Hacker News Reader

No, we can't conclude that yet. Gab modified their instance heavily from Mastodon code over several years. People are also pointing to an addition made by Gab, where an SQL query is used without input sanitization, as a possible culprit for the breach.

This had nothing to do with the Mastodon code, Gab has made a big deal about all the "improvements" they've made.

SQL injection that was used for the breach was introduced after the fork. We know that for sure because the source code was public, as is required by AGPL Mastodon uses.

Specifically, this was the commit (from a mirror of the repository): https://git.rip/gab/gab-social/-/commit/6e42e3b1eca73c306db1...