This article is and points out all sorts of bad. My major issue is the "discussion" of ethics. It's not a state-sposnored attack, but it is still a hack. It would still be a data scrape with the...
Exemplary
This article is and points out all sorts of bad.
My major issue is the "discussion" of ethics.
“From what I‘m reading, these weren‘t hacking in a sense we think about state-sponsored hacking, involving phishing or active deception, or anything like that. There was a glaring gap in the security of the platform, and @don_enby and a few others noticed it and used it,” Ali Alkhatib, data ethicist and a research fellow at the Center for Applied Data Ethics, explained to CyberNews.
It's not a state-sposnored attack, but it is still a hack.
Since @don_enby did not carry out the data scrape secretively, there’s little to worry about from an ethics perspective. However, Alkhatib agrees that if the data scrape was targeted towards minority groups, there’d be a lot more to worry about.
It would still be a data scrape with the intent of capturing private users' information, enabled by a hack that was made easier by a former contractor loudly announcing the site's vulnerabilities.
if the data scrape was targeted towards minority groups, there’d be a lot more to worry about.
With full awareness of where I'm commenting, this is a racially-motivated double standard, and completely unnecessary. I would contend that this is wrong, no matter who it was done against, and the only ethical conversation worth happening, and the article tries to pretend to solve, is the ethics of the behavior with regards to the benefits of the results.
“To me, this is a little more like the Ashley Madison debacle, but for white supremacists,” he explained.
You don't get to have a section that says "The ethics of this thing" and give the liberal version of "it's hurting the right people."
The only pass I'm willing to give here is that it is helpful in identifying domestic terrorists, but this data and any utility it has may still be undermined by the fact that it is useless for any sort of prosecution because it was illegally acquired. I also don't like the tone of "We don't like these guys so it's okay," because this is very much a double-edged sword. If this becomes legal in this instance, it could set a precedent in the next incident. You want to talk about risks to people of color? This is the perfect sort of thing for law enforcement to abuse. Also, two seconds on Google shows that Twilio had another major incident this year anyway.
In a press release announcing the decision, Twilio revealed which services Parler was using.
Probably not the best move. Yeah, I get it. "Fuck Parler." I'm there, too, but maybe a company hired to manage security for a site shouldn't be broadcasting that sites vulnerabilities after they're no longer a client.
I'm not "both sides-ing,." but an action like this can have one hell of a backhand. These tactics are apolitical and need to be considered through that lens. If it can be done to Parler, it can be...
I'm so tired of "both sides-ing" on this issue.
I'm not "both sides-ing,." but an action like this can have one hell of a backhand. These tactics are apolitical and need to be considered through that lens. If it can be done to Parler, it can be done to activist groups on Facebook. My intent wasn't "poor fascists!" but "holy shit, this would be a nightmare if it happened to the good team!"
I mean... It is. Again, you can find every single post on /r/AOC or Sanders4president or chapotraphouse or <insert left leaning sub> permanently stored. You can find public Facebook pages...
Exemplary
If it can be done to Parler, it can be done to activist groups on Facebook.
I mean... It is. Again, you can find every single post on /r/AOC or Sanders4president or chapotraphouse or <insert left leaning sub> permanently stored.
You can find public Facebook pages permanently stored on we archive. Same with Twitter. Hell, Trump already has a tweet archive.
How is this a nightmare? Honestly that reaction is strange when you think of it - when the webarchive team works to preserve your social media site being shut down by Amazon... Wouldn't you cheer for that?
I would be happy to have Tildes archived when it is about to be shut down. Why is that a nightmare?
We are talking about things accessible from a public API so no private messages. If you don't want to be identifiable, don't post identifying information. If the concern is that someone pouring...
We are talking about things accessible from a public API so no private messages.
If you don't want to be identifiable, don't post identifying information. If the concern is that someone pouring over your post history could piece together your identity, that is a concern for right now, not just when the data is archived.
This term is new to me, and I searched around for it but only got definitions and usages of the word using a very different meaning of “ratchet” that’s not at all relevant here. Could you explain...
blatant ratchetism
This term is new to me, and I searched around for it but only got definitions and usages of the word using a very different meaning of “ratchet” that’s not at all relevant here. Could you explain what it means? I’m asking because I can’t infer it from context — I promise I’m not trying to be a pain.
Normally I wouldn’t baldly ask for a definition like that, as I feel that kind of question is usually either setting up for trolling or a way of getting very legalistic about things in a bad way....
Normally I wouldn’t baldly ask for a definition like that, as I feel that kind of question is usually either setting up for trolling or a way of getting very legalistic about things in a bad way. Nevertheless, that word seemed so crucial to the meaning of your post and opaque to me on reading it that I figured it was worth clarifying. Your explanation is excellent, and it gives a name to something I think is a very valuable framework for looking at things. Thank you, tindall. I’m glad I asked!
