Tripe article, stating the obvious
Twitch is hacked, and its source code leaked
241–250 of 325 posts
Re: Twitch is hacked, and its source code leaked
#242Earlier quoted context omitted.
The tradeoffs for any individual piece of data are different from the tradeoffs of a company-wide policy. Siloing off one little thing (e.g. credit card info) usually doesn't inconvenience very many people, but at the same time it only provides marginal security. No front page headline has ever read "At Least The Credit Card Info Was Safe". On the other hand, a company-wide policy of siloing everything can have more…
I don't see how this precludes just-in-time access. Even if people can re-up on their own, you can still observe the data access patterns and manage the risk. Further, when you see someone is getting blocked a lot you can improve the experience for them so they are unblocked, or have more efficient access to the data. This is just mature data and security management. Quality of life and developer experience are impor…
Implementing just-in-time access on legacy systems that pre-date just-in-time architectures is extremely expensive. Its cheaper to either give all info or no info. Which is what every legacy company does instead.
My company can shut off my access to the all the databases when they stop asking me to troubleshoot any and all data issues. Which will never happen.
Re: Twitch is hacked, and its source code leaked
#243What language is the main website written in?
A lot of Go and Ruby
Re: Twitch is hacked, and its source code leaked
#244Earlier quoted context omitted.
I’m so misread, Twitch is a lot of luck, so is all of these companies. Show me the the source code for luck. I don’t give a fuck if you leaked a video streaming crud app code lol.
You're missing the _hard work_ part. Sure there's always an element of "luck" in any story of success, but that mostly has to do with timing, and is much less weighted than the perseverance and hard work of the people building it. Twitch is a full-featured, very mature application with many moving parts outside of just the video streaming, and building all those parts took an incredible amount of time and effort.
It’s just luck. I mean, if I was a storyteller, what story would I have to tell if there was no story.
They hit.
It’s sort of like we all hold Golden dice, so we marveled, by our own eyes, at the gold.
Dealer: You rolling those?
Us: no, it’s gold.
They fucking risked it. It’s not a engineering feat, we’re all a bunch of pussies.
Twitch is easiest site to build, you might as well show me a todo app (which will be sieged and dismantled), scale is solved, we will eat your applications, the barbarians.
Rome falls.
Re: Twitch is hacked, and its source code leaked
#245Actually in Twitch's codebase:
OR replace($1,'_','') SIMILAR TO '%(hate|kill|keel|hang|burn|gasthe)%(black|bl4ck|black|jew|trans|gay|african|afrikan|minorit|asian|nig|n1g)%'
Re: Twitch is hacked, and its source code leaked
#246Earlier quoted context omitted.
> Sha1 is not a very secure/expensive hashing algorithm and thus does make it significantly cheaper to break even with a unique salt. Ok, so how long does it take to break the hash I've provided if it's not very secure?
It's not so much "how long does it take" as it is "how much does it cost" and the answer to that really depends on what sort of compute infrastructure you have access to. Using a more appropriate hashing algorithm with a sufficient cost factor can massively increase the amount of compute needed. Preventing the re-use of that computational effort on additional users is why unique salts are important.
> It's not so much "how long does it take" as it is "how much does it cost"
So the answer is "It's too expensive to figure out in practice, unless you're being explicitly targetted by someone with nation state level credentials?", i.e. it's pretty much fine?
> Using a more appropriate hashing algorithm with a sufficient cost factor can massively increase the amount of compute needed.
But by the sounds of it, SHA1 is more than enough (given that nobody here is willing to brute force the hash I shared above?)
> Preventing the re-use of that computational effort on additional users is why unique salts are important.
The person who "cracked" my first hash found it in a list of passwords which was actually gotten from a plain text dump 15 years ago. That wasn't found by reversing a hash, so the compute wasn't reused. You are right that once it's cracked, it's cracked and that's that, but if your password _isn't_ cracked it's moot whether it's hashed with SHA1 or something more secure, as per above?
Re: Twitch is hacked, and its source code leaked
#247I'd be interested if someone could get their own instance of Twitch up and running from this leak. Someone mentioned internal API's, which would have to be reworked to avoid detection, but it'd be interesting to host it on AWS just to see how long it takes to get shut down. How would current AWS policies hold up? Obviously the code would be illegally acquired, but do they have detection mechanisms in place?
Even with source code it is hard to run a service if not impossible. You would need well written documentation that explains various options and error codes you could potentially get. Many times there is some magic command only one guy knows and he will share with you on slack. Rubbing a service of any complexity takes years of institutional knowledge.
Please don't rub the services, it causes unnecessary friction, and wear & tear.
Re: Twitch is hacked, and its source code leaked
#248Earlier quoted context omitted.
Thanks for trying! This somewhat supports what I'm suggesting - because that password hasn't been leaked by being posted in plaintext as a verified password, it's not available as a lookup, therefore it doesn't matter whether they used bcrypt, sha1 or md5, or even just pgp encrypted it, the password is likely "secure".
It depends. It doesn’t have to strictly be a leaked password. If it’s similar to a leaked password then the permutation rule-set will catch it. Anything under 9 characters I can brute force in minutes. 9 character passwords would take me 9 hours. Obviously if someone has a nest of the latest GPUs then they could go a lot faster. But yes if your password is uwv&6qu_brusb618_$@618jg then it doesn’t really matter how yo…
The reason I didn't give any more information on the password above is because you don't have any extra information on a dump of hashes from a twitch database either. If a password is only feasibly brute forceable for a specific algorithm by reducing the search space by many orders of magnitude, it kind of shows that there's not really any risk even if the passwords are unsalted for a person who hasn't reused a password.
Re: Twitch is hacked, and its source code leaked
#249Earlier quoted context omitted.
The point here is that once you brute force the plaintext password, the same password might be used elsewhere.
What if you did something like hash(plaintext_pw+"twitchsalt") ---> hash(browser_hash + db_salt)
Well, bear in mind, the hacker also has the exact code Twitch uses to salt it's hashes.
Re: Twitch is hacked, and its source code leaked
#250Does it take a genius to figure out how to build twitch? It’s a modern crud app with video streaming.
I figure you could "build a Steam" in a couple of years, with the right engineers hitting the main features. There's very little magic at the technology level, and you can make life simpler and forget about minor things like the hardware survey or the pretty graphs. I'm not saying this is trivial, but it's definitely doable. This is a far different statement than "You can build something and compete with Steam in a c…
Sir (Madame?), I ask you one simple question:
Was Twitch built in 10 years, or over just a few?
Steam was built since I was in FUCKING high school. Im old now, well over 30.
Apples, and blueberries.
Bluebarry, Drewbarry, tomato, ToMaHtoH.
Fuck their stupid ass streaming code, it’s a giant crud app, only their devops team can take credit for scaling, everyone else is not worth a shit, sorry, thats life, I gotta Leetcode too, and ur code isn’t worth me reading it, leaked or not).