31–40 of 52 posts
I’m morbidly curious: what was their tech stack?
Sarah Mei did an interesting thread [1] on one aspect. A few months back, they had an unexpected outage that turned out to be caused by hitting 2,147,483,648 notifications. That number should look instantly familiar to most programmers. [1] https://twitter.com/sarahmei/status/1348474269064339456
From what I understand, Parler was bankrolled and designed to do exactly what it was ultimately shutdown for. That is, be a concentrated anger-machine-echo-chamber. I'm not angry at the public corporations that have dropped Parler. I'm angry at the people that created Parler in the first place. It was basically a poison pill designed to test our feelings about free speech, designed to provoke. Mission accomplished, b…
>I think we'll see the angry mob go end up at less discoverable, but more robust distributed platforms. Not unless those distributed platforms are as easy to sign up for and use as twitter. I realize that not all the type of people that went to riot at the capitol or stupid, but the fact that they were there proves that most are intellectually lazy at best. Any extra effort to use a social network will completely blo…
Ultimately I think you underestimate many of them. They feel persecuted and righteous and have the ability to follow step-by-step directions.
If I’m understanding what happened correctly, the archivists here exploited a vulnerability to create numerous administrator accounts on the system, bypassing Parler’s security (as trivial as that was), and used those accounts to access private information from all individuals on the platform. My question is this: are the people who originally exploited this, created the image, and the users who downloaded it to coll…
As I discussed elsewhere: opening mail addressed to someone else is a federal crime, because mail has an expectation of privacy. It doesn't matter how easy it is to open an envelope, all that legally matters is the assumed intent.
If one party clearly wanted a message to be private, it is illegal to open that message.
------
In contrast, a Postcard has no expectation of privacy. And therefore, it is perfectly legal to read a postcard.
> Its public API used no authentication. When users deleted their posts, the site failed to remove the content and instead only added a delete flag to it. Oh, and each post carried a numerical ID that was incremented from the ID of the most recently published one. There's really nothing wrong with any of that, unless you're specifically coding to defend against content scraping. I mean, the whole point of a "tweet" o…
> Worse, but again, was the site even supposed to be designed with anonymity in mind? According to reports from several HN users who tried making accounts, Parler requires drivers license photos as a part of the process you have to go through before you can post. Rather than being designed for anonymity, they seem designed to identify all of their users as unequivocally as possible.
Earlier quoted context omitted.
> Worse, but again, was the site even supposed to be designed with anonymity in mind? According to reports from several HN users who tried making accounts, Parler requires drivers license photos as a part of the process you have to go through before you can post. Rather than being designed for anonymity, they seem designed to identify all of their users as unequivocally as possible.
So it was a honeypot.
If I’m understanding what happened correctly, the archivists here exploited a vulnerability to create numerous administrator accounts on the system, bypassing Parler’s security (as trivial as that was), and used those accounts to access private information from all individuals on the platform. My question is this: are the people who originally exploited this, created the image, and the users who downloaded it to coll…
I don't see any suggestion that they had elevated accounts or access. They directly hit parler's public backend server that powers the apps and website, asked it for as many posts as they could, and archived them. The backend did not require authentication to do this, and the posts were identified by auto-incrementing IDs, so it was trivial to scrape essentially all posts from 1 - n.
If we we had GDPR I think individual posters could probably sue the archivists? I'm not sure. Otherwise this is essentially webscraping, which doesn't seem to have been successfully prosecuted much [0].
If I’m understanding what happened correctly, the archivists here exploited a vulnerability to create numerous administrator accounts on the system, bypassing Parler’s security (as trivial as that was), and used those accounts to access private information from all individuals on the platform. My question is this: are the people who originally exploited this, created the image, and the users who downloaded it to coll…
IANAL, but... I expect the hackers to be subject to federal crimes. As I discussed elsewhere: opening mail addressed to someone else is a federal crime, because mail has an expectation of privacy. It doesn't matter how easy it is to open an envelope, all that legally matters is the assumed intent. If one party clearly wanted a message to be private, it is illegal to open that message. ------ In contrast, a Postcard h…
I’m morbidly curious: what was their tech stack?
Sarah Mei did an interesting thread [1] on one aspect. A few months back, they had an unexpected outage that turned out to be caused by hitting 2,147,483,648 notifications. That number should look instantly familiar to most programmers. [1] https://twitter.com/sarahmei/status/1348474269064339456
Earlier quoted context omitted.
IANAL, but... I expect the hackers to be subject to federal crimes. As I discussed elsewhere: opening mail addressed to someone else is a federal crime, because mail has an expectation of privacy. It doesn't matter how easy it is to open an envelope, all that legally matters is the assumed intent. If one party clearly wanted a message to be private, it is illegal to open that message. ------ In contrast, a Postcard h…
Were these posts private? I've never been on Parler so I have no idea, but I'm not reading anything that suggests they were direct messages or "private" accounts making the posts.
Which means the privacy question is a bit ambiguous. They were public at one point, but at the time they were leaked out, they had a deleted flag and clearly were meant to be private.
IANAL, but I'd expect it to be illegal to grab data marked "deleted". If you were a few hours earlier and archived them before they were deleted, that probably would be legal.
Earlier quoted context omitted.
> Worse, but again, was the site even supposed to be designed with anonymity in mind? According to reports from several HN users who tried making accounts, Parler requires drivers license photos as a part of the process you have to go through before you can post. Rather than being designed for anonymity, they seem designed to identify all of their users as unequivocally as possible.
Schadenfreude non-withstanding, why didn’t more users see that as a massive red flag?