Anti-racist motivations are important to combat the effects of racism. The double standard in a society with racism is how society unfairly treats minorities, and it is therefore not, by...
With full awareness of where I'm commenting, this is a racially-motivated double standard, and completely unnecessary.
Anti-racist motivations are important to combat the effects of racism. The double standard in a society with racism is how society unfairly treats minorities, and it is therefore not, by definition, a double standard to spend more time specifically protecting them and attempting to tip the balances because it is meant to undo the double standard of their treatment.
You don't get to have a section that says "The ethics of this thing" and give the liberal version of "it's hurting the right people."
But it is ethical to be intolerant of those who are intolerant. While I agree that the methods people choose are important (lets not start torturing terrorists, for example), plenty of ethical debates can often be described as, 'well we probably shouldn't do this, but someone already did this and it is currently working and the end result is one that is currently positive for society.'
I also don't like the tone of "We don't like these guys so it's okay,"
I don't think that's what people are saying - what they're saying is that these people are intolerant and threatening actual harm to our society, therefore we are morally obligated to thwart them. We should, absolutely, focus on ethical and moral means to accomplish this, but it's not just 'lol get fucked' and to paint it that way feels disingenuous as it sidesteps or ignores the damage they are causing to society.
I get that, but "this would be worse if it happened to minorities" isn't that. It would be bad if it happened to anybody who opposed the current power structure. My issue with the article is it...
I get that, but "this would be worse if it happened to minorities" isn't that. It would be bad if it happened to anybody who opposed the current power structure.
My issue with the article is it was already poorly written, and the bit I mentioned felt like a disingenuous way to score cheap points than an actual point being made. I would probably have read it differently in a better-written article.
I don't think that's what people are saying
Honestly, that was my takeaway from the sentiments expressed in the article. Everything I said was in the context of this poorly written article, not "what people are saying."
I would be more tempted to agree if it were actually as the article describes: a deliberate hack of Parler with the intention of releasing private information. But that was just a complete...
I would be more tempted to agree if it were actually as the article describes: a deliberate hack of Parler with the intention of releasing private information. But that was just a complete fabrication.
In effect, it's no different than what pushshift is for Reddit, which has existed without controversy for many years. You have a public API, nothing stops people from querying it and storing the data. There's no "we don't like these guys so its ok", every Reddit post I've ever made is on pushshift and you can see ones that I've deleted (although I don't think I ever have, but that's besides the point) on sites like removeddit that use it. I'm fine with it.
Or another example is people requesting the webarchive crawler to snapshot tweets before they're deleted.
There's zero hacking of anything, it's archiving publicly available data.
Private and deleted posts aren't publicly available data. I wouldn't have any issues if it was just a scrape, but it's not, and the article is very disingenuous about what happened, and justifying...
Private and deleted posts aren't publicly available data. I wouldn't have any issues if it was just a scrape, but it's not, and the article is very disingenuous about what happened, and justifying it in a half-assed, politically partisan manner.
But it is - Parler made all of this data publicly available. That may be because of their incompetence, but it is public nonetheless. Also, I'm not even sure if deleted posts are on there. The...
But it is - Parler made all of this data publicly available. That may be because of their incompetence, but it is public nonetheless.
Also, I'm not even sure if deleted posts are on there. The person who did said that everything archived could be seen from their website.
edit: looked it up, no actual indication deleted posts/images/videos are on there. Since they're crawling up sequential pks, hypothetically if Parlor blindly served content without checking their own flags to see if it was deleted then it'd be archived - which somehow was twisted into "archive HAS deleted posts" in the discourse right now. But since no one has bothered to manually look into the 70TBs of data to find an example of a deleted posts no one actually knows.
Furthermore, I'd argue that that kind of archiving is common. The Internet Archive has websites that their owners have deleted. Pushshift has reddit posts that are deleted. The Internet Archive also has reddit posts that are deleted, and twitter posts, etc.
You can take moral issue with that whole idea, I suppose, but it is simply wrong to claim that people are just okay with it because "parler bad". My public twitter and reddit posts are archived up in 3rd party databases. Some of the tildes ones too no doubt have been snapshotted by the wayback machine.
I take issue with the article claiming it's good because Parler is bad. And there is data from deleted, aka not publicly accessible posts, largely because standard operations for social media tend...
I take issue with the article claiming it's good because Parler is bad.
The data scrape includes deleted posts, meaning that Parler stored user data after users deleted it. This was not scraped at time of posting, but extracted from a database that should not have been accessible.
