12 ms·

Gab Has Been Breached

217 points by nikbackm 6y ago

bsmith0 6y ago
Wow, it is actually shocking how disgusting the CEO's comments are.
- gkoberger 6y ago
  Yeah, he's the worst. I knew him in YC, and actually liked him. But I watched him spiral as he wasn't able to raise money for his startup, including starting to go to Trump rallies "out of curiosity". His FB posts began to include worse and worse rhetoric. It was crazy to watch him get radicalized in realtime. It ended in him harassing some (minority) YC founders who said they were scared by saying we should "Build the wall". (Edit: His comments were worse than I let on; here's the full context https://techcrunch.com/2016/11/12/pro-trump-ceo-gets-booted-from-y-combinator/ https://techcrunch.com/2016/11/12/pro-trump-ceo-gets-booted-...)
  - konjin 6y ago
    I'm a minority, and I feel really fucking stupid that I have to say that so I don't get banned, but how on earth can anyone get expelled for saying they support the policy of the US government? That is insular to the point of caricature for out of touch democrat staffing aids, not people trying to make money.
    - gkoberger 6y ago
      Sorry, that's my fault, I'm going to edit my comment. I downplayed what he said. Here's the full comments: https://techcrunch.com/2016/11/12/pro-trump-ceo-gets-booted-from-y-combinator/ https://techcrunch.com/2016/11/12/pro-trump-ceo-gets-booted-...
      - konjin 6y ago
        Ok, I can see why you'd get expelled over that.
    - kyrra 6y ago
      .
      - konjin 6y ago
        That isn't anger, it's genuine incredulity.
    - akhilcacharya 6y ago
      As someone that is also a minority, I'm both aware and heartbroken that it became a very popular form of bullying towards children after 2015 [0]. Racist bullying isn't new of course, but this particular phrase is fairly new. [0] https://www.washingtonpost.com/graphics/2020/local/school-bullying-trump-words/ https://www.washingtonpost.com/graphics/2020/local/school-bu...
    - calciphus 6y ago
      Private groups don't have to swear fealty to the government. Individuals are allowed and encouraged to dissent, form groups of dissention, and don't owe it to anyone to grant them access to that group. Regardless of one's personal politics, insisting "if the government says it's ok, you shouldn't be allowed to reject someone who supports it" isn't really in line with the core ideals of the US, where YC is organized.
      - konjin 6y ago
        Alienating 50% of customers, and lets be honest these are the stupider customers you can more easily monetize, is not a good move for anyone trying to make money, which is the point of a startup. A well thought out Gab that was politically neutral will be able to steal the most engaged facebook users and then then sell them gold, guns and bibles, or whatever else those folks enjoy in their spare time. This isn't an issue of morals, it's an issue of money.
        deleted 6y ago
        [deleted]
    - 8note 6y ago
      Not everyone agrees with the policies of the US government, including private businessess
    - s5300 6y ago
      Getting into the realm of Reddit tier comments in replying to this... But in a genuine attempt to clear you up - The people who made Nazi Germany a thing were "just citizens of Germany supporting the policy of the German government." Institutions, such as YC, typically tend to have a set of morals/guidelines that they follow (and usually clearly state) If it so happens that a policy of the US government goes against said morals/guidelines and you're in support of them... as what most see as a pretty important part of being in the US, they're free to give you the boot from their institution. If they who be booted perceive their bootening as something that is illegal, they're also free to sue. Whether or not that lawsuit is credible/goes anywhere is up to a judiciary.
    - skissane 6y ago
      According to Techcrunch [0]: > Torba had also tweeted a screenshot of another founder’s Facebook comment (the founder’s name was removed) that “being a black, Muslim or woman in the USA is going to be very scary” with his own comment: “Build the wall.” Then, in another thread, a YC alum alluded to Torba’s behavior without mentioning him by name, prompting him to jump in: “Say my name when you talk about me, coward. Build the wall.” He wasn't just publicly supporting Trump's border wall policy, he was doing it in an assholeish way, and directing that towards other YC founders. If he'd cut out the assholeish manner and the direction towards fellow founders, and just kept the publicly supporting Trump's policies part, I doubt YC would have responded in the same manner. That's consistent with Kat Manalac's email quoted in the same article – he was banned for behaving in a hostile way, not purely for his political beliefs. [0] https://techcrunch.com/2016/11/12/pro-trump-ceo-gets-booted-from-y-combinator/ https://techcrunch.com/2016/11/12/pro-trump-ceo-gets-booted-...
