Amazon is full of shit lol, and so it’s their twitch
Twitch is hacked, and its source code leaked
311–320 of 325 posts
Re: Twitch is hacked, and its source code leaked
#312Amazon is full of shit and so is their twitch. This breach was gonna happen sooner or later. Nothing surprising!
Re: Twitch is hacked, and its source code leaked
#313Earlier quoted context omitted.
In many companies source code for all products is available to each and single developer.
In what world does all this data in the leak would be stored together in a unified ecosystem? It makes absolutely no sense. If you're saying that Twitch runs their developer environment in a lousy manner (and you have proof of this), then please go ahead. But to imply that an intern/average developer would be given access to all this branching information is ignorant.
I think many people are trying to say that in this world at many companies all that data is indeed stored and accessed together.
Maybe the super secure siloed world doesn't really exist outside of military/government organizations.
Re: Twitch is hacked, and its source code leaked
#314Earlier quoted context omitted.
It something I would expect security hardware to have automatically stopped. Even an employee shouldn't be able to download 125GB of stuff without flipping a safety switch somewhere.
Trying to protect against leaking developers/employees is like trying to protect against lone gunman terrorists: useless. And, if you try anyway, it is likely to cause more annoyance to everyone involved than actual protection (think TSA).
I dont know dude, I work in an enormous company that you 've heard of, and it's impossible for me to imagine how to extract code out. I can't do it, except if I get remote access and film my screen while scrolling.
Anything else is found quickly. I certainly wouldn't even dream of someone extracting the repo.
Re: Twitch is hacked, and its source code leaked
#315This is a pretty thorough and high profile hack on a major tech company - this isn't something I'd expect from an Amazon owned property. The hack (allegedly, I haven't downloaded it) includes * Entire git histories * Internal/Private AWS SDKs * Encrypted Password dumps and payout reports It's so comprehensive I'm very curious into how an attacker got that level of access. I can't think of another, large, corporate we…
ITT: people shocked that something like this could happen at a company the size and profile of Twitch. Running security at scale in a hypergrowth B2C company is very difficult. It's also completely different from running security at a startup, in a B2B company, or a slower-growth situation. _Every_ security executive and manager I've met has given up in frustration after 12-24 months and gone to take a cushy FAANG jo…
It's funny because for me each letter of FAANG is an hypergrowth B2C company...
Re: Twitch is hacked, and its source code leaked
#316Earlier quoted context omitted.
And that is not affected by salting. You can use a rainbow table to look passwords up whether or not those passwords are salted. There is zero conceptual connection between the two ideas. Now, realistically, you can't use a rainbow table on passwords of any noticeable length, and a salt may push the password over the edge of that threshold. If that's really what you want... enforce a minimum password length.
"Use of a key derivation that employs a salt makes this attack infeasible." https://en.wikipedia.org/wiki/Rainbow_table "Salts defend against attacks that use precomputed tables (e.g. rainbow tables)" https://en.wikipedia.org/wiki/Salt_(cryptography)
Salts do nothing for people with predictable passwords though. The salt is in the dump, so I can hash known plaintext with the algorithm and the dumped data.
Even if I can only hash a million a day, if your password is one of the top million most popular, and I have a good list, I'll have your password in a day. And if you re-used it...
Salts do make naïve brute-force, all-possible-strings approaches useless, yes.
Re: Twitch is hacked, and its source code leaked
#317Earlier quoted context omitted.
A lot of it is probably hacked together -- like, embarrassingly hacked together lol
You’re being downvoted for being overly negative, but the ops code is of (literally) shockingly poor quality. This leak has made me understand clearly that code quality is not what makes a product great. I guess that’s something. The jenkinsfiles are mostly nice and clean though. I’ve definitely seen worse of those.
Oops, didn't mean to be too too negative.
I say embarrassing in the sense of, I've definitely shoved out awful code because something needed to get out(tm). And with large companies, deadlines that cause that situation are inevitable.
But I also say it like that because, well, I've seen code that causes (objectively easy-to-fix) crashes but still ships because of one reason or another: laziness, politics, inexperience. It's a part of software engineering I'm still trying to accept.
Re: Twitch is hacked, and its source code leaked
#318Earlier quoted context omitted.
I disagree. Locking down and logging access to raw data like password hashes or payout information to only those who absolutely need it doesn't cause much annoyance and is very useful. It protects the company against rogue employees (not even strictly malicious, but also curious employees who want to see more than they should). It limits exposure if an employee's account gets hacked (my pet theory for this Twitch hac…
Note that it was code that was leaked. Preventing developers from leaking the codebase they are working with is outright impossible. Now combine that with a "monorepo" and even the most junior developer has access to practically the entire company codebase and version control history. And you can try to prevent them from accessing live/real customer data, but the cost is that they will never be able to debug issues i…
Nope, it was code AND data, including the sensitive type (e.g. user payouts).
Re: Twitch is hacked, and its source code leaked
#319Earlier quoted context omitted.
"Use of a key derivation that employs a salt makes this attack infeasible." https://en.wikipedia.org/wiki/Rainbow_table "Salts defend against attacks that use precomputed tables (e.g. rainbow tables)" https://en.wikipedia.org/wiki/Salt_(cryptography)
Salts do nothing for people with predictable passwords though. The salt is in the dump, so I can hash known plaintext with the algorithm and the dumped data. Even if I can only hash a million a day, if your password is one of the top million most popular, and I have a good list, I'll have your password in a day. And if you re-used it... Salts do make naïve brute-force, all-possible-strings approaches useless, yes.
Yes, but nothing will make predictable passwords safe (at least when you have the hash). Enforcing password guidelines helps a bit.
Re: Twitch is hacked, and its source code leaked
#320Earlier quoted context omitted.
Note that it was code that was leaked. Preventing developers from leaking the codebase they are working with is outright impossible. Now combine that with a "monorepo" and even the most junior developer has access to practically the entire company codebase and version control history. And you can try to prevent them from accessing live/real customer data, but the cost is that they will never be able to debug issues i…
Nope, it was code AND data, including the sensitive type (e.g. user payouts).
[deleted]