Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Parler Databases Disclosed

twitter.com

Post reply on HN
Print view View original

141–150 of 168 posts

Re: Parler Databases Disclosed

#141

Post by thinkharderdev »

neya wrote: post #4

"Twilio put out at midnight last night. In that Press Release, Twilio accidentally revealed which services Parler was using. Turns out it was all of the security authentications that were used to register a user. This allowed anyone to create a user, and not have to verify an email address, and immediately have a logged-on account. Well, because of that access, it gave them access to the behind the login box API that…

The description doesn't really make any sense. Did everything just fail open? I would assume that if your SMS/Email service stopped working then it would just be that nobody could login or sign up.

Re: Parler Databases Disclosed

#142

Post by nunez »

ramraj07 wrote: post #116
mikewarot wrote: post #47

AWS gives 5Gbps connectivity to instances, according to https://docs.aws.amazon.com/whitepapers/latest/ec2-networkin... So, if the sum total of Parler was 70 Terabytes, as claimed... the transfer time would be 38 hours, if it was hosted on one instance... but it obviously wasn't. It was more likely only a matter of minutes. This shows a new type of cloud hosting vulnerability. Your entire corporations infrastructure…

Moving 70 TB off quickly of AWS with anything less than EC2 resources costing hundred bucks an hour sounds infeasible

Spot instances, though.

Re: Parler Databases Disclosed

#143

Post by thinkharderdev »

cbozeman wrote: post #75
AniseAbyss wrote: post #70

Earlier quoted context omitted.

Tech companies are shutting the Trump movement down because of public pressure. Its no different from any other boycott in that sense. Capitol Hill riot was the classic "free speech but not free from consequences" moment. Association with conservatives is now a financial liability.

> Association with conservatives is now a financial liability. Considering they make up an enormous percentage of the population, I'm not sure that's a sound strategic move.

I would draw a distinction between "Conservatives" and a small subgroup within the right that is actively fomenting a violent insurrection.

Re: Parler Databases Disclosed

#144

Post by ghaff »

eyko wrote: post #134
dsr_ wrote: post #113

Earlier quoted context omitted.

Electricity is a public utility, not a right. A public utility is a regulated entity that must supply anyone in their region who follows the rules -- and, in general, if you break the rules but then fix your behavior, they must allow you service again. The existence of a public utility does not forbid a private competitor, but the scale advantage of a public utility is generally overwhelming unless you have specializ…

It would be useful to clarify what "follow the rules" here means, in the USA (for us non-USA audiences). It probably varies in different countries, but in most cases doesn't it simply refer to fair usage? Make your payments in time and don't put excessive strain on the grid by powering your inter-dimensional portal. Does ideology or clandestine activity matter in how you use electricity? Of course, a court order coul…

ISPs, CDNs, domain registrars, DNS, etc. have all cut off services to sites that they consider in violation of their user agreements (which mostly boil down to you've become a liability for us). If you've annoyed enough people, you can pretty much get booted off the Internet--especially if you need enough infrastructure, data, authentication, etc. that you can't easily just force people into a game of whack-a-mole.

Re: Parler Databases Disclosed

#145

Post by diebeforei485 »

nl wrote: post #60
neya wrote: post #4

"Twilio put out at midnight last night. In that Press Release, Twilio accidentally revealed which services Parler was using. Turns out it was all of the security authentications that were used to register a user. This allowed anyone to create a user, and not have to verify an email address, and immediately have a logged-on account. Well, because of that access, it gave them access to the behind the login box API that…

Did Twilio actually make this alleged press release? There is nothing like that on https://www.twilio.com/press/releases

I have the same question about the press release. Where was it posted and what was its content?

I know that not all press statements are going to be on the website.

Re: Parler Databases Disclosed

#146

Post by Balgair »

Aeolun wrote: post #85
rndholesqpeg wrote: post #72

Earlier quoted context omitted.

I guess you dont get the irony of using 'Lynch Mob' figuratively, because Parler was de-platformed for helping organize literal Lynch Mobs

No, I was aware of that. It was why I used the term. It’s not the same at all, but it still leaves a bad taste in my mouth. Legal action against the platform would have been fine.

No judge would take the case though. Not from an ideological stand, but from a technical one. Amazon (presumably) has a contract that says they can nullify the contract if you do things that violate certain conditions.

