Parler’s amateur coding could come back to haunt Capitol Hill rioters

> Its public API used no authentication. When users deleted their posts, the site failed to remove the content and instead only added a delete flag to it. Oh, and each post carried a numerical ID that was incremented from the ID of the most recently published one.

There's really nothing wrong with any of that, unless you're specifically coding to defend against content scraping. I mean, the whole point of a "tweet" or whatever they're called in Parler land is to be public and discoverable.

> failure to scrub geolocations from images and videos posted online

Worse, but again, was the site even supposed to be designed with anonymity in mind?

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#6

Post by castis » Tue, Jan 12, 2021, 3:54 PM UTC

Bancakes wrote: post #4

vectorbunny wrote: post #2

As linked in article, scraping code here: https://github.com/ArchiveTeam/parler-grab/blob/master/parle...

Thanks, can't wait to end racism.

Although I get that this is sarcasm, I dont understand the underlying intent here.

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#7

Post by jcranmer » Tue, Jan 12, 2021, 3:57 PM UTC

commandlinefan wrote: post #5

> Its public API used no authentication. When users deleted their posts, the site failed to remove the content and instead only added a delete flag to it. Oh, and each post carried a numerical ID that was incremented from the ID of the most recently published one. There's really nothing wrong with any of that, unless you're specifically coding to defend against content scraping. I mean, the whole point of a "tweet" o…

The topper is that it doesn't appear that requesting post #N did any checks for if you are allowed to see it (i.e., it doesn't check if post #N is private or deleted). That means that naïve content scraping will uncover private/deleted posts, which is the really big "oops" that Parler had.

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#8

Post by trianglem » Tue, Jan 12, 2021, 3:57 PM UTC

commandlinefan wrote: post #5

> Its public API used no authentication. When users deleted their posts, the site failed to remove the content and instead only added a delete flag to it. Oh, and each post carried a numerical ID that was incremented from the ID of the most recently published one. There's really nothing wrong with any of that, unless you're specifically coding to defend against content scraping. I mean, the whole point of a "tweet" o…

Was their security even supposed to work? Yes.

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#9

Post by commandlinefan » Tue, Jan 12, 2021, 3:58 PM UTC

jcranmer wrote: post #7

commandlinefan wrote: post #5

> Its public API used no authentication. When users deleted their posts, the site failed to remove the content and instead only added a delete flag to it. Oh, and each post carried a numerical ID that was incremented from the ID of the most recently published one. There's really nothing wrong with any of that, unless you're specifically coding to defend against content scraping. I mean, the whole point of a "tweet" o…

The topper is that it doesn't appear that requesting post #N did any checks for if you are allowed to see it (i.e., it doesn't check if post #N is private or deleted). That means that naïve content scraping will uncover private/deleted posts, which is the really big "oops" that Parler had.

Ah - well, yes, that's worse.

Re: Parler’s amateur coding could come back to haunt Capitol Hill rioters

#10

Post by whatshisface » Tue, Jan 12, 2021, 3:59 PM UTC

commandlinefan wrote: post #5

> Its public API used no authentication. When users deleted their posts, the site failed to remove the content and instead only added a delete flag to it. Oh, and each post carried a numerical ID that was incremented from the ID of the most recently published one. There's really nothing wrong with any of that, unless you're specifically coding to defend against content scraping. I mean, the whole point of a "tweet" o…

>Worse, but again, was the site even supposed to be designed with anonymity in mind?

According to reports from several HN users who tried making accounts, Parler requires drivers license photos as a part of the process you have to go through before you can post. Rather than being designed for anonymity, they seem designed to identify all of their users as unequivocally as possible.