Parler’s amateur coding could come back to haunt Capitol Hill rioters
arstechnica.com
arstechnica.com
I think we'll see the angry mob go end up at less discoverable, but more robust distributed platforms. Which is a shame, because it means eventually, when I say that you can find me on Mastadon/Scuttlebutt/etc, the average person will say, "Oh, you're on that extremist network?"
The benefit to Facebook/Reddit/Twitter is that while Parler is dominating the discussion, they can start cleaning up their most toxic communities.
That's always a problem with communities explicitly dedicated to freedom/non-censorship/etc., cf. Scott Alexander's https://slatestarcodex.com/2015/07/22/freedom-on-the-central...
> There’s an unfortunate corollary to this, which is that if you try to create a libertarian paradise, you will attract three deeply virtuous people with a strong committment to the principle of universal freedom, plus millions of scoundrels. Declare that you’re going to stop holding witch hunts, and your coalition is certain to include more than its share of witches.
Not unless those distributed platforms are as easy to sign up for and use as twitter. I realize that not all the type of people that went to riot at the capitol or stupid, but the fact that they were there proves that most are intellectually lazy at best. Any extra effort to use a social network will completely block most from participating.
Ultimately I think you underestimate many of them. They feel persecuted and righteous and have the ability to follow step-by-step directions.
Where did you get this understanding? Seriously. My understanding was that the founders were mostly anti-trump libertarians.
https://en.wikipedia.org/wiki/Parler says "Founder(s): John Matze, Jr., Jared Thomson, Rebekah Mercer" and "conservative political commentator Dan Bongino has said he is an owner."
https://en.wikipedia.org/wiki/Rebekah_Mercer#Donald_Trump says she supports Trump. eg, "Mercer aimed her support at GOP candidate Donald Trump in June 2016 after Cruz lost the primary. Mercer directs the Mercer Family Foundation and served on the Executive Committee of the transition team of United States President-elect Donald Trump"
https://en.wikipedia.org/wiki/Dan_Bongino says "He is a staunch supporter of President Donald Trump"
How is/was Parler different from Facebook in this regard? Facebook makes money on ads, so the longer you stay on their site, the more money they make. One way to get people to stay longer is by encouraging the sorts of posts that gets people riled up.
I'm not accusing Facebook of being complicit in the events of last week, but from personal observation, I see a lot more low-effort, angry posts on Facebook than I do on Twitter or Reddit.
However, Facebook has lines that when crossed result in being moderated. Their moderation system is obviously imperfect and a lot of the time they act too late, but it's there.
Parler was courting all the line-crossers with the promise that there would be no such moderation on their platform. That ended with predictable results.
It wasn't just calculated to bring out the worst: it was actively fostering it.
There's really nothing wrong with any of that, unless you're specifically coding to defend against content scraping. I mean, the whole point of a "tweet" or whatever they're called in Parler land is to be public and discoverable.
> failure to scrub geolocations from images and videos posted online
Worse, but again, was the site even supposed to be designed with anonymity in mind?
According to reports from several HN users who tried making accounts, Parler requires drivers license photos as a part of the process you have to go through before you can post. Rather than being designed for anonymity, they seem designed to identify all of their users as unequivocally as possible.
https://twitter.com/davetroy/status/1327253991936454663?lang...
Maybe they let people block out their ID numbers on the license photos, but I doubt that the vast majority of users there would even bother.
Some governments do have eIDs, that work cross-border, that are designed for both the public and private sector, with emphasis on security (although there are bound to be serious problems). This is the case in many European Union countries, and it will apply at some point to the entire EU: https://ec.europa.eu/digital-single-market/en/policies/trust...
Given that a common conspiracy theory espoused on Parler is (was) that vaccines contained tracking microchips (?), I imagine Parler users expected at least some anonymity.
> Worse, but again, was the site even supposed to be designed with anonymity in mind?
Yes! Privacy, security and harm/abuse mitigation must be one of the considerations when you're writing a project. This isn't even anonymity, these are basic safeguards one should put in place. Not doing so is like selling a car with no seatbelts, and arguing that there's nothing wrong with that unless you're specifically manufacturing to defend against car crashes.
This isn't like the argument about how many tests you should have and what kind; this absolutely must be one of the key things to consider when you're creating a project that's going to be used by people to communicate with one another.
With a browser and enough time at hand even my grandfather could have dumped their whole DB.
> When news of donk_enby's archival efforts broke, several viral tweets, Reddit posts, and Facebook posts claimed that she had captured private information, scans of drivers licenses and IDs, and other highly sensitive information. She said those posts are “not at all” accurate.¶ “Everything we grabbed was publicly available on the web, we just made a permanent public snapshot of it,” donk_enby told me.
https://www.vice.com/en/article/n7vqew/the-hacker-who-archiv...
Please stop making bombastic claims that will lead to people finding it easier to believe the kinds of unfounded rumors referenced above.
https://github.com/ArchiveTeam/parler-grab/blob/master/parle...
My question is this: are the people who originally exploited this, created the image, and the users who downloaded it to collect the data going to be subject to federal charges? It seems obvious that they broke the DMCA in using the exploit and the FCAA in collecting and publishing the data acquired.
If so, and the data were obtained through criminal means, is it even admissible in a criminal case?
Full disclosure - I have/had a verified Parler account, dating long before the Capitol stuff. I tend to join pretty much all the new social network stuff to claim my name and so I know what I’m talking about when I discuss it elsewhere. I don’t think I ever posted a “Parley”, and if memory serves the only PMs I sent were asking a friend about LED headlight options for my wife’s vehicle. I’m not concerned about that conversation leaking, but it will amuse to me see if it’s in the collected dataset.
As I discussed elsewhere: opening mail addressed to someone else is a federal crime, because mail has an expectation of privacy. It doesn't matter how easy it is to open an envelope, all that legally matters is the assumed intent.
If one party clearly wanted a message to be private, it is illegal to open that message.
------
In contrast, a Postcard has no expectation of privacy. And therefore, it is perfectly legal to read a postcard.
Which means the privacy question is a bit ambiguous. They were public at one point, but at the time they were leaked out, they had a deleted flag and clearly were meant to be private.
IANAL, but I'd expect it to be illegal to grab data marked "deleted". If you were a few hours earlier and archived them before they were deleted, that probably would be legal.
Of course, the iteration of accounts that Weev was convicted of was nearly exactly this, so we know that this doesn't always hold true, but it really is baffling why.
The law doesn't care about how easy or hard it is to perform the hack. All it cares is about intent.
Only if they’re in the USA based on their IP address or online testimony.
I don't see any suggestion that they had elevated accounts or access. They directly hit parler's public backend server that powers the apps and website, asked it for as many posts as they could, and archived them. The backend did not require authentication to do this, and the posts were identified by auto-incrementing IDs, so it was trivial to scrape essentially all posts from 1 - n.
If we we had GDPR I think individual posters could probably sue the archivists? I'm not sure. Otherwise this is essentially webscraping, which doesn't seem to have been successfully prosecuted much [0].
Realistically the FBI won't be eager to file charges to protect a company seen as a Biden opponent.