Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitch is hacked, and its source code leaked

kotaku.com

Post reply on HN
Print view View original

291–300 of 325 posts

Re: Twitch is hacked, and its source code leaked

#291

Post by shkkmo »

maccard wrote: post #246
shkkmo wrote: post #225

Earlier quoted context omitted.

It's not so much "how long does it take" as it is "how much does it cost" and the answer to that really depends on what sort of compute infrastructure you have access to. Using a more appropriate hashing algorithm with a sufficient cost factor can massively increase the amount of compute needed. Preventing the re-use of that computational effort on additional users is why unique salts are important.

> It's not so much "how long does it take" as it is "how much does it cost" So the answer is "It's too expensive to figure out in practice, unless you're being explicitly targetted by someone with nation state level credentials?", i.e. it's pretty much fine? > Using a more appropriate hashing algorithm with a sufficient cost factor can massively increase the amount of compute needed. But by the sounds of it, SHA1 is…

> But by the sounds of it, SHA1 is more than enough (given that nobody here is willing to brute force the hash I shared above?)

Absolutely not and that is a ridicoulous conclusion to draw. State-level resources are absolutely not required to break sha1.

> but if your password _isn't_ cracked it's moot whether it's hashed with SHA1 or something more secure, as per above?

Again, absolutely not. The algorithm and cost setting have a huge impact on the practical likihood that an attacker will crack your password.

Re: Twitch is hacked, and its source code leaked

#292

Post by ijcd »

AustinDev wrote: post #174
iuri1 wrote: post #129

Since the main leaked files are from github, I'm assuming they got it from one of the many reported github auth flaws which don't get fixed and allows access to private repositories. Or more unlikely, via someone getting sloppy with their laptop. Now I wonder if the commit history has database dumps or sensitive information, which is a common practice, or if any twitch servers have been accessed through a breach or p…

I'm pretty sure a company of Twitch's size uses on-premise GitHub.

Yup, and AWS Code*

Re: Twitch is hacked, and its source code leaked

#293

Post by iotku »

VRay wrote: post #234
zerkten wrote: post #218

Earlier quoted context omitted.

It's understandable why this is a neat perk, but it also seems absurd when you look at Twitch as an entity owned by a global corporation.

Man oh man, big "No thanks" to a perk like that from me "Hey, pick through everything I say with a fine-toothed comb and treat it as the official company stance!"

From prior (user) experience, typically staff have non-wrenched alt accounts for just chilling out in streams (with less concern about conduct, but generally tame by twitch standards). But will wrench up for higher profile streams or folks they're otherwise pretty close with personally.

I suspect that's a lot more controlled these days, but it wasn't very uncommon for signified staff to be trolling along with everyone else.

Re: Twitch is hacked, and its source code leaked

#294

Post by OnlineGladiator »

AnIdiotOnTheNet wrote: post #284
OnlineGladiator wrote: post #219

Earlier quoted context omitted.

What's wrong with looking at public code? The code is public, regardless of how it became public - this isn't someone's personal life being exposed. If twitch is damaged by streaming this, it's only because their poor code quality is being examined publicly. I can certainly understand why twitch banned this and don't blame them (although I think it's stupid), but I see nothing unethical about openly talking about thi…

> What's wrong with looking at public code? The code is public, regardless of how it became public Copyright would disagree with you, and I would say that ethically it is basically the same as stealing it yourself. You're profiting off of someone else having done the dirty work for you. > this isn't someone's personal life being exposed. Apparently a lot of payment information, telephone numbers, etc. was also in the…

> You're profiting off of someone else having done the dirty work for you.

I don't think anybody is streaming this stuff on twitch with the intention to make money, anymore than someone sharing it on a blog is trying to make money. Sure, in that edge case I'd agree with you, but it seems like the exception to the rule (after all people can just go look at the code themselves for free). I'm not talking about the guy who stole the code and is likely ransoming Amazon with it - I'm talking about people that just like to talk about code because it's something they like to do (there's an entire category for it on twitch already).

> Apparently a lot of payment information, telephone numbers, etc. was also in the leak. I don't think we should downloading or encouraging people to download and peruse that stuff.

My limited understanding is none of this information actually has been leaked yet, and is likely part of a future ransom (I could be wrong, I haven't looked because I don't care). I don't condone sharing that either, but that's not what the guy streaming was sharing. I'm talking about discussing the source code which is already publicly available.

> Copyright would disagree with you

I know very little about copyright so I'll just assume you're right. I still see no ethical problem with openly discussing this code publicly though. Anyway, agree to disagree.

Re: Twitch is hacked, and its source code leaked

#295

Post by aahortwwy »

nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

ITT: people shocked that something like this could happen at a company the size and profile of Twitch.

Running security at scale in a hypergrowth B2C company is very difficult. It's also completely different from running security at a startup, in a B2B company, or a slower-growth situation. _Every_ security executive and manager I've met has given up in frustration after 12-24 months and gone to take a cushy FAANG job instead.