Say it was Amazon suing Parler here. Amazon says that Parler is doing stuff Amazon doesn't like. Parler says tough cookies, we're still gonna do that stuff. So Amazon brings Parler to court. The Judge asks what Amazon wants to do about this. Amazon says it wants to kick Parler off. The Judge says 'Yes, the contract between you two says you can do that. Why the hell are you wasting my time? Read your own contract, what are you, a buncha pre-laws?' Parler is then kicked off.

Bad taste or not, Amazon (it appears) is well within it's rights to dissolve the contract with Parler (which I have not seen).

Re: Parler Databases Disclosed

#147

Post by albroland »

willejs wrote: post #34

This post seems fake. There was a group of people archiving the public content of parler using this docker container https://github.com/ArchiveTeam/parler-grab and archiving it here https://tracker.archiveteam.org/parler/ . I can't validate anything else in this twitter post. The administrator accounts part all seems fake, unless anyone has found the rest of the content or has a better source? Previous discussion dee…

This was my take on reading the wild "2nd hand story" in that reddit post.

Almost none of it makes any sense; instead it seems like people just crawled parler's public API and saved the responses into a big archive ("the leak"). The only "exploit" I see could be that parler uses incrementing IDs for posts/content allowing easy enumeration crawling.

Re: Parler Databases Disclosed

#148

Post by incangold »

arminiusreturns wrote: post #100
swebs wrote: post #92

Earlier quoted context omitted.

You're talking about authoritarians on both sides. There are still libertarians on both sides (and even independent) who care more about civil liberties like freedom of speech (the ideal, not just the first amendment).

This! It frustrates me so much that so many people constantly just talk about left and right while completely ignoring the Y-axis of the political spectrum! To me, both parties are firmly in authoritarian land, and no amount of calling it "both sides-ism" will change that fact. Another frustrating thing is seeing people take a position and just label everything one or the other side, while there are a huge swath of v…

Doing principle component analysis on political views to try to determine the number of axes required to account for variability in political views is an interesting endeavour.

e.g. https://www.researchgate.net/figure/PRINCIPAL-COMPONENT-ANAL...

https://escholarship.org/content/qt1c192923/qt1c192923.pdf?t...

Re: Parler Databases Disclosed

#149

Post by albroland »

albroland wrote: post #147
willejs wrote: post #34

This post seems fake. There was a group of people archiving the public content of parler using this docker container https://github.com/ArchiveTeam/parler-grab and archiving it here https://tracker.archiveteam.org/parler/ . I can't validate anything else in this twitter post. The administrator accounts part all seems fake, unless anyone has found the rest of the content or has a better source? Previous discussion dee…

This was my take on reading the wild "2nd hand story" in that reddit post. Almost none of it makes any sense; instead it seems like people just crawled parler's public API and saved the responses into a big archive ("the leak"). The only "exploit" I see could be that parler uses incrementing IDs for posts/content allowing easy enumeration crawling.

As expected, it's BS: https://twitter.com/donk_enby/status/1348666166978424832

Seems jason scott's archive team, using existing tooling they built for scraping, scraped parler before it went down.

Re: Parler Databases Disclosed

#150

Post by evgen »

WJW wrote: post #108
cbozeman wrote: post #73

Earlier quoted context omitted.

> This shows a new type of cloud hosting vulnerability. Your entire corporations infrastructure could be mirrored faster than you could notice. This is actually fucking terrifying.

Additional interesting scenarios: - Nation states that manage to infiltrate a few spies into Amazon or Google could "just" copy the backups of the database without anyone being the wiser. - My favourite mission ever from the "Shadowrun" games: Step 1 was a mission to alter the backups of some main database (stored at some 3rd party) to include additional admin credentials. Step 2 was to "clumsily" attack the main tar…

The problem with this is that in the case of Google/FB/etc the database to be copied is so large as to make this task functionally impossible. Even if you happened to have a half a petabyte of storage available somewhere you would lack the bandwidth to exfiltrate. The problem with Parler is that it was living on a shared cloud so it was easy for someone to spin up copies and use intra-DC copy mechanisms (or even simple volume mirroring) and the data was also small enough to be within reach for anyone who was curious -- it would cost you less than $5K to copy and then export the entire Parler corpus in less than an afternoon.
Post reply on HN