Hacker News Reader

"The simplest explanation is that they saw this coming a mile away (who honestly didn't?) and this is engineered martyrdom."

I think its more boring than that. Their platform was built by amateurs who didn't know what they were doing. Things like soft-deleting posts and auto-incrementing post IDs. This is why it was so easily crawled in a day before the shutdown.

https://arstechnica.com/information-technology/2021/01/parle...

Off topic but what's wrong with using auto-increment?

The most common criticism I'm aware of is that it leaks information about your system and its users. For example, you can gauge growth by how fast ids grow, and relative age of accounts. The former is potentially financially valuable. Often the latter is exposed properly through the UI, but the that can be a choice, rather than exposed due to an implementation detail. There are likely other criticisms as well.

https://en.wikipedia.org/wiki/German_tank_problem#Historical...

That's a great example, isn't it? :)

Auto-incrementing ids makes guessing subsequent or previous items trivial. There was a post here a few weeks ago about it -- https://news.ycombinator.com/item?id=25244872

That doesn't seem like it would matter much on its own. You can pretty easily guess HN item IDs, too. e.g. https://news.ycombinator.com/item?id=25244871 and https://news.ycombinator.com/item?id=25244873

Of course you’re right — nothing matters on its own. It’s one possible factor in a defense in depth strategy —- https://en.wikipedia.org/wiki/Defense_in_depth_(computing)

It makes it easy to crawl. If you're trying to get all of the user profiles for a given website and all of the URLs look like foo.com/user/123 it's easy to download all of them, whereas foo.com/user/1234-abcdef1234-1234 is much harder to guess.

You can use auto-increment IDs as your internal keys, but don't expose them as external identifiers.

There's nothing particularly wrong about it. Twitter does something like this with a bit of timing thrown in the mix, which is why some smart-asses have made self-referencing tweets:

https://www.spinellis.gr/blog/20090805/

I believe they also for a long time had a public API^.. and I'm pretty sure they soft-delete posts (bonus that they could revive the tweet down the track if it was a 'mistake'). I don't think the Twitter team are amateurs though.

Having monotonically increasing IDs for non-distributed systems removes the possibility of duplicate IDs. In distributed systems ID conflicts are unavoidable, and you might have less conflicts if you generate random IDs, as well as it becomes difficult for an attacker to guess IDs.

^ likely it would have been rate-limited, which isn't a problem if you've got a large pool of users you can authenticate with

> Having monotonically increasing IDs for non-distributed systems removes the possibility of duplicate IDs.

In parler's case, having monotonically increasing ID typed as signed 32-bit integer _guaranteed_ duplicate IDs once they reached 2.1 billion unique items. This is well-known failure mode, and yet it took them by surprise.

https://twitter.com/adrianbowyer/status/1348761214428569602

Okay.. I concede, 32-bit is a rookie mistake. I didn't know that. Wow. Did they not account for millions of daily active users in a Twitter competitor...

> what's wrong with using auto-increment?

1) It invites resource enumeration attack

https://www.cequence.ai/use-cases/enumeration-attacks/

https://owasp.org/www-community/attacks/Forced_browsing

2) they ran out of ints. Stop me if you think you've heard this one before

https://twitter.com/sarahmei/status/1348474968527360001

https://twitter.com/adrianbowyer/status/1348761214428569602

This is the real answer. It was very clear they had no competence to make an app of this scale. It would have collapsed under its own weight before long.

I mean, Reddit was pretty poorly built in the early days prior to getting popular and went down frequently due to load.

It's easy to blame incompetence, but startups are startups and many things are hacked together in a hurry when you're growing fast.

> Why weren't they dockerized and prepared to move containers and backups at the drop of a hat? Why didn't they have hot spares elsewhere?

Maybe the techies with those skills dont want to work there and so the existing employees might not have the skills to do that.

Difficult to compete with companies that have billions of dollars to spend.

The Mercers have billions they could spend on this:

https://www.wsj.com/articles/parler-backed-by-mercer-family-...

Just because the invested some money in that, doesn't mean they should bet all their wealth on it?

Exactly, these people don't want to put in the work. They just want to use shortcuts, but just as you're not entitled to an account Twitter, you're also not entitled to a cloud service provider.

Parler hasn't seen 1/10th the the deplatforming that The Pirate Bay has seen for example, yet that managed to survive throughout the years and is still up now. The reality is that whoever was running Parler had no clue what they were doing.

Who says it is the end of the story for Parler? They came on the scene many years after Twitter and Facebook. They have a lot of catching up to do, with a lot less money at their disposal. In the early days, Twitter ran on Ruby on Rails, hardly a scalable decision, either.

Aiding and abetting insurrectionists isn't a good look.

To you and others, perhaps, but there is clearly a sizable portion of the population that is either neutral or positive.

Large divergences in worldview and values, combined with universal policies, create underserved market segments, and thus opportunities.

"Aid and abet" and "insurrection" are part of a framing that not everyone accepts.

what a ridiculous comment. it was a crowd of some of the dumbest people alive - some attempting to kidnap, injure, and kill lawmakers, some thinking that by entering the building they'd find an OVERTHROW GOVT button. Idiots.

anyone that tries to both sides this shit deserves eternal shame

Some people are less concerned about "the look".

I personally just want a social network were I don't have to worry about being banned every minute. (Not sure if PArler qualifies, but I suppose it is their selling point).

Depends how much time it will take them to be back up again : if it takes too long, most of their potential users will have moved on, for instance to Gab.

If people were happy with Gab, Parler would not have been started, I suppose.

Yes, but it was most likely because Gab could never get on Apple's App Store and was banned from Google's Play Store before Parler was even founded.