    - ben_w 6y ago
      Replying to both your nearly invisible comments: On the one hand, yes, selling things to people is the point. On the other hand, one does not need to be an ass to one group just to get trade from another. Tim Cook was part of the big tech group that used to meet with Trump, yet managed to maintain corporate policies that are (from my non American POV) stereotypical of the American left.
  - totalZero 6y ago
    He got expelled from YC for saying we should build a border wall? Really?
    - gkoberger 6y ago
      I edited my comment. The full quotes are much worse. Here's the details: https://techcrunch.com/2016/11/12/pro-trump-ceo-gets-booted-from-y-combinator/ https://techcrunch.com/2016/11/12/pro-trump-ceo-gets-booted-...
      - totalZero 6y ago
        Thanks, and wow... he sounds like a perpetual drain on the energy and sanity of all of the people around him.
        dillondoyle 6y ago
        The stuff he is tweeting from the official Gab twitter is truly hellishly insane ! "As per my policy of not communicating with non-Christian and/or communist journos, I will not be replying to this non-story. " https://twitter.com/getongab/status/1366954798524887042 https://twitter.com/getongab/status/1366954798524887042
        zz_throwaway_zz 6y ago
        He's right though..
        gkoberger 6y ago
        Just for context, the situation being referenced here is that Gab claims Donald Trump is verified on the platform but the address associated with the account is really the CEO's email (Kuhcoon was his YC company).
        refurb 6y ago
        Maybe I'm missing some context, but what about that Tweet was disgusting versus just trashy or in poor taste? Compared to some of the crap on Twitter it's pretty tame.
  - antupis 6y ago
    It is like modern day version of Hitler did not getting in art school.
    - ALittleLight 6y ago
      Except he did get into YC and he's not a genocidal dictator so much as an angry and inappropriate person online.
      - atoav 6y ago
        As both an former art student and Austrian living in Germany I don't think it is forbidden to think about how Hitler became Hitler. Because for some time of his life Hitler was just some angry guy until he turned to a fully fledged genozidal fascist dictator. Hitlers antisemitism was partly created by his rejection in the viennese academy and his hurt ego made him want to pay them back for the rest of his life. Why should forbid ourselves from talking about that psychological mechanism? Because Hitler is not seen as a human but a demon? Because accepting Hitler as a human would mean this could happen again, with us in the role of the baddies? When your main reaction to personal rejection is to search for a scapegoat, because you can't handle it otherwise you are going down a similar path. Surely most will calm down on the way, surely most will not do so in a political and historical environment that allows them to become violent or even genocidal, but why not talk about it?
        ALittleLight 6y ago
        There are many, many, more people who blamed scapegoats or were angry than became Hitler or Hitler-like figures. Likening Torba to Hitler because both of them are angry is an extreme and unproductive association. I think it's enough to say "You should treat people with respect" or "You shouldn't say that Mr. Torba", or even "Andrew Torba is a racist/transphobe/etc" without having to liken him to Hitler. Hitler didn't switch from angry guy to legitimate problem overnight. He did things like forming a political party replete with armed forces and attempting a coup. I don't think building a mostly-failed Twitter clone is comparable.
  - minimaxir 6y ago
    HN thread from 2016 on Torba getting booted: https://news.ycombinator.com/item?id=12934388 https://news.ycombinator.com/item?id=12934388 Includes comments from Sam Altman and Torba, posting as rvcamo
    - hluska 6y ago
      That's an interesting thread as Fosco got involved too. https://news.ycombinator.com/item?id=12935057 https://news.ycombinator.com/item?id=12935057
      - minimaxir 6y ago
        Note that Fosco was not Gab’s CTO until recently, which makes his appearance in that thread a funny coincidence.
        hluska 6y ago
        I found it quite fascinating how similar their ideas were in that thread but I'm interested in how people are converted into extremist movements.