And there is data from deleted, aka not publicly accessible posts, largely because standard operations for social media tend to involve holding on to this data for various reasons. They didn't pull the data from the Wayback Machine, but from a database they should not have had access to. I have a feeling this would be a very different conversation if it was a different platform. I get wanting to dunk on Parler, but again my issue is with the way the article disguised dunking on Parler as a discussion on ethics that was three sentences long.
“To me, this is a little more like the Ashley Madison debacle, but for white supremacists,” he explained.
This is the part that is essentially saying "we're hurting the right people." People celebrated the Ashley Madison breach because it was just cheaters, but it was mechanically the same as any other data breach.
I would agree that this specific article frames it in a strange way, but this is some random website I've never heard of, reporting on an incidently completely incorrectly to begin with. I...
I would agree that this specific article frames it in a strange way, but this is some random website I've never heard of, reporting on an incidently completely incorrectly to begin with. I wouldn't put much stock into whatever it says.
But I still don't think you understand how basic and not in any way a data breach this is
They didn't pull the data from the Wayback Machine, but from a database they should not have had access to.
That's just wrong, though. Parler has an API, because that's how the site works - its a SPA, so it has a javascript client that makes API requests to get posts (same for the apps). So, say, there's an endpoint: parler.com/api/get_post, which takes a json input with a the post ID, and returns the post in JSON form.
That's what they're crawling. Because they decided to use incremental primary keys rather than UUIDs, you can just ask it for post ID 1, then post ID 2, etc. For a modern sites, which are SPAs, this is the equivalent of the webarchive crawler going on every page.
When you look at a post in the app, or the website, that's the same API they're calling. The security flaw is that they use sequential IDs and don't rate limit apparently.
It's literally the database access that everyone that ever used the app or the website had. If Parler let them get a post that's deleted, then that's purely because they're friggin idiots.
It's no different than taking a screenshot of every parler post - the "exploits" just made it so they can quickly go to every public Parler post/image/video and save it.
I have a feeling this would be a very different conversation if it was a different platform.
No, it really wouldn't - again, Pushshift literally captures every new reddit post, every second, and places it into its database, at this very moment.
Which is completely and utterly false. That was spread by a reddit comment who has now edited his post to say that they were wrong, not to mention that you can quite easily find the actual...
Exemplary
Which is completely and utterly false. That was spread by a reddit comment who has now edited his post to say that they were wrong, not to mention that you can quite easily find the actual "security researcher" on Twitter and what they did.
The parent comment is deleted, but for awareness could you repeat the false claim (in context as false)? If it is something I saw I would like to be set straight on it.
The parent comment is deleted, but for awareness could you repeat the false claim (in context as false)? If it is something I saw I would like to be set straight on it.
The false claim was that there was any sort of hacking done that exposed private data. There was not. They used a public (albeit undocumented) api endpoints to pull data that anyone could get....
The false claim was that there was any sort of hacking done that exposed private data. There was not. They used a public (albeit undocumented) api endpoints to pull data that anyone could get. People thought that private data was being exposed via some hacking or exploit. Specifically there was a claim of accessing the Parlor databases and exposing private data. The reality is much more boring: Parlor had a poorly designed api that had a public endpoint that allowed you to query and get results on what you would expect would be "private" data and anyone could have done it at any time that the endpoint functioned like that.
I’m asking this because I’m genuinely curious, and not too much should be read into the comparison: would you feel the same way of this happened to an ISIS recruiting site?
I’m asking this because I’m genuinely curious, and not too much should be read into the comparison: would you feel the same way of this happened to an ISIS recruiting site?
Yes. Because my concern isn't "poor bad guy users," but "this would suck if it happened to a cause that wasn't harmful." I can accept that stuff that sucks for the good guys can be done to the bad...
Yes. Because my concern isn't "poor bad guy users," but "this would suck if it happened to a cause that wasn't harmful." I can accept that stuff that sucks for the good guys can be done to the bad guys, but when doing stuff to bad actors, I think it's important to consider what'll happen if the same thing is carried out against people who aren't bad.
It's not. This isn't data that was scraped at the time of posting, it was data that was taken from a site with modified access through an iphone app. The fact it was available at all through the...
It's not. This isn't data that was scraped at the time of posting, it was data that was taken from a site with modified access through an iphone app. The fact it was available at all through the api is a different issue.
FWIW, I also disagree with web crawlers taking and saving data from public sites being an inherently good thing, because I feel you should reasonably expect your data to only exist where you approve of it being. I think it's okay for historically relevant stuff to be archived (parler does fit into this, both as a case study of wholly unmoderated social media, and because of the capitol attack), but in the day to day operations of most websites, I think this actually tends to be more a violation of people's "right to be forgotten" as protected by many data-protection laws than it benefits most of society. I shouldn't have to track my data across three websites to try to remove it because I posted it to one.
