Twitch source code and customer data has reportedly been leaked
videogameschronicle.com
videogameschronicle.com
My wife and I can't wrap our brains around the fact that payment info was leaked alongside source code.
Any theories how this happened?
Former pentester btw. I saw a lot of interesting things during my time, but I can't recall seeing a payment database next to a source code repo.
Did their s3 bucket get popped or something?
Even if their github enterprise got popped, that doesn't explain that streamer payouts down to the dollar were leaked. "Oh yeah, I commit all my stripe data into github. It's for compliance /s"
EDIT: If you want to see how much everyone's making: https://www.reddit.com/r/LivestreamFail/comments/q2gooi/twit...
I suspect you just haven’t looked at what the BI team has been up to. This seems like exactly the kind of stuff BI folks always leave on git.
With that, there are tons of specific disciplines you can focus on for pentesting. I'd figure out what excites you and then go for it. Web app is diff than physical exploitation of security systems etc. but some of them cross over.
Another option. Work for the government, join a red team or apply. They'll train you and you'll leave with a new perspective and possibly knowledge you can't get elsewhere.
> if you're not ready to write extensive reports.. it's probably 75% of the job
Do you happen to have a system for building these out? As a techie, I imagine you've tried something like text-expander or similar... but I see a lot of people unsatisfied that they end up building their own tools.
So all in, there are different tools needed for each report. Fortunately the way we capture the data and notes through out the "op" makes it much easier for the team to put together each part.
There's ways we could automate more, we've even messed with AI writing some of the suggestions and actions based on input. So far though, we still need the humans in the loop.
Honestly the first few reports are hardest, after that you find a process and it becomes much easier.
I've seen a lot of professions where in depth reporting still requires humans in the loop, and I think that will always be the case.
There's a small hope I have that one day writing will be a bit more like programming -- as in selecting a 'class' for a structure of a section / paragraph / thesis you want to communicate, which then provides typed functions for potential inputs -> outputs, freeing up human brain cycles for more interesting ideas.
Legionnairenove@protonmail.com
Initially job may not pay good but you can build your network and then probably start doing contract works. Most of the pentesters I know make more from freelance/contract work then their jobs. Because mostly those contract/freelance work pays on hourly bases. The initial hour rates usually are somewhere between 40-50 USD but they can go to 120-150 with just after few jobs.
P.S - I might have made it sound a very simple or easy profession but its not :)
For example. In 2012 average consulting hourly rate I charged $350. Stayed booked. 2016 $550. Stayed booked. In 2018 I had a couple really large clients that paid $1500+hr
There's gold in the hills, the trick is to figure out how to sell the pans, water, plots of land, and transportation to them. If you can work in complementary services or referrals for all the above, you just made yourself even more valuable.
1) The payment-data were just artifacts left on some file-server or from a process, which was accessible from dev-space.
2) No real systems were accessed and everything, it's all from a bad backup-server or poorly managed worker-pool.
3) Multiple Persons got hacked.
4) Exit-Scam of one or more Workers who just had broad enough access for some reason.
5) Twitch's security is just that bad.
Some notable thing is, the payment-data are quite limited, there are no real private data it seems, and the git-history seems also be missing. It's not sure whether this is on purpose and whether more data will follow. But this overall hints so far that this at least was not a full deep hack.
The article says otherwise: "The entirety of Twitch’s source code with commit history “going back to its early beginnings”"
There are devops tools, soc tools, and a ton of random things here, I guess we'll have to sit and wait to see if more follows.
"Feet pics when?!?"
A third reason would be finding a security flaw in the source code and exploiting it.
Nobody is putting production databases in to commit history. At the size of twitch, there's also no way any application dev has access to production.
> credentials like a password for a database is (even more common).
??? What cowboy outfit is putting things which grant access to production customer data in to git?
The site you linked to detects if the referrer url is HN and instead displays only an image saying "HACKER NEWS - A DDoS MADE OF FINANCE-OBSESSED MAN-CHILDREN AND BROGRAMMERS" instead of the content you are trying to link too.
wtf
And no, thats not a clever thing to do, neither is there a good reason to do it. But people do things you do not like and theres little you can do about it.
I would like to live in a world where you were right, but I am not. Sadly.
[Edit] dumps though are another thing. Not seen that, yet.
EDIT Found it again: https://sizeof.cat/post/twitch-leaks/#secrets-exposed
The site you linked to detects if the referrer url is HN and instead displays only an image saying "HACKER NEWS - A DDoS MADE OF FINANCE-OBSESSED MAN-CHILDREN AND BROGRAMMERS" instead of the content you are trying to link too.
OK Then...
The choosing of the name Vapor is probably no accident when the main competitor is Steam.
Just like when IBM launched the "Eclipse foundation" which was arguably based on one of Sun's most prized possessions; Java.
It was slow and buggy, but it felt like a handheld computer.
Qtek rebranded to HTC and I bought a HTC Touch running Windows Mobile 6.0, I am not sure when or what I switched to afterwards, maybe an Android.
Intel get the Apple gig -> Gets called Intel Core i.e. Apple Core.
The problem was the critical mass issue - no users, no publishers, neither want to join without the other.
Amazon will definitely get publishers but will users join? That's not a given.
Look at Epic which offers free games but sees pretty slow growth outside of their flagships. Further, look at Amazon's lumberyard engine, which gathers dust for the most part.
I'm not convinced that their 'weight' will automatically guarantee wide adoption.
That's not a formula for winning.
Unfortunately, Amazon has all the money in the world to keep throwing at the problem. Eventually some of the spaghetti will stick to the wall.
> no users, no publishers, neither want to join without the other
> Amazon will definitely get publishers but will users join?
Well, the publishers will be there. If users have a reason to go there over Steam, they will. Amazon will lock in a few exclusives, people will start to come over. Who knows, maybe there will be some way to verifiably move your Steam library over to an Amazon account?