    - shinsheel 6y ago
      I really hate how Sam didn't respond on the first objection about double standards when other founders openly sexually harassed women on the streets and got nothing for that. Like...what, commentator just made it all up and nobody noticed? Or it actually happened and Sam doesn't have even the minimal plausible excuse?
      - TeMPOraL 6y ago
        On a surface read, the author of the second objection may have not realized that prank videos are made with actors, not unsuspecting strangers.
    - weeblewobble 6y ago
      This thread is really eye-opening about how stagnant the discourse around free speech/wokeness/political correctness has been. Four years later and the conversation would be exactly the same today.
  - tibbydudeza 6y ago
    He really drunk the kool-aid becoming part of the cult. It is not everyday you see the CEO of a company saying "Gab Does Not Negotiate With Criminal Demons".
    - smaryjerry 6y ago
      It is a strange use of language so it would be interesting to see what he defines a demon as. If he has said “Gab does not negotiate with evil people” no one would have cared but saying demon criminals brings forth images of horned beings we all see in fantasy movies, perhaps that’s the imagery he was going for.
  - stjohnswarts 6y ago
    Someone got freaked out because he said "build the wall"? Oh come on, I think its a magnanimous monument to stupidity but surely someone wouldn't actually be -afraid- after hearing that. Anger, resentment, disgust I understand. However being afraid of these people is ridiculous. Thanks for the article! Edit: read the article. YC threw him out because he was harassing people, not because he was conservative or threatened anyone. Obviously you have to be respectful and tolerant in a group like YC regardless of your political leanings. I see why he got the boot, his comments were hot garbage.
- steve_adams_86 6y ago
  Perhaps ironically his comments strike me as those of someone mentally ill. They make me feel sorry for him.
  - walrus01 6y ago
    It's a severe disservice to non-bigoted, non-toxic people who struggle with a myriad of mental health issues to reduce a description of that specific person to "he must be mentally ill". Though undoubtedly it's entirely possible to be a cancerous individual and also have mental health issues simultaneously.
    - kkielhofner 6y ago
      One of the wisest things I ever heard from a mental health professional: "There's a normal range of asshole, beyond that, it's mental illness" There is an entire range of diagnosable mental illnesses, below that there are entire clusters of personality disorders that don't quite raise to the diagnosis of the others. When it comes to personality disorders, especially, the current consensus of the psychiatric community (for better or worse) is that they're made and formed in childhood. Essentially, many of these people are acting out things that were done to them; quite possibly through no fault of their own in their early development. Of course the results of their unacceptable behavior is what it is but there is some credence to the theory that these people are suffering in their own right. We're miserable just digesting their thoughts one tweet at a time. Meanwhile they walk around with that all day everyday.
      - fastball 6y ago
        Also worth pointing out that the diagnoses are just things we made up.
        steve_adams_86 6y ago
        You’re getting downvoted but I think this actually is worth considering. It doesn’t devalue diagnoses. These categories and labels are to some degree arbitrary, and the underlying conditions are often very elastic and amorphous. The categories and labels are very helpful in some ways, but it’s unhelpful to rely on them exclusively to inform yourself if someone is having mental issues or not. I’m not sure if this is what you were touching on or not.
- bgravinz 6y ago
  What part do you find disgusting?
  - zz_throwaway_zz 6y ago
    Presumably the demonic trannies part. Unfortunately he's not wrong...
    - hluska 6y ago
      Are you completely tone deaf, of below average intelligence or are you really this much of a bigot?