Vice article is worth a look at [1]. While Parler is now officially down [2], apparently they suffered a massive data breach prior to going offline. What is of interest to me is this [3] Reddit...
Vice article is worth a look at [1]. While Parler is now officially down [2], apparently they suffered a massive data breach prior to going offline. What is of interest to me is this [3] Reddit post that provides information on the hack. Of course, the source is "anonymous Reddit user," but it seems to be plausible technically. When it comes to vigilante activism, sometimes this is as good as you get.
If the Reddit account is true, then it’s a fascinating confluence of events that let this happen. It wasn’t even that difficult, just that everything worked out timing wise for them to exploit things.
If the Reddit account is true, then it’s a fascinating confluence of events that let this happen. It wasn’t even that difficult, just that everything worked out timing wise for them to exploit things.
I know the Archive Team has been scraping Parler data for quite some time, and released this Warrior container with instructions on scraping Parler data [1]. You can (could've when online) done...
I know the Archive Team has been scraping Parler data for quite some time, and released this Warrior container with instructions on scraping Parler data [1]. You can (could've when online) done mostly the same with this interesting project using undocumented Parler APIs [2]. I, of course, got most of this from the r/ParlerWatch subreddit as well.
To say it was a "hack" is, uh, somewhat of an exaggeration. The original reddit thread claiming it involved gaining access to an admin account because of Twilio cancelling service to Parler is...
To say it was a "hack" is, uh, somewhat of an exaggeration. The original reddit thread claiming it involved gaining access to an admin account because of Twilio cancelling service to Parler is just wrong.
People just crawled parler's public APIs because there was 1) no auth on them 2) no rate limiting 3) sequential primary keys.
Yeah, I probably should've looked into it a bit more. It does seem the Archive Team project [1] did 90% of what the Redditor claimed via undocumented APIs. If that is all that is included, then...
Yeah, I probably should've looked into it a bit more. It does seem the Archive Team project [1] did 90% of what the Redditor claimed via undocumented APIs. If that is all that is included, then really all that happened was that public posts were gathered including deleted ones. Not huge in my opinion, but probably historically important for historians analyzing the current moment, especially considering that the service is now, for the moment, offline.
Has anyone put prominent conservatives calling the removal/blackballing of Parler 'Orwellian' on TV and made them sit through some choice quotes from popular Parler posts? Forcing them to defend...
Has anyone put prominent conservatives calling the removal/blackballing of Parler 'Orwellian' on TV and made them sit through some choice quotes from popular Parler posts? Forcing them to defend the actual hate and incitement speech in specificity would probably (hopefully?) be hard to do.
Yea, Orwellian being the stand-in word for government censorship from the same people who are trying to call an insurrection a protest and other egregious abuses of language is highly ironic.
Yea, Orwellian being the stand-in word for government censorship from the same people who are trying to call an insurrection a protest and other egregious abuses of language is highly ironic.
The best example I've come across is Facebook (and probably the rest) has been hunting down and banning/removing ISIS content for years to fight the spread of Islamic terrorism but we haven't...
The best example I've come across is Facebook (and probably the rest) has been hunting down and banning/removing ISIS content for years to fight the spread of Islamic terrorism but we haven't heard a peep about that from the free speech absolutists.
You're right it's pure demagoguery -- it appears there are less and less Republicans serving anything other than their own power and interests. Hopefully, there will be some room for Democrats to capitalize on that -- turning Trump into a persona non grata will benefit 2024 hopefuls and keep the billionaire donations rolling in.
I’m old enough to remember when it was mostly liberals advocating for free speech on the Internet and conservatives calling for censorship. These days, it seems people switch sides frequently...
I’m old enough to remember when it was mostly liberals advocating for free speech on the Internet and conservatives calling for censorship. These days, it seems people switch sides frequently depending on the target.
But I can’t get too worked up about hypocrisy anymore. It seems like charges of hypocrisy are often used to prove too much? Like, Gavin Newsom is a hypocrite so they’re not going to obey COVID rules either. It would be nice if people weren’t hypocrites, but the flaws of people arguing particular positions aren’t a shortcut for figuring out what you think is right.
Like, what should happen to forums used by right-wing extremists? Should they be crushed or not? Is it only the technically competent ones who hide behind Tor or create a private group on Signal who get to have a forum?
Then again I guess it’s not our decision, so we can just get out the popcorn and watch.
I'd certainly like to see more of this. It's been entertaining as hell to watch Tim Pool engage in mental gymnastics over the last couple of days. He's gone into full on free-speech absolutist...
