Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Parler’s amateur coding could come back to haunt Capitol Hill rioters

arstechnica.com

Post reply on HN
Print view View original

21–30 of 52 posts

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#21

Post by disabled »

whatshisface wrote: post #10
commandlinefan wrote: post #5

> Its public API used no authentication. When users deleted their posts, the site failed to remove the content and instead only added a delete flag to it. Oh, and each post carried a numerical ID that was incremented from the ID of the most recently published one. There's really nothing wrong with any of that, unless you're specifically coding to defend against content scraping. I mean, the whole point of a "tweet" o…

> Worse, but again, was the site even supposed to be designed with anonymity in mind? According to reports from several HN users who tried making accounts, Parler requires drivers license photos as a part of the process you have to go through before you can post. Rather than being designed for anonymity, they seem designed to identify all of their users as unequivocally as possible.

Yeah you never give out your drivers license number as an American (or passport number, for international users), and especially not for some sketchy social media platform. It’s an easy way to get your credit stolen.

Maybe they let people block out their ID numbers on the license photos, but I doubt that the vast majority of users there would even bother.

Some governments do have eIDs, that work cross-border, that are designed for both the public and private sector, with emphasis on security (although there are bound to be serious problems). This is the case in many European Union countries, and it will apply at some point to the entire EU: https://ec.europa.eu/digital-single-market/en/policies/trust...

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#22

Post by drew55555 »

whatshisface wrote: post #10
commandlinefan wrote: post #5

> Its public API used no authentication. When users deleted their posts, the site failed to remove the content and instead only added a delete flag to it. Oh, and each post carried a numerical ID that was incremented from the ID of the most recently published one. There's really nothing wrong with any of that, unless you're specifically coding to defend against content scraping. I mean, the whole point of a "tweet" o…

> Worse, but again, was the site even supposed to be designed with anonymity in mind? According to reports from several HN users who tried making accounts, Parler requires drivers license photos as a part of the process you have to go through before you can post. Rather than being designed for anonymity, they seem designed to identify all of their users as unequivocally as possible.

I had an account and you definitely didn't need a drivers license to post anything. I didn't have a picture or anything on my profile.

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#23

Post by [deleted] »

freewilly1040 wrote: post #16
commandlinefan wrote: post #5

> Its public API used no authentication. When users deleted their posts, the site failed to remove the content and instead only added a delete flag to it. Oh, and each post carried a numerical ID that was incremented from the ID of the most recently published one. There's really nothing wrong with any of that, unless you're specifically coding to defend against content scraping. I mean, the whole point of a "tweet" o…

Why is the auto incrementing ID bad? Easier to scrape, I suppose, if the db ID was in the URL

[deleted]

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#24

Post by oceanghost »

gregmac wrote: post #15
eutropia wrote: post #3

I’m morbidly curious: what was their tech stack?

Sarah Mei did an interesting thread [1] on one aspect. A few months back, they had an unexpected outage that turned out to be caused by hitting 2,147,483,648 notifications. That number should look instantly familiar to most programmers. [1] https://twitter.com/sarahmei/status/1348474269064339456

That is terrifying.

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#25

Post by Zababa »

whatshisface wrote: post #10
commandlinefan wrote: post #5

> Its public API used no authentication. When users deleted their posts, the site failed to remove the content and instead only added a delete flag to it. Oh, and each post carried a numerical ID that was incremented from the ID of the most recently published one. There's really nothing wrong with any of that, unless you're specifically coding to defend against content scraping. I mean, the whole point of a "tweet" o…

> Worse, but again, was the site even supposed to be designed with anonymity in mind? According to reports from several HN users who tried making accounts, Parler requires drivers license photos as a part of the process you have to go through before you can post. Rather than being designed for anonymity, they seem designed to identify all of their users as unequivocally as possible.

From what I understand, the drivers license photo was required to have your account verified, someone was talking about this here https://news.ycombinator.com/item?id=25730344

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#26

Post by mormegil »

LarryDarrell wrote: post #14

From what I understand, Parler was bankrolled and designed to do exactly what it was ultimately shutdown for. That is, be a concentrated anger-machine-echo-chamber. I'm not angry at the public corporations that have dropped Parler. I'm angry at the people that created Parler in the first place. It was basically a poison pill designed to test our feelings about free speech, designed to provoke. Mission accomplished, b…

> I think we'll see the angry mob go end up at less discoverable, but more robust distributed platforms. Which is a shame, because it means eventually, when I say that you can find me on Mastadon/Scuttlebutt/etc, the average person will say, "Oh, you're on that extremist network?"