      - throwoutttt 6y ago
        Are you really in that much of a bubble reality
        hluska 6y ago
        What? A bubble reality where we're all worthy of love, respect and the right to be our most authentic selves? If that's how you define a bubble reality, yes I am. Thank you!
        dang 6y ago
        Would you please stop creating accounts to break HN's guidelines with? Obviously we have to ban such accounts. Continuing down this path will get your ban account banned as well, so please don't. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
  - akhilcacharya 6y ago
    This part, linked here - https://news.ycombinator.com/item?id=26339446 https://news.ycombinator.com/item?id=26339446
- walrus01 6y ago
  Make shunning of bigots great again.
- vixen99 6y ago
  We know you're shocked but might you not have provided at least one comment (the worst, say) as a an example? On a scale of human actions from 1 to 10, how disgusting?
gkoberger 6y ago
There's been lots of previous discussion, such as: https://news.ycombinator.com/item?id=26319649 https://news.ycombinator.com/item?id=26319649 I'm not surprised. Parler and Gab were just thrown together, and made themselves hugely attractive sites to attack.
encryptluks2 6y ago
Gab is a joke. I got banned for making a post asking how are all the domestic terrorists Trump supporters doing after the capitol riot. I guess that is ban-worthy on their free speech network while advocating for assassinating public officials is a-ok.
- jb775 6y ago
  I bet it felt good to create an account for a website just so you could log in and say "how are all the domestic terrorists Trump supporters doing after the capitol riot?". That's pretty much the online equivalent of peeling-out in your car and thinking it made you look awesome.
  - spamizbad 6y ago
    True but it’s also free speech and as such should be permitted on a social network oriented around free speech. Unless trolling doesn’t count as free speech?
    - gfosco 6y ago
      With that definition, would you think unlimited spam is also ok? Most likely you got reported by the community and picked up by the same sort of algorithm that exists on every other platform.
      - twooster 6y ago
        Was that comment spam, or just snark? But I guess bigotry is okay. Free speech platform so long as it doesn't step on any in-group toes.
      - deleted 6y ago
        [deleted]
      - encryptluks2 6y ago
        Spam would indicate some type of repetitious behavior, or unwanted advertisement. A single snarky comment generally wouldn't be considered spam. Every other platform would be fine with the comment.
choppaface 6y ago
Not only that but their CTO has violated the license of Mastadon https://arstechnica.com/gadgets/2021/03/rookie-coding-mistake-prior-to-gab-hack-came-from-sites-cto/ https://arstechnica.com/gadgets/2021/03/rookie-coding-mistak...
- deleted 6y ago
  [deleted]
pope_meat 6y ago
I'm very tired and for a moment I read it as: "God Has Been Breached" First RSA falls, now god, what's next.
- burundi_coffee 6y ago
  RSA is dead. RSA remains dead. And we have killed it. How shall we comfort ourselves, the murderers of all murderers? What was holiest and mightiest of all that the world has yet owned has bled to death under our knives: who will wipe this blood off us? What water is there for us to clean ourselves? What festivals of atonement, what sacred games shall we have to invent? Is not the greatness of this deed too great for us?
  - kps 6y ago
    God made the integers; factoring them is the work of man.
- walrus01 6y ago
  If one were to posit that we are in fact living in a simulation of some sort, breaching god would probably look something like a method to gain host bare-metal memory access or code to escape from a virtual machine.
HNfriend234 6y ago
I use gab quite frequently but mainly for the memes and jokes. The vast majority of people on there use pseudonymous aliases anyways so no one cares if the site gets hacked. People on the right-wing have also been subject to extensive persecution (harassment, doxing etc.) from the left-wing so we're all quite used to it by now. I'm been trying to teach as many people as possible about how to stay anonymous online, how to use high-privacy tools and why using technologies like monero is extremely important.
- Pfhreak 6y ago
  Do you think the average user, whose passwords are things like "password", used an email address that couldn't be tied to then to sign up? Because my guess is that a whole bunch of people do very much care that the stuff they wrote on gab can be traced back to the email account they use everywhere. >> extensive persecution from the left-wing Check your biases if you think this is somehow a one directional concern.