I'd certainly like to see more of this. It's been entertaining as hell to watch Tim Pool engage in mental gymnastics over the last couple of days. He's gone into full on free-speech absolutist mode. Aptly displays why I chuckle at libertarians now and where I break with them. He just can't handle the mere thought that every rule, no matter how vital and necessary, has special cases that invalidate it.
For schadenfreude, mostly. He is one of the more sane conservatives (never denied this was Trump supporters, for example), but the posse he has on his podcasts are all derp all the time. I check...
For schadenfreude, mostly. He is one of the more sane conservatives (never denied this was Trump supporters, for example), but the posse he has on his podcasts are all derp all the time. I check in just to see what conservatives are thinking and spinning for themselves.
So... what about the phone numbers? I noticed on signup Parler was collecting phone numbers for all of their members. That's the juicy nugget in this data - real world identification of who these...
So... what about the phone numbers? I noticed on signup Parler was collecting phone numbers for all of their members. That's the juicy nugget in this data - real world identification of who these people are. Did this data leak, or is it just the public posting data? Have there been subpoenas filed to get Amazon to turn over those phone numbers yet? I'm quite sure various government agencies are interested in that information.
Parler apparently also collected copy of Driver/Govt IDs if a user wanted to be a "verified citizen", which allowed users to be able to DM, post meme's etc. (this is from what I heard in Reddit,...
Parler apparently also collected copy of Driver/Govt IDs if a user wanted to be a "verified citizen", which allowed users to be able to DM, post meme's etc. (this is from what I heard in Reddit, so please correct me if this is not the case).
Yes, they do. However, that's not part of this data dump, which is all publically accessible information* *there's some content metadata which shouldn't be public but that's more on Parler for...
Yes, they do. However, that's not part of this data dump, which is all publically accessible information*
*there's some content metadata which shouldn't be public but that's more on Parler for being idiots. Like if you upload an image on reddit, notice that it strips the metadata from that image.
Parler left the metadata in? Holy smokes. The rest of that data is still available via subpoena, if the government wants it (and I'm sure the FBI does at least). Amazon will have backups lying...
Parler left the metadata in? Holy smokes.
The rest of that data is still available via subpoena, if the government wants it (and I'm sure the FBI does at least). Amazon will have backups lying around. I suspect we haven't heard the last of this.
I'm not sure myself. I've noticed that whenever I go to sign up to try out a new social media site, it's always crashing, so other than Tildes I've had pretty low success getting onto any of these...
I'm not sure myself. I've noticed that whenever I go to sign up to try out a new social media site, it's always crashing, so other than Tildes I've had pretty low success getting onto any of these new platforms, even just to check them out. :P
This article is and points out all sorts of bad.
My major issue is the "discussion" of ethics.
It's not a state-sposnored attack, but it is still a hack.
It would still be a data scrape with the intent of capturing private users' information, enabled by a hack that was made easier by a former contractor loudly announcing the site's vulnerabilities.
With full awareness of where I'm commenting, this is a racially-motivated double standard, and completely unnecessary. I would contend that this is wrong, no matter who it was done against, and the only ethical conversation worth happening, and the article tries to pretend to solve, is the ethics of the behavior with regards to the benefits of the results.
“To me, this is a little more like the Ashley Madison debacle, but for white supremacists,” he explained.
You don't get to have a section that says "The ethics of this thing" and give the liberal version of "it's hurting the right people."
The only pass I'm willing to give here is that it is helpful in identifying domestic terrorists, but this data and any utility it has may still be undermined by the fact that it is useless for any sort of prosecution because it was illegally acquired. I also don't like the tone of "We don't like these guys so it's okay," because this is very much a double-edged sword. If this becomes legal in this instance, it could set a precedent in the next incident. You want to talk about risks to people of color? This is the perfect sort of thing for law enforcement to abuse. Also, two seconds on Google shows that Twilio had another major incident this year anyway.
Probably not the best move. Yeah, I get it. "Fuck Parler." I'm there, too, but maybe a company hired to manage security for a site shouldn't be broadcasting that sites vulnerabilities after they're no longer a client.
I'm not "both sides-ing,." but an action like this can have one hell of a backhand. These tactics are apolitical and need to be considered through that lens. If it can be done to Parler, it can be done to activist groups on Facebook. My intent wasn't "poor fascists!" but "holy shit, this would be a nightmare if it happened to the good team!"
I mean... It is. Again, you can find every single post on /r/AOC or Sanders4president or chapotraphouse or <insert left leaning sub> permanently stored.
You can find public Facebook pages permanently stored on we archive. Same with Twitter. Hell, Trump already has a tweet archive.
