Hacker News Reader

Comment by f430 | Hacker News Reader

> GPS coordinates—unlike most social media sites, Parler does not strip metadata from media its users upload, which, crucially, could be useful for law enforcement

OH SHI-

This is a colossal mess up, on epic proportions.

View on HN

Due to the people involved, Parler is almost certainly not a honeypot setup by the FBI, CIA, or some other government organization. However some of the details that have leaked out over the last week made me wonder how little of the site would have changed if that was the intended purpose.

Sufficiently advanced incompetence is indistinguishable from malice.

Hah, this is great. If you don't get the references, it's Hanlon's Razor ("Never attribute to malice that which is adequately explained by stupidity") plus Arthur C. Clarke's "3rd law" ("Any sufficiently advanced technology is indistinguishable from magic.")

Apparently it's called Grey's Law: https://www.urbandictionary.com/define.php?term=Grey%27s%20L...

Does that make it a "quotemanteau"?

Wait... Is that a thing? Are there more of these?

I vote for "quotemanteau" to be officially sanctioned! But I would say the specific case is merely a snowclone[0] of "any sufficiently X is indistinguishable from Y"

[0] https://en.wikipedia.org/wiki/Snowclone

It appears to have the properties of both in this case.

That is to say it's a snowclone where the substitutions come from another quote.

I guess quotemanteaus are a special kind of unique snowclone.

You could take "with great power comes great responsibility" and form the snowclone "with great X comes great Y" and then take the quote "the medium is the message" and use those in your snowclone to make the quotemanteau "with a great medium comes a great message"

Hmm... I feel like I should try concoct more of these. They're fun.

Thank you for the explanation.

More like, sufficiently advanced malice is indistinguishable from common incompetence :)

It's pretty well demonstrated that Three Letter Agencies really like enticing idiots people into fantasy situations well above their competency in order to generate terrorism convictions so it's always a possibility even if there's no demonstrable third party malicious action

And in this case there is demonstrable malicious action.

It would probably have been more secure.

this is true "female body inspector" shirt clientele though

they would have required authentication for their api calls if that was the case...

Besides that, probably not much. =)

Indeed. The level of security failure was pretty incredible. They named media serially (So, pics/1.jpg, pics/2.jpg, etc.) and did not have any validation that you were allowed to access what you were grabbing so it was literally as easy as possible to grab everything. Oh, and did I mention that private messages were also fully accessible?

So Gab's strategy (fork Mastodon) looks solid for security but they hit performance issue because Mastodon isn't made for such scale.

Mastodon scales horizontally until PostgreSQL becomes the bottleneck:

https://docs.joinmastodon.org/admin/scaling/

they needed a platform that would not need to scale before the database server becomes a bottleneck

I am convinced this was an inside job. There is simply no way someone can be this incompetent without willful intent.

Ever worked for a startup? This is what "move fast, break things" does.

This happens at established firms as often as startups.

I have but only at competent ones. Nothing this flagrantly bad.

I’ve seen not quite this bad but definitely in the same order of magnitude

I disagree, incompetance is rampant. I worked for a healthcare company who kept it's data at a Dell security center. One of their people ran a SQL script that deleted millions of billing records. They informed us later that they could not recover the data because every 24 hours they were writing over the one backup they kept. We had missed the window by a few hours.

You take shortcuts. Saying you’ll fix it later. Which never happens because you’re busy on the next feature that is riddled with the next set of shortcuts.

It happens.

Let me introduce you to every early stage startup in the world. Plenty of mature companies also have completely abysmal security practices

I wish I could disclose some of the incompetence I’ve encountered to persuade you otherwise. The reason there aren’t breaches like this of nearly all systems isn’t because most systems are better protected, it’s because no one’s interest (or they’re not interested for the purposes of sharing).

You'd be surprised how incompetent people can be when it comes to security. Nothing i have heard so far would really surprise me for a small startup with very rapid growth.

A career in looking at the guts of companies later I can assure that is very much possible.

A mess up if you intended to protect your users...

Reply on news.ycombinator.com