That's always a problem with communities explicitly dedicated to freedom/non-censorship/etc., cf. Scott Alexander's https://slatestarcodex.com/2015/07/22/freedom-on-the-central...

> There’s an unfortunate corollary to this, which is that if you try to create a libertarian paradise, you will attract three deeply virtuous people with a strong committment to the principle of universal freedom, plus millions of scoundrels. Declare that you’re going to stop holding witch hunts, and your coalition is certain to include more than its share of witches.

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#27

Post by jjeaff »

LarryDarrell wrote: post #14

From what I understand, Parler was bankrolled and designed to do exactly what it was ultimately shutdown for. That is, be a concentrated anger-machine-echo-chamber. I'm not angry at the public corporations that have dropped Parler. I'm angry at the people that created Parler in the first place. It was basically a poison pill designed to test our feelings about free speech, designed to provoke. Mission accomplished, b…

>I think we'll see the angry mob go end up at less discoverable, but more robust distributed platforms.

Not unless those distributed platforms are as easy to sign up for and use as twitter. I realize that not all the type of people that went to riot at the capitol or stupid, but the fact that they were there proves that most are intellectually lazy at best. Any extra effort to use a social network will completely block most from participating.

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#28

Post by amvalo »

LarryDarrell wrote: post #14

From what I understand, Parler was bankrolled and designed to do exactly what it was ultimately shutdown for. That is, be a concentrated anger-machine-echo-chamber. I'm not angry at the public corporations that have dropped Parler. I'm angry at the people that created Parler in the first place. It was basically a poison pill designed to test our feelings about free speech, designed to provoke. Mission accomplished, b…

> From what I understand, Parler was bankrolled and designed to do exactly what it was ultimately shutdown for. That is, be a concentrated anger-machine-echo-chamber. I'm not angry at the public corporations that have dropped Parler. I'm angry at the people that created Parler in the first place.

Where did you get this understanding? Seriously. My understanding was that the founders were mostly anti-trump libertarians.

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#29

Post by eesmith »

amvalo wrote: post #28
LarryDarrell wrote: post #14

From what I understand, Parler was bankrolled and designed to do exactly what it was ultimately shutdown for. That is, be a concentrated anger-machine-echo-chamber. I'm not angry at the public corporations that have dropped Parler. I'm angry at the people that created Parler in the first place. It was basically a poison pill designed to test our feelings about free speech, designed to provoke. Mission accomplished, b…

> From what I understand, Parler was bankrolled and designed to do exactly what it was ultimately shutdown for. That is, be a concentrated anger-machine-echo-chamber. I'm not angry at the public corporations that have dropped Parler. I'm angry at the people that created Parler in the first place. Where did you get this understanding? Seriously. My understanding was that the founders were mostly anti-trump libertarian…

> "My understanding was that the founders were mostly anti-trump libertarians."

https://en.wikipedia.org/wiki/Parler says "Founder(s): John Matze, Jr., Jared Thomson, Rebekah Mercer" and "conservative political commentator Dan Bongino has said he is an owner."

https://en.wikipedia.org/wiki/Rebekah_Mercer#Donald_Trump says she supports Trump. eg, "Mercer aimed her support at GOP candidate Donald Trump in June 2016 after Cruz lost the primary. Mercer directs the Mercer Family Foundation and served on the Executive Committee of the transition team of United States President-elect Donald Trump"

https://en.wikipedia.org/wiki/Dan_Bongino says "He is a staunch supporter of President Donald Trump"

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#30

Post by Ancapistani »

If I’m understanding what happened correctly, the archivists here exploited a vulnerability to create numerous administrator accounts on the system, bypassing Parler’s security (as trivial as that was), and used those accounts to access private information from all individuals on the platform.

My question is this: are the people who originally exploited this, created the image, and the users who downloaded it to collect the data going to be subject to federal charges? It seems obvious that they broke the DMCA in using the exploit and the FCAA in collecting and publishing the data acquired.

If so, and the data were obtained through criminal means, is it even admissible in a criminal case?

Full disclosure - I have/had a verified Parler account, dating long before the Capitol stuff. I tend to join pretty much all the new social network stuff to claim my name and so I know what I’m talking about when I discuss it elsewhere. I don’t think I ever posted a “Parley”, and if memory serves the only PMs I sent were asking a friend about LED headlight options for my wife’s vehicle. I’m not concerned about that conversation leaking, but it will amuse to me see if it’s in the collected dataset.

Post reply on HN