4 ms·
Yeah, those requirements are quite steep for what Parler does. That being said, it is actually incredibly hard to scale any product that sees a sudden massive
by snoshy 6y ago
Yeah, those requirements are quite steep for what Parler does. That being said, it is actually incredibly hard to scale any product that sees a sudden massive influx of users, media attention, and conflict like this. I mean this from a purely technical standpoint.
If your customer base is doubling every few weeks, that's simply not enough time to hire more engineers, onboard them, and get their resources focused on optimizing the stack to improve efficiency. It's also way more realistic to scale up your infrastructure in the short run until you know you've stabilized at a point where you can purchase and operate dedicated hardware to offset the steep margins cloud providers charge.
On top of it all, their product itself seems off-putting to a large portion of tech workers, which would make hiring talented individuals even harder.
- deleted 6y ago[deleted]
- ashtonkem 6y agoAt this point, we actually do know how to scale a social media site though, and if you’re making a new one you should anticipate such exponential growth. It seems they did not set a sufficient foundation for such a possibility, and got caught unprepared.
- snoshy 6y agoFor sure. I shared this in another comment earlier, but they literally were using a free trial of Okta [1] to secure prod. This is why all of their user data got leaked. Their code was written to fail open, so if Okta didn't respond for some reason to auth requests, access was granted by default. [1] https://twitter.com/okta/status/1348191370528256002 https://twitter.com/okta/status/1348191370528256002
- duskwuff 6y agoMy understanding is that that was a myth. The data which was exfiltrated from Parler was retrieved through their mobile API, which allowed for easy enumeration of content and didn't implement some expected access controls (like blocking access to deleted content).
- ashtonkem 6y agoThem using a trial version is not a myth; that is from the official Okta Twitter account. My understanding of the scraped data is that some APIs used both sequential keys, and ignored both permissions and their soft delete flag. It’s not clear to me whether or not that API was permanently unauthenticated, or if it failed open once Okta locked them out.
- duskwuff 6y agoThat API was effectively public by design. It's the same API that anyone using the Parler mobile app would have been accessing.
- tptacek 6y agoThat API --- their most obvious, public API --- appears to have done no authz, despite using sequential identifiers. There are private feeds on Parler. That's clownish. I don't understand why anyone would trust them going forwards.
- ashtonkem 6y agoI don’t understand either, but lots of people appear to be doing lots of things I don’t understand. So I’m going to assume that people will continue us to trust them going forward, even if I think they shouldn’t.
- tptacek 6y agoI don't know what the pill color for this is, but, like, welcome to the desert of the real and all that.