How is this a nightmare? Honestly that reaction is strange when you think of it - when the webarchive team works to preserve your social media site being shut down by Amazon... Wouldn't you cheer for that?
I would be happy to have Tildes archived when it is about to be shut down. Why is that a nightmare?
We are talking about things accessible from a public API so no private messages.
If you don't want to be identifiable, don't post identifying information. If the concern is that someone pouring over your post history could piece together your identity, that is a concern for right now, not just when the data is archived.
This term is new to me, and I searched around for it but only got definitions and usages of the word using a very different meaning of “ratchet” that’s not at all relevant here. Could you explain what it means? I’m asking because I can’t infer it from context — I promise I’m not trying to be a pain.
Normally I wouldn’t baldly ask for a definition like that, as I feel that kind of question is usually either setting up for trolling or a way of getting very legalistic about things in a bad way. Nevertheless, that word seemed so crucial to the meaning of your post and opaque to me on reading it that I figured it was worth clarifying. Your explanation is excellent, and it gives a name to something I think is a very valuable framework for looking at things. Thank you, tindall. I’m glad I asked!
Anti-racist motivations are important to combat the effects of racism. The double standard in a society with racism is how society unfairly treats minorities, and it is therefore not, by definition, a double standard to spend more time specifically protecting them and attempting to tip the balances because it is meant to undo the double standard of their treatment.
But it is ethical to be intolerant of those who are intolerant. While I agree that the methods people choose are important (lets not start torturing terrorists, for example), plenty of ethical debates can often be described as, 'well we probably shouldn't do this, but someone already did this and it is currently working and the end result is one that is currently positive for society.'
I don't think that's what people are saying - what they're saying is that these people are intolerant and threatening actual harm to our society, therefore we are morally obligated to thwart them. We should, absolutely, focus on ethical and moral means to accomplish this, but it's not just 'lol get fucked' and to paint it that way feels disingenuous as it sidesteps or ignores the damage they are causing to society.
I get that, but "this would be worse if it happened to minorities" isn't that. It would be bad if it happened to anybody who opposed the current power structure.
My issue with the article is it was already poorly written, and the bit I mentioned felt like a disingenuous way to score cheap points than an actual point being made. I would probably have read it differently in a better-written article.
Honestly, that was my takeaway from the sentiments expressed in the article. Everything I said was in the context of this poorly written article, not "what people are saying."
I would be more tempted to agree if it were actually as the article describes: a deliberate hack of Parler with the intention of releasing private information. But that was just a complete fabrication.
In effect, it's no different than what pushshift is for Reddit, which has existed without controversy for many years. You have a public API, nothing stops people from querying it and storing the data. There's no "we don't like these guys so its ok", every Reddit post I've ever made is on pushshift and you can see ones that I've deleted (although I don't think I ever have, but that's besides the point) on sites like removeddit that use it. I'm fine with it.
Or another example is people requesting the webarchive crawler to snapshot tweets before they're deleted.
There's zero hacking of anything, it's archiving publicly available data.
Private and deleted posts aren't publicly available data. I wouldn't have any issues if it was just a scrape, but it's not, and the article is very disingenuous about what happened, and justifying it in a half-assed, politically partisan manner.
But it is - Parler made all of this data publicly available. That may be because of their incompetence, but it is public nonetheless.
Also, I'm not even sure if deleted posts are on there. The person who did said that everything archived could be seen from their website.
edit: looked it up, no actual indication deleted posts/images/videos are on there. Since they're crawling up sequential pks, hypothetically if Parlor blindly served content without checking their own flags to see if it was deleted then it'd be archived - which somehow was twisted into "archive HAS deleted posts" in the discourse right now. But since no one has bothered to manually look into the 70TBs of data to find an example of a deleted posts no one actually knows.
Furthermore, I'd argue that that kind of archiving is common. The Internet Archive has websites that their owners have deleted. Pushshift has reddit posts that are deleted. The Internet Archive also has reddit posts that are deleted, and twitter posts, etc.
You can take moral issue with that whole idea, I suppose, but it is simply wrong to claim that people are just okay with it because "parler bad". My public twitter and reddit posts are archived up in 3rd party databases. Some of the tildes ones too no doubt have been snapshotted by the wayback machine.
I take issue with the article claiming it's good because Parler is bad.
And there is data from deleted, aka not publicly accessible posts, largely because standard operations for social media tend to involve holding on to this data for various reasons. They didn't pull the data from the Wayback Machine, but from a database they should not have had access to. I have a feeling this would be a very different conversation if it was a different platform. I get wanting to dunk on Parler, but again my issue is with the way the article disguised dunking on Parler as a discussion on ethics that was three sentences long.
