Live data from Hacker News

Gab Has Been Breached

troyhunt.com

61–70 of 194 posts

Re: Gab Has Been Breached

#61
This is a pretty non-political rundown from Troy, and a great read as always. It's not always easy to find trustworthy people, but he's one of them.

If anyone is offended by supposed political leanings in this article, I'd suggest separating Torba's political views from his words. Blaming a data breach on "mentally ill tranny demon hackers" (his words, not mine) is not a sane or rational thought. The most realistic scenario is that he knows exactly what he's saying and is doing so simply to rile up fanatics, because otherwise he actually believes that and should be in an institution. I'm not sure which one is worse.

Re: Gab Has Been Breached

#63

Earlier quoted context omitted.

Yeah, he's the worst. I knew him in YC, and actually liked him. But I watched him spiral as he wasn't able to raise money for his startup, including starting to go to Trump rallies "out of curiosity". His FB posts began to include worse and worse rhetoric. It was crazy to watch him get radicalized in realtime. It ended in him harassing some (minority) YC founders who said they were scared by saying we should "Build t…

HN thread from 2016 on Torba getting booted: https://news.ycombinator.com/item?id=12934388 Includes comments from Sam Altman and Torba, posting as rvcamo

That's an interesting thread as Fosco got involved too.

https://news.ycombinator.com/item?id=12935057

Re: Gab Has Been Breached

#64
post #2

Wow, it is actually shocking how disgusting the CEO's comments are.

We know you're shocked but might you not have provided at least one comment (the worst, say) as a an example? On a scale of human actions from 1 to 10, how disgusting?

Re: Gab Has Been Breached

#65
post #46

If you just want to know how the breach[1] happened: it was SQL injection, where string interpolation was used to construct a query, rather than use parametrized queries. [1] https://arstechnica.com/gadgets/2021/03/rookie-coding-mistak...

I thought bcrypt had built in salts, how was he able to reverse those hashes for simple passwords? Any better algorithm to use or recommendation on salting?

If the password is on a short enough list, you can afford to check each hash separately with the salt.

Re: Gab Has Been Breached

#66

It doesn't seem right that the big players like Facebook and Twitter enjoy much better security. Is there really no open source offering that just gets this stuff right? A Twitter-in-a-box, like WordPress is a blog-in-a-box, but secure this time? Apparently Gab used Mastodon. Is Mastodon intrinsically hard to secure?

No, we can't conclude that yet. Gab modified their instance heavily from Mastodon code over several years. People are also pointing to an addition made by Gab, where an SQL query is used without input sanitization, as a possible culprit for the breach.

Re: Gab Has Been Breached

#67
Some bit of gossip about the CTO of Gab, seeing as how I've got a bit of context. (Throwaway, for obvious reasons.)

The CTO was never a software engineer. They were a developer advocate so had some interaction with code, but was more of a "talk to developers using things and make sure the requirements were passed along to the dev team" sort of guy, rather than someone that knew his technical details (beyond say, the thing he was actively working on) inside and out.

Fosco started out pretty reasonable. When Trump was first elected, he did a "talk to a conservative" series, and while there was the expected disagreement, it was a pretty, civil, positive, well-received olive branch overall. However, like a lot of right-leaning folks in the Trump era, he became more extreme as time went on.

I had some reasonably close interactions with Fosco (not going to go into details with how), but it was being kind of clear that he had started to buy into the "Fox News caricature of what someone on the left is like" — to the point of putting words into the very people's mouths he'd so civilly made a point of talking to prior — and surrounding himself with like-minded folks. For all the talk of "diversity" that he had (and indeed, initially fostered!) he became pretty much the sort of caricature, albeit one of the opposite side of the spectrum, that he was deriding.

In that sense, while there's a lot of holier-than-thou and disgust that the whole Gab situation prompts, I feel pity and sadness more than anything else. Fosco was a decent guy at one point, but even decent people can end up in their own echo chambers. It's unfortunate to see the state that he's in now.

Re: Gab Has Been Breached

#68

> There's also the risk of incorrectly assuming that a presence in the breach implies your views have some degree of alignment with those regularly expressed on the site, yet clearly based on the presence of my own email address, that assumption is incorrect. I've seen comments elsewhere saying something to the effect of "Gab is just a bunch of right-wing terrorists, who cares if their personal info gets hacked" Ther…

Ironically enough, I saw someone make a post on another site I read where they were saying in order to exploit cancel culture and doxing, they were working on a bot that would scrape public data from facebook profiles (mainly the name and profile picture) and then have that bot cross create the account on gab and parler. Then the bot would go and repost content from the site and add comments. The idea is that other people would come to the website looking to doxx people or harass people but the reality is the people they would be trying to harass are just fake profiles that the individual person never actually made.

It is kind of interesting to think about because if you go on facebook, you can see lots of people using their real facial picture and real first name, last name and the people doing the doxing/harassments don't really put much thought into how that profile account was created.

Re: Gab Has Been Breached

#70

Gab is a joke. I got banned for making a post asking how are all the domestic terrorists Trump supporters doing after the capitol riot. I guess that is ban-worthy on their free speech network while advocating for assassinating public officials is a-ok.

I’m not a gab user, a Republican, or even an American for that matter. But it strikes me that what the situation seems to call for is more compassion and constructive discourse, but you seemingly wanted to harass people online under the guise of free speech. I think I understand why that would lead to being banned just about anywhere. It doesn’t serve anyone in any useful way. I don’t believe they should allow advoca…

Free speech and compassion for the hate mongers, “you’re just like them” for the people who don’t accept their hate or expose their lies. Got it.
Post reply on HN