Twitch source code and customer data has reportedly been leaked • Hacker News Board

Re: Twitch source code and customer data has reportedly been leaked

#491

Post by astrange » Wed, Oct 06, 2021, 10:23 PM UTC

vsareto wrote: post #114

astrange wrote: post #58

Earlier quoted context omitted.

> PS: Make sure to change your Twitch (and possibly Prime) password. Twitch is already prompting users to do so based on Reddit posts. This is not worth worrying about. If Twitch is making you reset your password, that means you don’t need to hurry because they’ve already locked your account. If your password hash leaked, the important thing isn’t Twitch, it’s every other place you used the same password.

Just spend 2 minutes and change your password instead of spending 2 minutes thinking about whether you should.

There are downsides to asking people to change their password for everything! (even though this is a big "everything")

I remember some services send you a message telling you to change your password anytime a new device logs in or even fails to login to your account. That causes most people to pick weaker passwords, since they're not all using manager apps.

Re: Twitch source code and customer data has reportedly been leaked

#492

Post by wizzwizz4 » Wed, Oct 06, 2021, 10:24 PM UTC

SketchySeaBeast wrote: post #195

wizzwizz4 wrote: post #112

Earlier quoted context omitted.

Or just watch it on television. (You can even tape it when it's on television… sshhhhhhh.)

Are you using VHS for said taping? I suddenly wonder if this is one of those anachronistic phrases, or if people no longer use it and you're revealing your age.

At least it's less anachronistic than “record”.

Re: Twitch source code and customer data has reportedly been leaked

#493

Post by AnIdiotOnTheNet » Wed, Oct 06, 2021, 10:38 PM UTC

slightwinder wrote: post #477

AnIdiotOnTheNet wrote: post #269

Earlier quoted context omitted.

I don't really get this. My phone number is apparently already known by every scammer and spammer on earth, which is why I never answer calls from people I don't know, so what am I losing? Meanwhile, Twitch has had a significant bot spamming problem.

> I don't really get this. My phone number is apparently already known by every scammer and spammer on earth, which is why I never answer calls from people I don't know, so what am I losing? The only scammers who know my number are my phone-provider and my mom. Other scammers either never call me, or just don't know the number. Protecting your number is possible. > Meanwhile, Twitch has had a significant bot spamming…

The twitch tools for dealing with spam suck ass. You basically get a blacklist of words and follower/subscriber only chat modes.

Re: Twitch source code and customer data has reportedly been leaked

#494

Post by zeouter » Wed, Oct 06, 2021, 10:52 PM UTC

NaturalPhallacy wrote: post #475

stunt wrote: post #254

https://www.twitchearnings.com/

I can't help but love the fact that PaymoneyWubby (a fat ginger nerd who makes interesting content, at least on youtube) makes more than pokimaine and Amouranth whose primary feature seems to be young, attractive, and female. Perhaps there's a tiny bit of justice in the world.

... that does sound quite misogynistic. Like the sole comparisons you raise (and insult) are women.

Re: Twitch source code and customer data has reportedly been leaked

#495

Post by ganoushoreilly » Wed, Oct 06, 2021, 10:54 PM UTC

anonymouse008 wrote: post #489

ganoushoreilly wrote: post #414

Earlier quoted context omitted.

There are a ton of companies hiring pentesters. Most testers fall into the profession after having worked in other network or IT related professions. A few are free lance, most work for a company or in my case start their own and expand out services. It's not really any different than any other tech job at the end of the day, it just seems glamorous. Don't become a pentester if you're not ready to write extensive rep…

[potentially off topic] > if you're not ready to write extensive reports.. it's probably 75% of the job Do you happen to have a system for building these out? As a techie, I imagine you've tried something like text-expander or similar... but I see a lot of people unsatisfied that they end up building their own tools.

Yes, We have a few tools that fill in based on scan data, with typical points of data, but a lot of what we're doing requires it's presented in a few different perspectives. Generally we provide a couple reports, the Highly Technical (with notes, logs of actions, etc. This can be hundreds of pages, but it's meant to be a reference for the engineering teams fixing what we found. We also sometimes provide full screen captures of the "ops". Second we provide a paired down version of that report with issues and recommendations, usually for the person that's hired us. It includes what we recommend for them to be successful. Finally we provide an Executive report that is designed to be presented by the second report recipient. Usually we've addressed the high level issues, helped with internal requests if possible (IE IT/Security wanted a budget for new firewall, we help boost that with our report as part of future planning etc.) and ultimately this report is designed to give whomever hired us the ability to be the rockstar (we're just the tool).