I don't think the bar to compete with Steam is as high as you're suggesting, but even if it is, if anybody was going to start listing companies that could conceivably do it, Amazon would probably be on the list.
Given that steam has pretty strict terms with publishers over this, I highly, highly doubt they would do this unless they wanted to dump a huge ocean of money into free license comps for developers to make money from and for users to get free games.
Competing with Steam isn't only just a money/size thing, though of course that helps.
The library is the #1 reason people stay in Steam. Lots of people just buy games in other places and just add it there.
Amazon could, for example, offer different royalties (say, 10% instead of 30%) for publishers willing to have their old games "moveable" to Amazon's hypothetical new platform and I bet a lot of studios would take the deal. This is not unheard of: it's how Apple does iTunes Match.
I think people just consider Steam as a store, but it has become much more than that.
Game overlays and capture were working fine, and the controller API was designed to support any number of controllers (Steam's support is great but their interfaces are subpar, in our opinion). We were also able to pull from a well known database of controller configurations and device IDs, which really made this a non-issue.
Linux compatibility was fine as far as the client went (all of our code was cross-platform and not webkit frames or the like). The client even ran on Android and iOS.
If you're referring to Steam's Proton, we really didn't want to touch that area for a while. But we had much better systems for searching for new titles, including those that worked well on the system and also matched all of the criteria (tags and whatnot).
Our social system was also designed to support "cross-talk" between different marketplaces (Steam, GoG Universe and Epic) but we never got as far as building out any client functionality - just the initial blackbox proof of concepts.
The store aspect was indeed just a smaller part of it, though it was complicated in its own right.
The project was a great idea and we were executing well on it. Lots of cool new tech was developed for it. But nobody we talked to wanted it - including publishers, users, investors, or even friends. It didn't matter how compatible we made it, the fact that we didn't push you to re-buy games, etc.
We wanted to make an non-shitty experience for gaming and the market simply said "no".
Like I haven't touched my Xbox One in years, but I'm still giving them $10/month for Xbox Game Pass for my PC.
"In its latest financial results, Microsoft announced that the gaming division revenue was up 50% year-on-year, boasting huge $3.53 billion earnings over the past 12 months. The vast majority of that income stems from Xbox hardware (largely the launch of the Xbox Series X/S), which is up 232%."
https://www.vg247.com/xbox-revenue-hardware-game-pass-boost-...
Okay, I guess hardware is still big for them. Huh.
This is where they've been throwing money at the problem: giving away a ridiculous amount of games for free.
https://www.theverge.com/2021/4/12/22380895/epic-games-store...
On the other hand, it should be possible for consumers to claim products they own on different platforms by peering a list of their their owned (licensed) products.
It happened to me. If you're in the industry long enough, I'll wager it happens to you too.
FWIW The notion that a company like Amazon or whatever can have it's tentacles in these kinds of things at will is proof they are getting too big.
- 10-15% commission
- Exclusives
- Curation/quality control
- Integrated anti-piracy
- Forums/modding/game guides
- User profiles/achievements/gamification
- Less generous regional pricing (like on consoles) in exchange for slightly lower overall pricing
- 5% cashback into wallets, like Nintendo eShop
Epic only does some of these things, which is why its struggling. Its lack of social features is a major reason for low engagement on the platform, probably driven by Tencent and Chinese censorship restrictions (in the same way that the Steam forums are unavailable in China).
Exclusives are anti-consumer and doesn't convince users if we follow what Epic did.
It's easy to say "curation/quality control" but to come up with a method and algorithmic way of doing it well is insanely difficult.
Anti-piracy is just called DRM and it's not really foolproof nor always desired. GoG is successful in catering that niche. It also requires a good understanding of reverse engineering hardening, so much easier said than done.
Forums/modding/whatever, yeah sure perhaps "simple" but quite extensive. Even for a large company, code doesn't write itself (well, not any code you want to rely on, at least).
I don't really get the console pricing aspect, sorry.
Cashback isn't a free thing, it's a marketing campaign - even if it runs indefinitely. I don't think that would work by itself, it's a bit of a gimmick.
Epic is struggling because of their anti consumer strategies, aggressive and oftentimes reckless CEO, seemingly constant and very public lawsuits with huge companies, and trying to stay relevant outside of Fortnite.
I agree that lack of social contributed to it but is far from the only problem. For example, Epic doesn't have a cart. It's been a widely requested feature, but they focus on other things.
Tencent is a cancer upon this world and I have little base respect for companies that go with them.
>vaporware
I see no issue here
It would be pretty awesome if they stuck with "Vapor" though. It'd be some WWE-style drama, and great for marketing.
When new sounds for System 7 were created, the sounds were reviewed by Apple's Legal Department who objected that the new sound alert "chime" had a name that was "too musical", under the recent settlement [with Beatles' record label Apple Records]. Jim Reekes, the creator of the new sound alerts for System 7, had grown frustrated with the legal scrutiny and first quipped it should be named "Let It Beep", a pun on "Let It Be". When someone remarked that that would not pass the Legal Department's approval, he remarked, "so sue me". After a brief reflection, he resubmitted the sound's name as sosumi (a homophone of "so sue me"). Careful to submit it in written form rather than spoken form to avoid pronunciation, he told the Legal Department that the name was Japanese and had nothing to do with music.
Meanwhile, Twitch has had a significant bot spamming problem.
And even otherwise, any fuckups there, my bank is liable. My phone number? Outside of changing my 20-year-old number, there’d be nithing I could do.
> And even otherwise, any fuckups there, my bank is liable. My phone number? Outside of changing my 20-year-old number, there’d be nothing I could do.
The fact that they can use this number to correlate against contact lists collected from other people.
Now I don't think Twitch itself is doing this, but they may provide this information to marketing platforms such as Facebook which will use this data for ad targeting (and they definitely have a lot of people's contacts and can infer social graphs very well as a result).