Funny how it's working out now…

Its more that nothing they do can overcome the fact that everyone has blacklisted them. You can't run a site on the internet without having ISPs and DNS registers on your side at least. Even if they rehost somewhere else they will just be hit with the next level of blocks and have wasted the money rehosting.

Again, TPB, Sci-hub and many others have done it for decades. It's nothing new.

The freaking stormfront is still up, so I doubt Parler will not find a way too. The question is what fraction of their users will they lose over it?

Via a tor hidden service iirc. This would seriously limit how many users they can have

Well, you made me visit it... :/

No, it's on the open Web.

If a company can’t attract skilled workers who want to build its product, that sounds like a great vote against its existence.

What makes you think they can't attract talent? There are plenty of libertarians in tech that would be willing to work with them, including this SRE right here. I think they had other issues. Perhaps they were just out of their league and didn't have the leadership capable of fighting fires while simultaneously recruiting, scaling, policing, etc. Typical successful startup skills that many people don't have.

I’m responding to a person who made this assertion, but designing your site in a way that non-users can archive all media uploaded to it seems like a good sign!

apparently it's harder for them to get back than they thought. I guess they are now facing the equivalent of the Holywood blacklist. Dockerized setups will not help if you can't get an alternative host.

"Matze said that Parler had faced trouble in finding a new service provider, ... He also said that others had refused to work with Parler: "Every vendor, from text message services to email providers to our lawyers, all ditched us, too, on the same day." https://en.wikipedia.org/wiki/Parler#Attempts_to_return_onli...

It is probably easier to find an alternative hosting platform when you are booted from AWS because of porn. In the case of parler they also might need to migrate more data.

Their lawyers bailing gave me pause. Suggests things are substantially more serious than Amazon, Apple, Google, and Twilio suddenly finding a paying customer distasteful.

Exactly.

Soon people will understand why it was taken down.

Something like organizing an assault on the nation's capital in order to overturn a vote?

They are probably worried about the company solvency

I don't think it's unreasonable for Parler to attempt to create the same kind of mainstream platform that these other services enjoy. Their service is not criminal in nature. Regardless of what some may claim, their service is simply a social media platform. If you're a technical user you can probably figure out the 'Darkweb'. You can't blame them for not wanting to restrict their userbase to only technical users. They're trying to be a viable alternative to the Silicon Valley giants. That's a reasonable thing to do.

> Their service is not criminal in nature

They are getting kicked off AWS because of content that is absolutely criminal in nature, and their inability and inaction in moderating it.

They provided ~90 example out of millions of posts and comments. I signed up to see what all the fuss was about and didn’t see any examples of violence whatsoever, other than some nutty conspiracy stuff and some vaguely violent language that wouldn’t be out of place on Vox or Mother Jones.

If a platform has ANY illegal content what standard is then acceptable? If you moderate 99.999% of your content is it reasonable for you to be blacklisted for the 0.001%? If someone found 90 examples of calls to violence on Twitter would that make it OK to deplatform them too?

> If you moderate 99.999% of your content is it reasonable for you to be blacklisted for the 0.001%?

This sounds like you're trying to get us to pretend along that Parler had a moderation policy that was in any way effective, equally applied, or not just pandering to the crowd it was trying to entice.

Same kinds of criticism are regularly voiced at Facebook and Twitter too.

For instance:

https://thediplomat.com/2020/08/how-facebook-is-complicit-in...

(IMHO both Facebook and Twitter should be shut down. Size matters.)

> They provided ~90 example out of millions of posts and comments

This argument is problematic. In any criminal endeavor, what most of the criminals do isn’t illegal or even unusual.

When HSBC was laundering cartel money, they also served regular customers. They processed credit cards, gave loans and so on. 99.9999% legal activities and yet they were fined billions of dollars for fascinating money laundering operation of few murderous warlords.

If that’s your logic, then clearly Facebook and Twitter are 1,000x as guilty as Parler, considering that they have hosted extremely violent speech. The genocide in Myanmar, for instance.

This is about money and power, nothing else. Facebook is “too big to fail” so clearly it will never face any consequences, while Parler is a random little site that’s easy to pick on.

I do not object to the claim that FB/Twitter etc. are no better. I am simply pointing out that "arithmetically most of the things they did are harmless" is not a good argument. Most of the things Bin Laden did are benign, Him studying eating, partying, watching TV, taking a dump, playing a ball etc. probably accounts for %99.999 of his actions and being a horrible terrorist is just %0.001 of who he is, if we are looking for a benign/illegal ratio.

IMHO social media needs to be regulated, companies should not be able to simply cut you off from the rest of the public and you shouldn't be unaccountable for your actions and there must be ways for harm reduction. (if you tell/share a something, them maybe people affected by it should have right to equal exposure to challenge it. i.e. their POV could be attached to your post and everyone who interacted with your post receives a notification that the post was challenged)

Wouldn't the platform be protected by section 230? I imagine a large part of the reason Parler even exists is to abuse section 230, or get section 230 removed so they can then go after big tech, or call people hypocrites when only their service gets removed. But as it stands, isn't the service protected?

> The law allows for companies to engage in “good Samaritan” moderation of “objectionable” material without being treated like a publisher or speaker under the law.

My understanding is that the law simply says that doing _some_ moderation doesn't make you the publisher.

Section 230 protects against civil litigation, not criminal.

Simplest explanation is that Rebekah Mercer knows how to write a check but can't evaluate talent properly.

I would assume they simply haven't been around long enough, and didn't have enough money to throw at the issue yet.

I hope they will be back, stronger than before.

They should have seen this coming. But then, so did the Capitol police.