Hacker News Reader

Comment by ljm | Hacker News Reader

Why would an intern at Twitch have access to data in production?

Saying that no 'secrets' were leaked is effectively burying the lede.

In general the broad access was to code repos early on. Some were gated. There’s lots of collaboration and the need to study other code bases for learning and collaboration, read only. It’s micro services galore there so one didn’t tend to have access to production databases for services or systems you didn’t work on. You were opted in there. Teams did their own devops for the most part.

The payout data likely wasn’t ripped from a DB but rather dashboards which customer service or partnerships likely had access to. Tier1 or Tier2 support kinda stuff.

This smells like a stolen backup or maybe network access and http scanning, finding the internal GitHub and maybe a support admin cred that allowed dashboard view.

By secrets, I mean salts, password hashes, etc.

> You also get access to every streamer's dashboard and their analytics

I would classify that as access to production systems.

This statement makes no sense.

The leak includes source code of multiple active websites and applications that are operated under the umbrella of Twitch/Amazon.

Why would an intern have access to this data?

In many companies source code for all products is available to each and single developer.

In what world does all this data in the leak would be stored together in a unified ecosystem? It makes absolutely no sense.

If you're saying that Twitch runs their developer environment in a lousy manner (and you have proof of this), then please go ahead.

But to imply that an intern/average developer would be given access to all this branching information is ignorant.

I have first hand info, and this is how it’s done. Don’t call somebody ignorant if you don’t have first hand info. Leave that for somebody who does.

I think many people are trying to say that in this world at many companies all that data is indeed stored and accessed together.

Maybe the super secure siloed world doesn't really exist outside of military/government organizations.

>Why would an intern have access to this data?

monorepos are a thing at several companies (e.g. Google).

Monorepos can and often do have ACLs per directory.

Why is getting access to prod, or prod data, considered a perk, exactly?

The perk is the wrench UX denoting you are an employee to the community . Reddit/twitch allow employees to communicate with the users . It is a social media platform , being able to indicate that you are special is street cred.

The other access rights that come from staff access is either incedential or miss /debt in architecture.

It's understandable why this is a neat perk, but it also seems absurd when you look at Twitch as an entity owned by a global corporation.

Man oh man, big "No thanks" to a perk like that from me

"Hey, pick through everything I say with a fine-toothed comb and treat it as the official company stance!"

From prior (user) experience, typically staff have non-wrenched alt accounts for just chilling out in streams (with less concern about conduct, but generally tame by twitch standards). But will wrench up for higher profile streams or folks they're otherwise pretty close with personally.

I suspect that's a lot more controlled these days, but it wasn't very uncommon for signified staff to be trolling along with everyone else.

Reply on news.ycombinator.com