The only scammers who know my number are my phone-provider and my mom. Other scammers either never call me, or just don't know the number. Protecting your number is possible.
> Meanwhile, Twitch has had a significant bot spamming problem.
Which can be solved without this. The bot-problem is more about people not using the existing tools well and twitch sucking in their handling. Adding another features they won't use will not make anything better. Especially as the phone-number only rises the bar for bots.
It literally takes only one person who has your number to reveal your number.
For friends/family they have my cell# and it only lets calls through if they're in my contacts.
Phone numbers are nice because the marginal cost to a customer is low (they probably already have one) while the marginal cost to a bad actor is high (it's expensive to acquire many of them or to change one once it's been identified as malicious).
My current twitch subscriptions: 11.97€/month
I can’t really see how they need my phone number to make it too expensive to be a bot.
And if that is the thing, then that’d makes them even more shady, claiming it’s for account security when it’s for their bit protection.
They really need that verification option just to avoid getting run off the platform.
I imagine other free software might have modifications too.
> The GNU General Public License permits making a modified version and letting the public access it on a server without ever releasing its source code to the public.
> The GNU Affero General Public License is designed specifically to ensure that, in such cases, the modified source code becomes available to the community.
Modifications don't need to be shared back to the community if the software is used internally or behind a webserver.
As long as GCC is not distributed, this is a perfectly valid use case for GPL'd software.
Less abstract: Facebook famously has massive internal patches for MySQL, which is GPL'd. And of course, Google has massive internal patches for Linux kernel, which is also GPL'd.
What's the difference?
But seriously, if it takes trolling through the code to determine that Twitch's math violated their special way of doing math that no one else should get to use, it's just more evidence that software patents aren't helping protect or encourage innovation (else the violation would have been apparent from using the service). It would instead clearly be a "hah, gotcha, turns out we patented the linked-list-inside-a-hashmap construction you've got going on here, pay up! Only we can put the Legos together in that way!"
That's being irrationally dismissive of the effort and merit it takes to win in an attention market in a particular way purely because of a personally biased judgement of value.
The real genetic lottery winner on Twitch is being a white male given the relate-ability to the majority of Twitch's audience, and as the data leaked supports.
I mean even consider the cost those creators have to bear of dealing with people who are constantly claiming that their success in somehow invalid.
justice? hardly.
That's just a long way of saying that if you wanna get rich, learn how to write code and talk to people. Way easier than becoming one of the top 3-400 streamers in the world.
[0] https://www.indeed.com/career/senior-software-engineer/salar...
Also, you linked to the wrong job title. I said "senior staff" software engineer, which where I work is two rungs above senior engineer. http://levels.fyi has comp estimates for a bunch of the big tech cos. $750k far from an unreasonable amount for someone to make in this line of work, and plenty of folks make a lot more than that.
1. Indeed, Glassdoor and other mainstream sites are useless and at best report outdated base salaries. Use levels.fyi or teamblind.com for more realistic data.
2. 50% or more or the compensation at these companies is in RSUs. These companies have performed remarkably well over the past decade. Folks who have had exposure to their stocks as employees have done very well.
3. Half a million dollars a year (before refreshers, etc.) is entirely realistic at the Staff level and at Senior Staff, you're often looking at anything from $700K to low $1MM.
For these companies, the scope and weight of someone at that level of work if impact across millions/billions of users and their actions can make or lose you similar amounts of money.
People are generally paid based on how hard they are to replace, not by how much profit they generate. But in some markets, this results in people making terrible wages while the company makes tons of money, ie, Wal-mart and basically all the major fast food chains.
Corporations are so used to applying arbitrary values to ephemeral things on their balance sheets that I think such a mentality seeps over into highly skilled employees in some cases.
In other cases, the business's viability is determined by how many minimum wage (or better yet, off the books entirely) laborers can be obtained in a given week. See: every construction project in every US state, for example.
Bezos doesn't have to work. To be honest, I don't know why he still does. Personally, if the stock options at the startup I work with end up panning out to be worth $5M or more if/when they go public in a few years, I'm taking that cash and retiring at 45. Throwing it into an S&P500 index, I could live off the interest for the rest of my life.
Twitch just asked me to change password for the first time, so it sounds credible.
One wonders. Why are encrypted passwords stored in an external code repository?
science != commerce
something truly novel is hard to evaluate in money
I am not saying at all it is not deserved. I am quite ok with them earning millions. But it does make a lot of us pull this comparison, both in achievements for humanity and in effort spent in their endeavors.
I personally never played or wish to play the fame lottery, I prefer the hard work path.
Yes some is luck, attractiveness, etc. But that's true in all careers.
Just because they're playing games doesn't mean they aren't working. Athletes get insane amounts of money to play games. They exert themselves more physically, but I expect being a top steamer day in and out isn't a cake walk either.
Unless you're an absolute god at whatever game you're playing, nobody wants to simply watch you play a game. People come for the live commentary and audience interaction.
Being a successful stream takes charisma and cleverness, and being clever and charismatic for 3+ hours straight to entertain your audience can be exhausting.
Wealth is not linear, it's not promised as the result of "hard work". Hard work helps, but it isn't the determining factor of whether or not you'll get a payout.
You must work hard in a domain that has public visibility and actually produces something of value to people. And yes, Basketball (and watching it) is extremely valuable to a lot of people.
Nevertheless, anyone that manage to have 5+ millions USD in property and savings before they are 30 got to a level of wealth in 10 years that 90% of people will not achieve in a lifetime.
https://i.kym-cdn.com/photos/images/original/001/259/257/342...
Someone can want socialism while still participating in a capitalist society. Being a martyr is rarely worth it imo.
On top of that, even if we lived in a socialist society, the top would still be rich, they would just be taxed more.