This is the part that is essentially saying "we're hurting the right people." People celebrated the Ashley Madison breach because it was just cheaters, but it was mechanically the same as any other data breach.
I would agree that this specific article frames it in a strange way, but this is some random website I've never heard of, reporting on an incidently completely incorrectly to begin with. I wouldn't put much stock into whatever it says.
But I still don't think you understand how basic and not in any way a data breach this is
That's just wrong, though. Parler has an API, because that's how the site works - its a SPA, so it has a javascript client that makes API requests to get posts (same for the apps). So, say, there's an endpoint:
parler.com/api/get_post, which takes a json input with a the post ID, and returns the post in JSON form.That's what they're crawling. Because they decided to use incremental primary keys rather than UUIDs, you can just ask it for post ID 1, then post ID 2, etc. For a modern sites, which are SPAs, this is the equivalent of the webarchive crawler going on every page.
When you look at a post in the app, or the website, that's the same API they're calling. The security flaw is that they use sequential IDs and don't rate limit apparently.
It's literally the database access that everyone that ever used the app or the website had. If Parler let them get a post that's deleted, then that's purely because they're friggin idiots.
It's no different than taking a screenshot of every parler post - the "exploits" just made it so they can quickly go to every public Parler post/image/video and save it.
No, it really wouldn't - again, Pushshift literally captures every new reddit post, every second, and places it into its database, at this very moment.
Which is completely and utterly false. That was spread by a reddit comment who has now edited his post to say that they were wrong, not to mention that you can quite easily find the actual "security researcher" on Twitter and what they did.
I mean ffs it's open source: https://github.com/d0nk/parler-tricks
All it does is crawl the public APIs the iOS app uses to function.
Honestly I'm disturbed at the speed and voracity at which that misinformation spread to people's minds.
The parent comment is deleted, but for awareness could you repeat the false claim (in context as false)? If it is something I saw I would like to be set straight on it.
The false claim was that there was any sort of hacking done that exposed private data. There was not. They used a public (albeit undocumented) api endpoints to pull data that anyone could get. People thought that private data was being exposed via some hacking or exploit. Specifically there was a claim of accessing the Parlor databases and exposing private data. The reality is much more boring: Parlor had a poorly designed api that had a public endpoint that allowed you to query and get results on what you would expect would be "private" data and anyone could have done it at any time that the endpoint functioned like that.
I see, thanks.
I’m asking this because I’m genuinely curious, and not too much should be read into the comparison: would you feel the same way of this happened to an ISIS recruiting site?
Yes. Because my concern isn't "poor bad guy users," but "this would suck if it happened to a cause that wasn't harmful." I can accept that stuff that sucks for the good guys can be done to the bad guys, but when doing stuff to bad actors, I think it's important to consider what'll happen if the same thing is carried out against people who aren't bad.
Why? This is just a data archive of public information.
It's not. This isn't data that was scraped at the time of posting, it was data that was taken from a site with modified access through an iphone app. The fact it was available at all through the api is a different issue.
FWIW, I also disagree with web crawlers taking and saving data from public sites being an inherently good thing, because I feel you should reasonably expect your data to only exist where you approve of it being. I think it's okay for historically relevant stuff to be archived (parler does fit into this, both as a case study of wholly unmoderated social media, and because of the capitol attack), but in the day to day operations of most websites, I think this actually tends to be more a violation of people's "right to be forgotten" as protected by many data-protection laws than it benefits most of society. I shouldn't have to track my data across three websites to try to remove it because I posted it to one.
As someone on the left who has been using the internet for decades, this and much worse has always happened to actual leftist organization online.
Vice article is worth a look at [1]. While Parler is now officially down [2], apparently they suffered a massive data breach prior to going offline. What is of interest to me is this [3] Reddit post that provides information on the hack. Of course, the source is "anonymous Reddit user," but it seems to be plausible technically. When it comes to vigilante activism, sometimes this is as good as you get.
[1] https://www.vice.com/en/article/jgqbex/parler-is-gone-but-hackers-say-they-downloaded-everything-first
[2] https://www.cbsnews.com/news/parler-down-aws-web-hosting-trump/
[3] https://old.reddit.com/r/ParlerWatch/comments/kuqvs3/all_parler_user_data_is_being_downloaded_as_we/giu04o6/[3] https://www.reddit.com/r/ParlerWatch/comments/kuqvs3/all_parler_user_data_is_being_downloaded_as_we/giuz38a/?context=1
PS: I'm not sure I'd trust the linked site's data leak check.
If the Reddit account is true, then it’s a fascinating confluence of events that let this happen. It wasn’t even that difficult, just that everything worked out timing wise for them to exploit things.