I'm not surprised at all. My experience in security at a larger SV unicorn was that changes only happened in the immediate aftermath of a security crisis. Otherwise, there was incredible inertia and you just wouldn't be able to get the institutional support you needed to make progress.

Re: Twitch is hacked, and its source code leaked

#296

Post by superfrank »

slightwinder wrote: post #288
nemothekid wrote: post #2

This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…

> It's also strange that someone who has this level of access to what is presumably a multi-billion dollar company decided to just leak the data? From what I heard about Twitch-interns over the years, it seems the company is more a third-rate-s**hole that grew too big too fast and accumulated a huge amount of technical debt and fatal security flaws. Making billions doesn't mean anything if you don't invest them back…

> From what I heard about Twitch-interns over the years, it seems the company is more a third-rate-s*hole that grew too big too fast and accumulated a huge amount of technical debt and fatal security flaws.

I mean this as a genuine question, but is there any company that didn't end up like this after an exponential growth phase? I'm not saying it's okay, but this feels par for the course. I've now been at two start ups during that hockey stick growth time and both went through this as well.

I'd be curious if anyone here has worked at a large, fast growing tech company where they didn't accumulate a ton of technical debt during growth. If so, what did the company do to prevent that?

Re: Twitch is hacked, and its source code leaked

#297

Post by slightwinder »

superfrank wrote: post #296
slightwinder wrote: post #288

Earlier quoted context omitted.

> It's also strange that someone who has this level of access to what is presumably a multi-billion dollar company decided to just leak the data? From what I heard about Twitch-interns over the years, it seems the company is more a third-rate-s**hole that grew too big too fast and accumulated a huge amount of technical debt and fatal security flaws. Making billions doesn't mean anything if you don't invest them back…

> From what I heard about Twitch-interns over the years, it seems the company is more a third-rate-s*hole that grew too big too fast and accumulated a huge amount of technical debt and fatal security flaws. I mean this as a genuine question, but is there any company that didn't end up like this after an exponential growth phase? I'm not saying it's okay, but this feels par for the course. I've now been at two start u…

Generally yes, but Twitch is not your average startup. It's now 10 years old, and 7 of those years it was owned by Amazon, which should have enough competence and manpower for bringing it onto a good course. But from what I heard, Amazon did neglect Twitch for a long time and focused too much on making it a profitable business by all costs. Because of which they had all those scandals and problems in the last years. It's a business-platform, where technology is just an afterthought.

Re: Twitch is hacked, and its source code leaked

#298

Post by syshum »

unethical_ban wrote: post #263
hamburglar wrote: post #216

Earlier quoted context omitted.

Welcome to devops. Ask Mike down the hall to add you to the “admin” group. Tell him you’re a new dev so you need everything. (This is a joke but also, at many companies, it’s not. Twitch was once small and grew. Who knows what ancient all-access switches are still critical to running the systems, marked “tech debt” in someone’s backlog)

The whole point of devops is to automate everything according to best practices, so fuckups are a thing of the past! The only fuckups, of course, will be Terraform state issues.

No the whole point of devops is to get rid of those terrible sysadmins always keeping the devs from doing anything...

Once you have "DevOps" the devs are ops, your head count drops, and all that pesky security and other things those dirty sysadmins wanted are gone

kinda /s sometimes I think that is really want managers think about devops

Re: Twitch is hacked, and its source code leaked

#299

Post by hamburglar »

unethical_ban wrote: post #263
hamburglar wrote: post #216

Earlier quoted context omitted.

Welcome to devops. Ask Mike down the hall to add you to the “admin” group. Tell him you’re a new dev so you need everything. (This is a joke but also, at many companies, it’s not. Twitch was once small and grew. Who knows what ancient all-access switches are still critical to running the systems, marked “tech debt” in someone’s backlog)

The whole point of devops is to automate everything according to best practices, so fuckups are a thing of the past! The only fuckups, of course, will be Terraform state issues.

As it turns out, the entire industry doesn't quite agree on "the whole point of devops."

Re: Twitch is hacked, and its source code leaked

#300

Post by thaumasiotes »

shkkmo wrote: post #199
maccard wrote: post #183

Earlier quoted context omitted.

It is! I guess using a password from Google isn't the best idea, and kind of defeated the point of what I wanted to ask (if your password isn't already hashed online how long does it actually take to break a sha1 hash), but definitely proves the point. Can I try again? Sha1 e7b7cdf949007abe7e8a190ba8eae56c60018c1f

The point of the salt isn't that it makes it take longer to break any one password. What it does is prevent you from re-using the rainbow table you generate breaking one password when you break the next one. Sha1 is not a very secure/expensive hashing algorithm and thus does make it significantly cheaper to break even with a unique salt.

> What [a password salt] does is prevent you from re-using the rainbow table you generate breaking one password when you break the next one.

Your idea of what a rainbow table is appears to be unrelated to what a rainbow table actually is. A rainbow table is prepared in advance, not generated in the process of cracking an individual password.

Post reply on HN