Top 10k Streamers by Revenue: https://pastebin.com/LjmaPNam
Contains the following data points:
'ad_share_gross', 'sub_share_gross', 'bits_share_gross', 'bits_developer_share_gross', 'bits_extension_share_gross', 'prime_sub_share_gross', 'bit_share_ad_gross', 'fuel_rev_gross', 'bb_rev_gross'
(TTS donations, 3rd party revenue like OnlyFans, Patreon, Amazon Gifts and sponsorship deals... are not included)
Total gross payout in the leak (2019/8 to 2021/10) was 4.2 billion dollars across 344k users. (based on data points above alone but could be wrong since it's annons on 4chan.)
PS: Make sure to change your Twitch (and possibly Prime) password. Twitch is already prompting users to do so based on Reddit posts.
Looks like someone dumped everything on their github enterprise.
I wonder if this'll lead to software engineers in big companies having more restricted access to code?
Before per-branch controls, the only way to disable write access (while maintaining read access, pull-request privs, etc) to a repository's blessed branches was forks.
The number of git repos might look big but without knowing more, the content of most of those repos could be a complete nothingburger. Number of git repos is pretty meaningless metric, IMO.
I don't think that Twitch has closed source code because they want to keep code private. It's probably more a matter of don't want to show commit message in case there are some bad words inside it. And don't want to show the world in case their source code look bad.
Twitch without its code source can't work yeah, but imagine if all the commits of Twitch were public I doubt it would change anything for them.
That would be nice if their was a mental change about source code and that it is fine to show it even if it looks shit.
Snippets of open source code.
Commit messages that imply anti-competitive behaviour ("Committing a change to the API to lockout competitor XYZ").
Commit messages that imply code theft ("Using a method that we used at my previous company").
etc.
Sometimes things that look sketchy might be innocent but will still cause nightmares for twitch since they'll now have to play defensively as people call into question anything that ever went into the repo.
There is also the issue of security. I'm sure people will be combing through the source code to find anything they can exploit, even if it's a simple XSS attack. It could either be sold/used for malicious actions or submitted to the bug bounty program for the reward money.
Back in the mid 90's there was a issue in Scotland when a well known journalist got a job in a call center and looked up the private telephone numbers for the Queen.
On top of that, besides their eceleb status, most of these people aren't that professional. Plenty of them are a combination of variety or casual, often to a degree the person isn't even that good in games in general.
Their production quality also isn't anywhere near amazing (note it can be both organic and high quality), and other parties (e.g. Hololive) have shown how easily the space can be disrupted. For those curious, notice how many top streamers still lack actual high quality audio (mostly from their own lack of voice training rather than equipment), proper schedules and sticking to those schedules, high quality video when applicable (e.g. bad light), allow themselves to get devolved in politics, allow their streams to go majorly off-track in general, etc. It's not like these guys don't have the means to drastically improve it.
And the obvious: we don't have anywhere as much of a shortage of people willing to play games in an extremely dedicated manner as doing software development.
On production quality, I think it's a mistake to think it matters too much. Live streaming is a different thing to television. In very much the same way Roblox is different to AAA games.
There's also a level outside of the more chaotic personalities who make a lot of money in spite of themselves where there is a lot of professionalism going in to making things seem pretty casual because these people know their audience.
The other problem with looking at hours worked is it's hard to quantify sporadic interactions on multimedia and the likes. Arguably the biggest drain, most of these people are always "online" and have a hard time unplugging themselves. This is further exasperated by the momentum loss most streamers perceive when not streaming for a long while.
>On production quality, I think it's a mistake to think it matters too much
But we don't really know that yet. It's extremely hard to quantify all these variables and what truly matters. What we do know is many people in these circles have fallen to the side since they were unable to keep up with the modicum of effort newcomers put in despite their lack of resources and despite the first-mover advantage these old-timers had. At the same time, we see other parties break through with new concepts while putting in a ton of effort to market and PR themselves, and it worked, as seen with the Hololive example. The top earner is (apparently) also much more professional than the majority of the top 10/100/N.
>Live streaming is a different thing to television
If anything, this is the biggest problem. If beginners are expected/advised to put in much more effort and resources to (increase their odds of) breaking through compared to before, why is it acceptable for someone earning a Silicon Valley-equivalent salary while living in a much lower CoL area to stream in a dank basement or attic with poor audio quality? This isn't a criticism as much as a question. Maybe it doesn't matter. But it's also the question which makes people wonder "should they be earning as much as they do?"
If you arbitrarily take $50k as a living wage then it's basically the top 2000 streamers who can make a living on Twitch. Random googling tells me there were approximately 8 million active streamers in September. Again arbitrarily assuming that 7 million of those are 'casual' and doing it for fun that means the percentage of streamers making a living wage is 0.002%.
Back of the napkin math but kinda depressing.
Edit: Someone on Twitter told me that Affiliate status is pegged around the top 3% of streamers. So taking that as my new baseline for "trying to make it" since you can actually get paid out, it raises the percentage to a whopping 0.008%!
Plus, Twitch is probably just one source of income for many content creators. For many it's not their primary source, but just a side source. YouTube, Patreon, OnlyFans, outside sponsors, or even esports may be where they make most of their money.
I have spent decades of my life learning about how to use, propagate, and cultivate most plants, animals, fungi, and minerals (not the propagate part here) in an area +/- 100 miles from where I live. I've taught a couple of State University extension classes, and regularly sell at a farmers market the things I gather/grow, just for shits and giggles.
People have asked me for years why I don't do this for a living. Why don't I do that instead of working a job that I am neutral to, but that pays the bills.
Because all of that sounds exhausting. Needing to maintain a presence on so many platforms, interact with so many people, and constantly be thinking about my next thing for all of the various platforms is just exhausting.
I don't know how people can do it without burning out.
The thing is the power law curve is so strong that if we take the top ten thousand which sets a living wage at approximately $11.5k which is definitely not a living wage in a lot of places people stream from then that only improves things to the top 0.04% (of those trying to make it).
