way of making money. Notably, the initial leak didn't actually include the password data which the leaker claims to have, just source code and payment…

> It's possible that this first leak was just to establish trust so they can random or auction password hashes later. Password hashes are relatively useless though? Once the leak is announced I imagine most of the big targets will rotate their credentials. Then the next thing you need to do is spend possibly thousands in CPU time bruteforcing bcrypt hashes. Then I'm not sure what you can even do with those. I'm not c…

A few things here. If you're the sort of person who runs a crypto mine, which I assume many of the people interested in breaking hashes are you have enough firepower at your disposal to at least perform a targeted attack on a few hashes with relative ease.

Ideally that would be useless because things are properly salted and you don't know the salt, however with access to all of the source code as we have here I think it isn't as clear cut, as it may be possible to reverse out the salts as well.

I'm not a cybersec guy so please take my speculation with a grain of salt.

Re: Twitch is hacked, and its source code leaked

#129

Post by iuri1 »

Since the main leaked files are from github, I'm assuming they got it from one of the many reported github auth flaws which don't get fixed and allows access to private repositories. Or more unlikely, via someone getting sloppy with their laptop.

Now I wonder if the commit history has database dumps or sensitive information, which is a common practice, or if any twitch servers have been accessed through a breach or privileged information found in some of their source code.

Re: Twitch is hacked, and its source code leaked

#130

Post by whimsicalism »

blain wrote: post #119
noncoml wrote: post #95

Anybody took a peek? What language, and framework if they use one, do they use?

Here are a few screenshots of go and php: https://sizeof.cat/post/twitch-leaks/ . WARNING: do not click the link, copy it and paste it in new tab.

?
Post reply on HN