I know the Archive Team has been scraping Parler data for quite some time, and released this Warrior container with instructions on scraping Parler data [1]. You can (could've when online) done mostly the same with this interesting project using undocumented Parler APIs [2]. I, of course, got most of this from the r/ParlerWatch subreddit as well.
[1] https://github.com/ArchiveTeam/parler-grab
[2] https://github.com/d0nk/parler-tricks
I'm no expert, but this reddit take from the same thread seems like it may be more reasonable?
This does sound far more on point, I'll replace the link to this one, thanks
Someone has, uhm, "helpfully" put this into a more dramatized format.
To say it was a "hack" is, uh, somewhat of an exaggeration. The original reddit thread claiming it involved gaining access to an admin account because of Twilio cancelling service to Parler is just wrong.
People just crawled parler's public APIs because there was 1) no auth on them 2) no rate limiting 3) sequential primary keys.
Yeah, I probably should've looked into it a bit more. It does seem the Archive Team project [1] did 90% of what the Redditor claimed via undocumented APIs. If that is all that is included, then really all that happened was that public posts were gathered including deleted ones. Not huge in my opinion, but probably historically important for historians analyzing the current moment, especially considering that the service is now, for the moment, offline.
[1] https://github.com/ArchiveTeam/parler-grab
Has anyone put prominent conservatives calling the removal/blackballing of Parler 'Orwellian' on TV and made them sit through some choice quotes from popular Parler posts? Forcing them to defend the actual hate and incitement speech in specificity would probably (hopefully?) be hard to do.
Yea, Orwellian being the stand-in word for government censorship from the same people who are trying to call an insurrection a protest and other egregious abuses of language is highly ironic.
The best example I've come across is Facebook (and probably the rest) has been hunting down and banning/removing ISIS content for years to fight the spread of Islamic terrorism but we haven't heard a peep about that from the free speech absolutists.
You're right it's pure demagoguery -- it appears there are less and less Republicans serving anything other than their own power and interests. Hopefully, there will be some room for Democrats to capitalize on that -- turning Trump into a persona non grata will benefit 2024 hopefuls and keep the billionaire donations rolling in.
I’m old enough to remember when it was mostly liberals advocating for free speech on the Internet and conservatives calling for censorship. These days, it seems people switch sides frequently depending on the target.
But I can’t get too worked up about hypocrisy anymore. It seems like charges of hypocrisy are often used to prove too much? Like, Gavin Newsom is a hypocrite so they’re not going to obey COVID rules either. It would be nice if people weren’t hypocrites, but the flaws of people arguing particular positions aren’t a shortcut for figuring out what you think is right.
Like, what should happen to forums used by right-wing extremists? Should they be crushed or not? Is it only the technically competent ones who hide behind Tor or create a private group on Signal who get to have a forum?
Then again I guess it’s not our decision, so we can just get out the popcorn and watch.
I'd certainly like to see more of this. It's been entertaining as hell to watch Tim Pool engage in mental gymnastics over the last couple of days. He's gone into full on free-speech absolutist mode. Aptly displays why I chuckle at libertarians now and where I break with them. He just can't handle the mere thought that every rule, no matter how vital and necessary, has special cases that invalidate it.
God, that's a name I haven't heard in years. Is this guy still relevant?
For schadenfreude, mostly. He is one of the more sane conservatives (never denied this was Trump supporters, for example), but the posse he has on his podcasts are all derp all the time. I check in just to see what conservatives are thinking and spinning for themselves.
So... what about the phone numbers? I noticed on signup Parler was collecting phone numbers for all of their members. That's the juicy nugget in this data - real world identification of who these people are. Did this data leak, or is it just the public posting data? Have there been subpoenas filed to get Amazon to turn over those phone numbers yet? I'm quite sure various government agencies are interested in that information.
Parler apparently also collected copy of Driver/Govt IDs if a user wanted to be a "verified citizen", which allowed users to be able to DM, post meme's etc. (this is from what I heard in Reddit, so please correct me if this is not the case).
Yes, they do. However, that's not part of this data dump, which is all publically accessible information*
*there's some content metadata which shouldn't be public but that's more on Parler for being idiots. Like if you upload an image on reddit, notice that it strips the metadata from that image.
Parler left the metadata in? Holy smokes.
The rest of that data is still available via subpoena, if the government wants it (and I'm sure the FBI does at least). Amazon will have backups lying around. I suspect we haven't heard the last of this.
I'm not sure myself. I've noticed that whenever I go to sign up to try out a new social media site, it's always crashing, so other than Tildes I've had pretty low success getting onto any of these new platforms, even just to check them out. :P
Hopefully no one goes after me just for having signed up. I made an account 2 days ago to see exactly what was going on in there.
I mean, video takes up quite a lot of storage space.