> Plus, Twitch is probably just one source of income for many content creators. For many it's not their primary source, but just a side source. YouTube, Patreon, OnlyFans, outside sponsors, or even esports may be where they make most of their money.
If you read the original comment the gross amount supposedly includes 3rd party revenue.
It’s an entertainment corporation that just happens to run on Twitch.
No Twitch donations, Patreon, merch sales etc.
edit: I saw it mentioned in that /g/ thread that these numbers are without the donations.
This is not worth worrying about. If Twitch is making you reset your password, that means you don’t need to hurry because they’ve already locked your account. If your password hash leaked, the important thing isn’t Twitch, it’s every other place you used the same password.
Use a password manager, and reset your password if the service has been compromised.
Expecting people to simply memorize a unique, strong password for every single website that they use is unrealistic. Of course, no solution is perfect, but that doesn't mean we shouldn't improve the current situation of people reusing passwords with maybe slight modifications per website.
Why? Any breach that involves usernames/passwords are account name and password combos that get tried on EVERY POSSIBLE SITE after.
It only takes one pair of username with a reused password for this to work.
I remember some services send you a message telling you to change your password anytime a new device logs in or even fails to login to your account. That causes most people to pick weaker passwords, since they're not all using manager apps.
7BB7DB877943832837046863EF45C252D3A08C92A273F7B665210A6E12701095
Do you have Amouranth's or xQcOW's salted hash from this leak? Might be worth trying to brute force it.
You try on those kinds of accounts because they might have re-used it or the password might be patterned or not completely random, which gives you a chance that the credential might give you access elsewhere.
At least when i donate to blue origin i get something tangible delivered to my door.
Where is the value exchange in being one of 10k people building a faux-relationship with a hot tub streamer?
ohwee! the streamer might read out your username along with a scripted line after a 5 dollar subscription!1Eleven
Of all the things on Twitch the value of Hot Tub streams seem very upfront and I think it's pretty telling that there are vanishingly few successful streamers doing it and that for all the hot air people spew about its a very niche part of the site.
Undelivered promises and lawsuits against NASA to slow down space exploration for all of us ?
And by its very nature, it is ephemeral.
Subscribing or donations are completely optional. ( subscriptions get rid of the adds, but I doubt that's a main driver)
I feel like it's substantially different, you are paying Disney the money to watch the movie, you don't really care about the actors or other people who worked on it.
On the other hand, twitch users pay for the sake of paying money, it's closer to something like strip clubs.
What about comedy clubs? If I buy a ticket to see Dave Chappelle, who is clearly wealthy, am I sucker too?
What about paying cover at my local bar because a local band is playing that night?
What about buying tickets to a baseball game, to see a bunch of millionaires play a game for a few hours?
You are making it seem like users get nothing for their money, when there is plenty of established precedent for giving money in exchange for attending a performance.
Sure the performance has changed, but the actual difference here is that these Twitch millionaires (and the rest who are far from millionaires) are literally charging "pay what you can" instead of setting a minimum ticket price for their show. Plenty of people (the majority in fact) get the show for free.
Groceries are necessary for survival, and limited in quantity.
Movies and streams are similar to each other because they are both video content. And as long as the creator of the stream or the company behind a movie get paid enough to make the content they could’ve received no more money and still gotten by fine.
Streams are a little bit different from movies though because much of the audience is actively engaging in conversation with the creator or making requests to them etc. In that sense a stream has an aspect of limited supply to it that a movie does not. At some point the audience of a stream will be too big for the creator to be able to meaningfully interact with all of them, and at a point after that maybe even too big to be able to meaningfully interact with any of them.
And so if you have a lot of people that want to interact with you it makes sense to prefer interacting with the ones paying you money, and to encourage them to do so. And beyond that, it also makes sense to offer “exclusive” content to people that pay. So OnlyFans makes sense too.
What really has me upset though is thinking of the people that are on the audience, among whom some people have little money but also get so little attention IRL that they are paying someone who already has a lot just to interact with them and maybe even being deluded into thinking that they have some form of “real” relationship with them. That is very sad and something I don’t think has been studied enough and is not being talked about enough.
I still think this is a narrow view.
So you don't consider a performance to be a product?
How is going to the movies different from going to a baseball game or a concert or a comedy club?
If those are like movies, and movies are like groceries, are we not back to the same point that people are exchanging money for some kind of benefit, whether it's a tangible thing they take home or an experience they enjoy?
A less emotionally evocative example might be giving money to a street musician who accepts requests for donations. Either way, the street musician is there performing and you can enjoy the music whether you pay or not. But the money gets you a bonus, and you’re free to give money regardless of desire to request a song.
Or at least, maybe that's a welcome side effect but not the main motivation for a lot of people.
I am guessing here, I have no data to back this up, but I feel like a lot of people sub out of gratitude and as a show of support, and less to draw attention or get some kind of shout-out..
I do watch a decent amount of streams on Twitch across a few categories, but I've never subscribed or donated to any of them, so it's possible I'm wrong here.
Also I did make the distinction between paid performances and "pay what you can".. That was indeed my point, that Twitch differentiates itself by being an essentially "pay what you can" service where the majority don't pay anything, but lots of people still manage to make money giving their work away for free.
There are three things you need to survive: food, shelter, and love/community.
Entertainment can sometimes provide the last one (love/community) but for the most part it's fulfilling a need for distraction and/or curiosity.
There was a stint during the GTA V RP craze I had it on in the background and watched it for approximately 6-8 hours every day. I subbed to one streamer for like 5 bucks.
This averages out to like 2 cents/day for 240 hours of entertainment. Cheaper than netflix, cheaper than cable, cheaper than hulu... You catch my drift. I don't know how this is different than me paying $80 to spend a night out at the movies with my wife, other than it being insanely cheaper?
Some people, on the other hand, like to reward others if they enjoy the product/service/performance they provide.
