>Super paranoid question - I wonder if one of the Mastodon coders poisoned the Mastodon source code in the hopes that Gab would pull and merge the changes? I

>Super paranoid question - I wonder if one of the Mastodon coders poisoned the Mastodon source code in the hopes that Gab would pull and merge the changes? I highly doubt that. It's a fairly large open-source software project, slipping a backdoor into the codebase via a patch wouldn't go unnoticed. The Wikipedia article you linked to states Gab uses a fork of Mastodon. I would lean towards this being a bug introduced in Gab's fork or a patched bug in Mastodon not ported to their fork, assuming that was even the attack vector. The data could just have been exfiltrated directly via their hosting infrastructure and not related to Mastodon at all.