Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitch is hacked, and its source code leaked

kotaku.com

Post reply on HN
Print view View original

321–325 of 325 posts

Re: Twitch is hacked, and its source code leaked

#321

Post by AshamedCaptain »

yupper32 wrote: post #77
AshamedCaptain wrote: post #52

Earlier quoted context omitted.

Note that it was code that was leaked. Preventing developers from leaking the codebase they are working with is outright impossible. Now combine that with a "monorepo" and even the most junior developer has access to practically the entire company codebase and version control history. And you can try to prevent them from accessing live/real customer data, but the cost is that they will never be able to debug issues i…

Of course, some stuff you can't avoid, especially code leaking. Luckily code isn't usually that interesting or useful to external parties which is the only reason it isn't leaked more. For the rest of the stuff, there's a sliding scale. In no universe does your average twitch developer need raw access to password hashes, for example.

What with security as it is on these companies, the code is literally the most sensitive information they can hold, specially in terms of value to the company. With the code out, expect lots more high-profile cracks in the coming months...

"your average twitch developer" needs access to the password hashes or at least the code that checks these hashes the moment they need to debug an issue which involves logging in, and from then its all downwards.

Re: Twitch is hacked, and its source code leaked

#322

Post by AshamedCaptain »

xwolfi wrote: post #314
AshamedCaptain wrote: post #17

Earlier quoted context omitted.

Trying to protect against leaking developers/employees is like trying to protect against lone gunman terrorists: useless. And, if you try anyway, it is likely to cause more annoyance to everyone involved than actual protection (think TSA).

I dont know dude, I work in an enormous company that you 've heard of, and it's impossible for me to imagine how to extract code out. I can't do it, except if I get remote access and film my screen while scrolling. Anything else is found quickly. I certainly wouldn't even dream of someone extracting the repo.

Really, you can't simply copy files from a code repo you're working on? You work on a isolated workstation, not connected to any external network, where you are not allowed to bring anything other than plain clothes (TSA-style)? With a sizable army of developers all working this way?

And if it's a remote FB/VNC connection, what is preventing you from just recording the screen? Not really hard...

Most companies I've seen could see all their code extracted with one malformed NFS packet. These are "air gapped" systems holding the type of industrial secrets that we don't want to leak to china. Practically the only real line of defense they have is employee screening, which does not really stop the lone man guy.

Re: Twitch is hacked, and its source code leaked

#323

Post by xorcist »

mercurywells wrote: post #233
xorcist wrote: post #159

Earlier quoted context omitted.

The point here is that once you brute force the plaintext password, the same password might be used elsewhere.

What if you did something like hash(plaintext_pw+"twitchsalt") ---> hash(browser_hash + db_salt)

The browser_hash is now the password.

Re: Twitch is hacked, and its source code leaked

#324

Post by aahortwwy »

xwolfi wrote: post #315
aahortwwy wrote: post #295

Earlier quoted context omitted.

ITT: people shocked that something like this could happen at a company the size and profile of Twitch. Running security at scale in a hypergrowth B2C company is very difficult. It's also completely different from running security at a startup, in a B2B company, or a slower-growth situation. _Every_ security executive and manager I've met has given up in frustration after 12-24 months and gone to take a cushy FAANG jo…

It's funny because for me each letter of FAANG is an hypergrowth B2C company...

All of them have very significant B2B products.
Post reply on HN