That's the nature of "pay what you can". If money is tight, then don't pay, and don't feel bad about it. But if you have disposable income, and you value the experience, then give what you can as a form of gratitude.
It doesn't need to be said that if everyone took the "it's free so I don't have to pay anything" route, then there would be no show to see.
I treat museums the same way. When I was young and poor my parents didn't pay to get in since it was optional. But now that I'm older and I make good money, I donate extremely well when I go to museums. I know that it's voluntary and I choose to participate in funding it because I enjoy the experience.
If nobody paid to go to the movies, then nobody would want to advertise in those movies, those movies would lose their sponsorships, and stop being made. If everybody unsubbed from netflix right now they would stop funding original content, even though the content they make has ad placements. Why even ask netflix for money if you can just make a wildly successful tv show with ad placements and release it for free?
Why should you pay to go to a football game? Why should you pay to watch a football game? All the players have sponsors. They're all millionaires. Why did our parents pay for cable? Cable had ads, all the actors were millionaires, the cable company owners were millionaires, the production studios were millionaires. You're saying practically everyone who bought cable in the 1990s-2000s was bad with their money because the actors were millionaires and had ad sponsrships? Give me a break.
I just think it's incredibly disingenuous that because someone is leveraging a SLIGHTLY different monetization model that allows for free consumption, that anyone who pays for it is bad with their money. Maybe if you condemned ALL luxury spending with the same energy I could see you're at least being consistent. But this is just more irrational disdain for the new wave of media consumption.
If you would pay money for Dave to shout "Hey sbarre, thanks for the donation" from the stage, then you'd be doing what Twitch fans are doing.
Plenty of people do, of course. Celebrity worship is quite common.
On youtube you have streamers merging under the same umbrella to create branded channels.
IMO the differences compared to Disney is the scale of the production and the interactive medium (which is constrained by scale). Once you reach a certain scale I don't think you can expect much direct interaction due to the volume of chat. So really it's just scale.
My favorite twitch streamer, 'x5_pig' (996th highest earner on twitch) only grossed $186,000 over 24 months, and lives in a fairly HCOL area in Australia. I'm happy to give him $5 or so to help make sure that he continues to stream an EOL game, Starcraft2.
Sure, he has other revenue streams as well but I can only imagine the risk he takes by sticking with a game that's been EOL'd. When Blizzard shuts down the servers I imagine he'll have no career left at all and will likely have to start over in a totally different career. I'd be surprised if he could start streaming some other strategy game and maintain enough earnings.
I pay him $5/month to help swing his risk-reward balance in favor of continuing to produce the content that I most enjoy vegetating to after my 12 hour day of coding/troubleshooting/collaborating.
Sure, he has other revenue streams (YouTube, announcing for major tournaments, etc). But I imagine for him it may be important to earn enough over the 10 year life of Starcraft2 to mostly-retire in case he ends up without a "real" career.
In fact, sometimes I wonder whether income tax brackets could potentially include consideration for short-lived high earning careers. Seems it might be slightly broken to tax someone who has a stable $1MM/year income for 30+ years (e.g. car dealership owner) the same % as someone who makes $1MM this year, but next year might be earning $40,000 working at that car dealership (athletes, streamers, windfalls, etc). Seems like it might make sense to allow people to "defer" earnings to future years, as long as income tax is eventually paid in full. This could allow people who unexpectedly earn $1MM for just one year to spread out those earnings over 10 years and pay a more appropriate % as taxes. Not sure what else this could break though, or how much of a problem it really solves vs. other things legislators could be spending time on.
https://www.ato.gov.au/business/primary-producers/in-detail/...
Without the payment the service wouldn't be accessible
Telling blue collar workers you work in tech usually gets a nearly identical reaction to what you just gave. etc etc.
The blue collar workers are right too. They should be getting paid a lot more. Certainly not less than streamers. It's not fair and I refuse to accept it.
Come to think of it, advertisers seem to be a major cause of these distortions. They distort the value of activities that happen to have an audience. Yet another reason to block ads: help restore balance to society by ensuring people are properly rewarded for the actual value of their work instead of how many eyeballs they can summon.
In streaming case, for whatever reason you want to make a donation to somebody, not doing it because they are richer than you seems very strange to me.
Something we used to scoff at in places like Asia, now even casual relationships are utterly commoditized and we taught a whole generation of young humans how that's the most normal thing in the world.
rumor was recently negotiations have been very cut and dry for newer big/up and coming streamers basically being told to take some algorithmically assigned cut or give up partner status.
Actually the more I think about it - that does seem like a lot if you add in their other rev from youtube channels and other compensation. I understand why all the pro players started working on their twitch stream content more than winning competitions. More stable business and viewer base.
It's even more interesting that for 50k gross, you have to beat this guy "DEMOLITION_D" at the #4432 place.
Also: 4.8M/24 people is still 200k per head. Even if you assume that various costs take 50% of the revenue, they're all still making 6 figures for a thing that's pretty much a side hustle for most of them.
Also it started out being a side gig but most of them have switched to it as their primary gig. They are starting campaign 3 this fall.
As a point of comparison, a talented voice actor can gross around $125k per year, working from home as a freelancer. I don't feel that the Critical Roll actors are being overcompensated at all.
The most amazing Critical Role fact might be its creation was indirectly financed by Youtube/Google :o. Felicia Day knew all of those guys and about their private DnD game, she invited them to film few episodes for her YT channel "Geek & Sundry". Channel started with $1Mil advance from YouTube Original Channel Initiative, one of the rare if brief successes.
It's basically a regular job at that point.
If you look at social class stratification, the general assumption is that if you have to work a job for your income, you're not upper class, you're serving in the employment of the upper class. If you have a high paying job, that's defined as "upper middle" social class at least until you have accumulated wealth to transition to a capitalist/owner/investor role (as some popular musicians and athletes do); being in the top 4% of earners is quite reasonable for traditional upper middle class roles e.g. independent lawyers and doctors, which also tend to earn 200k+/year in USA.
