Hacker News Reader

Comment by mellosouls | Hacker News Reader

"researchers".

Imagine what they'd be called if this was Reddit, Twitter or a non-conservative site they'd hacked.

The hack is equivalent to if someone downloaded all of the content of Reddit, or a database of all tweets, if this post is to be believed: https://www.reddit.com/r/ParlerWatch/comments/kv0jo6/psa_the.... Would anyone even bat an eye if that happened?

From the original article

> This may include things from deleted/private posts.

I think people would be alarmed if private DMs were leaked from Twitter, yes.

The data also includes the geolocations of posters.[1]

Another comment also suggested that the photos of the driver's licenses that were used to verify users were also being downloaded, though I'm not certain if this is true.

1. https://gizmodo.com/every-deleted-parler-post-many-with-user...

Yeah, but this apparently was all downloaded through Parler's publically accessible API, so if anyone should be to blame here, it is Parler.

I crawled reddit in several topics.

It's supported through their api.

terrorists of course

Imagine if they published a portion of the contents of a laptop they legally owned.

You can literally download Reddit and Twitter archives anytime you want.

No, you can't. There are private tweets, profiles, DMs and deleted messages/posts/tweets and for sure the profile data. This isn't a scrape of the site using a regular account, this is cracking admin accounts, creating their own admin accounts and using it to scrape private accounts, DMs, user information, and deleted content.

https://github.com/ArchiveTeam/parler-grab

The details in the post are generally false - nowhere in this grabber (which is what was used to download the 70TB (or 56tb based on the tracker[0]) are admin credentials used to bypass access controls. There were no ACLs on the video and picture files, so anyone could wget them without issue.

0: https://tracker.archiveteam.org/parler/

Someone went to prison for wget'ing ATT data. And people right here argued that when you create a script to do so, you're no longer using their intended functionality in good faith.

https://news.ycombinator.com/item?id=24876481

I was talking about weev, not Aaron.

To be fair, weev (in this case) didn't really do anything legally wrong IMO other than maybe should have stopped once they had PoC as you would with a bug bounty. However, those standards for responsible bug finding/disclosure weren't fully developed yet and I consider one of the problematic overreaches of the CFAA. Even ended in weev being radicalized in jail, so no one won, AT&T was still embarrassed by it. If someone leaves a unlocked filing cabinet on the edge of their property near the public road full of PII and people cross onto the property and look in the filing cabinet and take pictures of the files and use it as evidence of the property owner's irresponsibility, "should have known better" isn't a compelling argument to me to arrest them for trespassing, breaking and entering, and theft. This was a case where they didn't even bother to put a fence around it, they just assumed no one would notice it.

Weev, at best, committed the equivalent of a misdemeanor in my mind, and that's probably only because he kept downloading everything he could even after they had enough to call attention to the issue.

I think a similar case happened with a teenager accessing public records in a hidden directory on a government server, they tried to throw the book at him too for calling attention to it, when legally citizens could access the data anyway, and they were the ones that made it available to public. They tried to ruin the kids life over it, but thankfully cooler heads and a public outcry about it prevailed.

Reply on news.ycombinator.com