So all in, there are different tools needed for each report. Fortunately the way we capture the data and notes through out the "op" makes it much easier for the team to put together each part.

There's ways we could automate more, we've even messed with AI writing some of the suggestions and actions based on input. So far though, we still need the humans in the loop.

Honestly the first few reports are hardest, after that you find a process and it becomes much easier.

Re: Twitch source code and customer data has reportedly been leaked

#496

Post by mkishi » Wed, Oct 06, 2021, 10:55 PM UTC

NaturalPhallacy wrote: post #475

stunt wrote: post #254

https://www.twitchearnings.com/

I can't help but love the fact that PaymoneyWubby (a fat ginger nerd who makes interesting content, at least on youtube) makes more than pokimaine and Amouranth whose primary feature seems to be young, attractive, and female. Perhaps there's a tiny bit of justice in the world.

Donations probably dwarf subscription earnings, I'm not sure it's that black and white.

Re: Twitch source code and customer data has reportedly been leaked

#497

Post by anonu » Wed, Oct 06, 2021, 11:01 PM UTC

sillysaurusx wrote: post #337

Hi ya'll, I have a question. My wife and I can't wrap our brains around the fact that payment info was leaked alongside source code . Any theories how this happened? Former pentester btw. I saw a lot of interesting things during my time, but I can't recall seeing a payment database next to a source code repo. Did their s3 bucket get popped or something? Even if their github enterprise got popped, that doesn't explain…

It's all on AWS and some insider had super user access... (My baseline theory)

Re: Twitch source code and customer data has reportedly been leaked

#498

Post by asdfasgasdgasdg » Wed, Oct 06, 2021, 11:07 PM UTC

stunt wrote: post #254

https://www.twitchearnings.com/

Just goes to show you how small the top is in streaming. Based on this data, and assuming twitch payouts are about a quarter the average streamer's income, about 300-400 twitch streamers get paid more than the total comp of senior staff engineers where I work. Let's be generous and say that these people have no staff to pay (false assumption, e.g. Pestily has stated that he pays hundreds of thousands on salaries for editors, moderators, social media people, etc.). There are far more people than that at my one company making this kind of money, not to mention all the other big tech companies and startups.

That's just a long way of saying that if you wanna get rich, learn how to write code and talk to people. Way easier than becoming one of the top 3-400 streamers in the world.

Re: Twitch source code and customer data has reportedly been leaked

#499

Post by theneworc » Wed, Oct 06, 2021, 11:09 PM UTC

hnick wrote: post #116

dannyw wrote: post #34

Earlier quoted context omitted.

The leak contains much more than this FYI, there's a hundred gigabytes of code and resources from dozens of repositories. Looks like someone dumped everything on their github enterprise. I wonder if this'll lead to software engineers in big companies having more restricted access to code?

Dozens? The 4chan post said "almost 6,000 internal Git repositories". We don't use git at work (TFS, yay), and we definitely aren't on their scale, but that seems high to me. Do they have a repo for every class? Is this normal?

My company has way more than 6,000 devs and each dev creates a git repo as part of our onboarding process and uploads it to our centralized git tool (you create and push a mostly empty test repo as part of the basic training). Just from that, I'd imagine my company has tens of thousands of git repos, although a lot of them probably only have a single file or some random throwaway code.

The number of git repos might look big but without knowing more, the content of most of those repos could be a complete nothingburger. Number of git repos is pretty meaningless metric, IMO.

Re: Twitch source code and customer data has reportedly been leaked

#500

Post by slightwinder » Wed, Oct 06, 2021, 11:18 PM UTC

AnIdiotOnTheNet wrote: post #493

slightwinder wrote: post #477

Earlier quoted context omitted.

> I don't really get this. My phone number is apparently already known by every scammer and spammer on earth, which is why I never answer calls from people I don't know, so what am I losing? The only scammers who know my number are my phone-provider and my mom. Other scammers either never call me, or just don't know the number. Protecting your number is possible. > Meanwhile, Twitch has had a significant bot spamming…

The twitch tools for dealing with spam suck ass. You basically get a blacklist of words and follower/subscriber only chat modes.

You can also restrict to following-age, certified e-mail, and some more. That experienced mods do have little to no problems with bot speaks kinda for itself. Additionally, there are also a bunch of requested features on twitch-side which could had defused the problems even more, without opening the privacy-box.