The media/VC etc community has been hyping e-gaming as the new sports domain. That said the top salary for a sports player is $168M / year for one player (Lionel Messi) and number 99 is $35M/year (source: https://en.wikipedia.org/wiki/List_of_largest_sports_contrac...)
It really shows how much of a step change there is between the sports & e-sports and I would be curious how much of this Twitch is keeping to themselves instead of paying out.
Not to mention how much uptime e-gamers have to put in.
Ninja was famously paid $1MM for an 8 hour ad of playing Apex at launch.
I've had private conversation with large streaming friends that have all said independently that the amount they get paid from a short Raid Shadow Legends ad is huge. One said it's enough to buy a nice car, and if they hit their target downloads (w/ link) the number jumps up to enough to buy multiple nice cars.
There is a lot of big money for streamers, not just big streamers.
I'm not surprised by any of this. If you ever did any digging in to how much advertising pays, ran numbers on twitch subs, etc, these numbers match that quite closely.
Paying all that talent adds up.
magnet:?xt=urn:btih:N5BLZ6XECNEHHARHJOVQAS4W7TWRXCSI&dn=twitch-leaks-part-one&tr=udp%3A%2F%2Fopen.stealth.si%3A80%2Fannounce
And "premium contracts" to keep talent were offered pretty much since day 1, just looked quite different back then. (Mainly just differentiated in sub share. For the last 2-3 years they also include better ad payouts (and a minimum of ad time), boni for minimum amount of hours streamed, etc.))
And... every streamer who only cares a bit about his business already knows, at least for the most part, what kind of contract other streamers are on.
So don't think there will be any (real) drama - but I also didn't see or hear of any extreme unexpected outliers.
the irony in that it was leaked to 4chan
Are you referring to some specific event?
The one I was thinking of, I misremembered: it was actually an (alleged) stabbing. https://www.theregister.com/2021/07/07/tenacity_maintainer_q...
...but that your views are considered problematic by quite a lot of people?
Perhaps that could be some cause for self reflection before you universally declare the entire platform here hostile and toxic.
What I consider problematic is the fact these people will organize massive efforts on Twitter to ruin other people's lives because they posted wrongthink. They make the 4chan raids I've seen look amateurish.
Yeah, 4chan is toxic and savage, but at least they are honest and humane in a candid kind of way.
The cyber-bullying's of 4chan is trash though...
While 4chan posters occasionally get organized and manage to operate outside their borders, these incredibly malicious activities just aren't something I associate with them. They're the specialty of groups like kiwi farms who are responsible for the suicide of at least one video game console emulator developer. I was shocked when people told me about byuu's suicide here on HN.
> ...but that your views are considered problematic by quite a lot of people?
You do not know what my views are. It's as if you are trying to prove me right honestly. (btw, I am not posting on reddit nor on twitter, nor 4chan for that matter)
Plus the same could be said for the toxic interactions that you had on there.
> Perhaps that could be some cause for self reflection before you universally declare the entire platform here hostile and toxic.
Again, same thing for you. "Perhaps that could be some cause for self reflection before you universally declare the entire platform there hostile and toxic."
I’m just going to politely remind you that on HN your entire comment history per account is public.
Also, something that I did not mention before
> ...but that your views are considered problematic by quite a lot of people?
This is not a justification for toxicity.
And it's not as if reddit does not have its own share of similar forums.
I'm really bad at woodworking, but I do it a lot, and I've spent a crap load of money on it. Does that matter at all to anyone else in the world?
Simping is more like an alcohol consumption - damaging and the first step is acknowledging a problem exists, often through an intervention.
I think the main issues overall are encouraging parasocial relationships, and also the problem of selling sex to kids. I'm no prude but I think it raises some ethical questions when you have gaming content and sexual content in the same spot. If I had kids, that would matter to me.
Looks real to me based on the archive I managed to download so far
Since copyright law favors encouraging scholarship, research, education, and commentary, a judge is more likely to make a determination of fair use if the defendant's use is noncommercial, educational, scientific, or historical.
'ad_share_gross', 'sub_share_gross', 'bits_share_gross', 'bits_developer_share_gross', 'bits_extension_share_gross', 'prime_sub_share_gross', 'bit_share_ad_gross', 'fuel_rev_gross', 'bb_rev_gross'
Twitch is not YouTube. For some reason they had for a long time big problems to get their ad-business running, especially outside the USA. It seems because of this the payment is low for streamers.
Paste it to a separate tab, then it works.
Until Steam has a couple major screw ups, potential competitors better have tons of capital to keep throwing at their platform-in-waiting! Amazon does have the $$$, but they also have hungry shareholders that won't wait like they used to. Gamers by-in-large quite like the platform Gabe has built.
Now, imagine using that argument when a bridge falls down. "What do you mean? You think all the bridge builders were safety engineers? Bridge components rely on different dependencies, often dozens at the same time. You just need one point of failure and boom, it collapses. These are humans creating these bridges. I would say that SPECIALLY because of the size of these bridges, collapses are inevitable."
People die when bridges collapse. People get mildly inconvenienced if twitch is slow or down.
Accordingly bridge construction takes security & safety much more seriously throughout the project. And it's orders of magnitude more expensive to build and check bridges for safety issues, etc.
> What all these coders do all day?
Implying that all coders have to care about everything in their stack. Putting the blame of UX devs or data engineers for the platform to be offline doesn't make any sense. Even hiring more platform engineers doesn't necessarily fix this issue. Like when building a bridge, you avoid this problem with good architecture.
Edit: One of the reasons is that because there are a very few people (probably) who do the low level stuff, there aren’t enough eyes on the code and a lot of vulnerabilities left in production.
Software companies are maybe incentivised to hire a lot of programmers who can start delivering on day 1. This wouldn’t be possible without the convenience afforded by high level languages.
A lot of people who worked in giant tech companies can tell you stories of talent being wasted on tight deadlines for unnecessary projects.
magnet:?xt=urn:btih:N5BLZ6XECNEHHARHJOVQAS4W7TWRXCSI&dn=twitch-leaks-part-one&tr=udp%3A%2F%2Fopen.stealth.si%3A80%2FannounceDownloaded: 7.84GB Uploaded: 64.64GB
sheesh, one popular magnet!
There's no such "trade secrets" laws or anything like that you're violating. Perhaps the hacker has broken laws of unlawful access (i.e. hacking), but you certainly aren't just by downloading it. It's as bad as downloading a song or streaming a movie on a sketchy website. In practice, I've never heard of anyone getting sued for downloading code in a large leak.
When the Windows source code got leaked, so many people looked at it, including FAANG engineers. As long as you don't bring any of that stuff to work you're fine. That includes the knowledge[0]
https://github.com/twitch-opensource
There's no way this is staying up lol.
Would be way more interest to me to know the distribution of people giving away their money. I personally spend about $20 a month on Twitch, I wonder in each part of the bell curve I am, and if it is a bell curve at all.
I'm hoping this leak will have serious financial consequences and bring awareness to that.
Really it just comes down to trust, and not having anything actually sensitive in the code, no?
This is also a project to enable me to learn go so is probably over-engineered
It's our first blog post (and we really tried to avoid making it look like blog spam as it's not intended to be blog spam) so please be gentle (but still brutally honest)
The chances of you stopping someone who's nefarious enough to use the data but so non-technical that they can't find a magnet link is so low it wasn't worth me typing this sentence about it
Does that mean that Twitch has very poor security systems that the entire infrastructure and data of Twitch was breached and it all fell into the hands of this so-called hacker?
Compared to the Epik breach weeks ago, this one is a lot worse.
I don't know what the point around this breach is for but surely the so-called hackers that have done this have now made matters worse for all Twitch streamers now. That was Part 1.
Waiting for what is in Part 2.
Twitch likely stores a lot of payment information too, i don't see why they would be better secured than anything else in this dump. Could get interesting
Personally I'm thinking this is decent PR for twitch since the market is still small and the payouts can be relatively high even in the middle tier.
magnet:?xt=urn:btih:N5BLZ6XECNEHHARHJOVQAS4W7TWRXCSI
Had any particular game, caster or community member made waves above and beyond recently?
Twitch - where daily wage workers pay millionaires to get 2 seconds of attention
> A band of professional voice actors improvises, role-plays and rolls their way through a `Dungeon and Dragons' campaign.
A group of professional voice actors who put on a real show every week, with extremely high production quality. A real standout on the list and well deserving of the #1 spot.
A personal favorite moment: https://www.youtube.com/watch?v=Cnl5r3hp1_k
I've always loved the spells in D&D that talk to plants. "You imbue plants within 30 feet of you with limited sentience and animation, giving them the ability to communicate with you and follow your simple commands."
Every casting of the spell is a Flowers For Algernon tragedy, as the plants around you realize they will only be sentient for 10 minutes and then fade back into nothingness.
They did a Kickstarter to turn the first season of the live DnD campaign into an animated show, which finished at over 10 million.
The rights have been bought by Amazon and it will release on Prime.
Sounds like how Record of Lodoss War got started - RPG session gets recorded and it went from there.
Even YouTube allows more nudity then twitch.
So yes, there are girls wearing bikinis and underwear on camera, but that's as far as it goes.
> you cannot have sexual content on twitch
Which is obviously completely, completely false.
Is it really hot in their rooms or are they sex workers?
What actually defines porn? It's hard to say, but you know it when you see it. Spend 5 minutes watching any of the ear lickers on the front page of twitch and make your mind up for yourself. I find it hard to come to the conclusion that it's not porn.
> Even YouTube allows more nudity then twitch.
Nudity alone is not pornographic.
FB is a business making conscious and deliberate decisions and can be called out on it in part because things like this can happen. I mean they just made such a massive goof that they completely took down their own site, other massive sites they owned, and locked their own employees out of their buildings just two days ago for almost a full day. They can certainly screw up and be victim to a leak like this as well.
Thats the sort of high minded thing that WE might do here, but I worry about how this data is going to be weaponised against a whole bunch of people just trying to make a living from things they're passionate about.
I'm not a streamer (yet?) but I kind of see Twitch as this haven for a bunch of people who, until the advent of streaming, didn't really have an outlet, or an easy way to find like minded people, let alone (in some cases) make a living. I used to write off Twitch as a crazy fad that didn't make any sense to me. Then I spent a bit of time on there and realised what an awesome bunch of people (mainly) inhabit that place.
I feel very sorry for anyone caught up in this who goes onto experience some of the inevitable downsides. I can just see morons in the chat on various streams constantly bringing up how much the streamer earns (or doesn't earn) etc.
I've done a tiny bit of streaming myself at some point, and keep meaning to do a bit more. I'll never have any significant following, but it's a cool website. It sucks that's it's gotten out there, but it's too late, it's out.
Might as well satisfy my morbid curiosity of how much some streamers are making on that site, which is about all I'm doing with this data.
We don't publish the names of victim of certain crimes, and they are not widely known even if they are leaked, thus significantly limiting the damage. Information about how to make 'violent things' with easily acquired materials, certain recruiting videos for 'very bad groups' aka ISIS etc. - all of this is out there on some level but because it's actively not propagated, the likelihood of it having an impact is reduced.
We shouldn't be publishing individual's income, or the private source code of normal, legit private groups.
People on HN probably would very much oppose leaking private DMs but transparency on celebrity earnings is not exactly that big of a deal. I'd actually like earnings transparency in general, like it already exists in Sweden.
Given that children's rights on the internet seem to be a hot topic, this might give some of them an idea who they're giving their hard earned money to.
So is source code.