- zz_throwaway_zz 6y ago
  Ironic this is the lowest rated comment in the thread. Conservatives are the new untermensch in this dystopian technocracy.
- Clewza313 6y ago
  They're not pseudonymous anymore if their email addresses got leaked, which seems to have happened.
mberning 6y ago
It seems like the author cares about the politics and religion of the Gab founder quite a lot, despite his assertions to the contrary. If you strip away all that it is still a very embarrassing breach. Having a data exfiltration of that magnitude is simply devastating.
- Pfhreak 6y ago
  What quotes lead you to that conclusion? How much of the overall article is dedicated to them? His article felt quite objective in tone.
- HNfriend234 6y ago
  No one using the platform even cares. Everyone on the platform just shares memes and jokes anyways. The people using gab aren't stupid like the people who use facebook where they put all their personal information out in the open for all to see.
bmarquez 6y ago
> There's also the risk of incorrectly assuming that a presence in the breach implies your views have some degree of alignment with those regularly expressed on the site, yet clearly based on the presence of my own email address, that assumption is incorrect. I've seen comments elsewhere saying something to the effect of "Gab is just a bunch of right-wing terrorists, who cares if their personal info gets hacked" There are plenty of everyday people who have Gab accounts, some just wanted to reserve their username, others (like Troy Hunt) don't post about politics, others were just checking it out and haven't posted anything. It would suck if their info was leaked and they started getting spammed even though they have no connection to illegal activity. Fortunately Troy took steps to limit searching for email addresses, I hope others with full access are just as cautious.
- HNfriend234 6y ago
  Ironically enough, I saw someone make a post on another site I read where they were saying in order to exploit cancel culture and doxing, they were working on a bot that would scrape public data from facebook profiles (mainly the name and profile picture) and then have that bot cross create the account on gab and parler. Then the bot would go and repost content from the site and add comments. The idea is that other people would come to the website looking to doxx people or harass people but the reality is the people they would be trying to harass are just fake profiles that the individual person never actually made. It is kind of interesting to think about because if you go on facebook, you can see lots of people using their real facial picture and real first name, last name and the people doing the doxing/harassments don't really put much thought into how that profile account was created.
  - vmception 6y ago
    I pollute alot of data for alot of people Dont let your dreams be dreams
    - logicchains 6y ago
      > I pollute alot of data for alot of people Ah, you must be a fellow C++ programmer.
dt3ft 6y ago
If you just want to know how the breach[1] happened: it was SQL injection, where string interpolation was used to construct a query, rather than use parametrized queries. [1] https://arstechnica.com/gadgets/2021/03/rookie-coding-mistake-prior-to-gab-hack-came-from-sites-cto/ https://arstechnica.com/gadgets/2021/03/rookie-coding-mistak...
- stanrivers 6y ago
  Niiiiice
- walrus01 6y ago
  drop table fash;
- Intermernet 6y ago
  Little Jimmy Tables strikes again.
  - _muff1nman_ 6y ago
    I believe Bobby Tables is the more well known name: https://xkcd.com/327/ https://xkcd.com/327/
    - gibolt 6y ago
      Must have been changed via SQL injection
      - dmje 6y ago
        upvote
        dmje 6y ago
        What? I said I'd upvoted the parent comment because I thought it was funny and I get downvoted? Wtf, sometimes I just don't get HN :-/
millstone 6y ago
It doesn't seem right that the big players like Facebook and Twitter enjoy much better security. Is there really no open source offering that just gets this stuff right? A Twitter-in-a-box, like WordPress is a blog-in-a-box, but secure this time? Apparently Gab used Mastodon. Is Mastodon intrinsically hard to secure?
- EtherTyper 6y ago
  No, we can't conclude that yet. Gab modified their instance heavily from Mastodon code over several years. People are also pointing to an addition made by Gab, where an SQL query is used without input sanitization, as a possible culprit for the breach.
- yborg 6y ago
  This had nothing to do with the Mastodon code, Gab has made a big deal about all the "improvements" they've made.
- input_sh 6y ago
  SQL injection that was used for the breach was introduced after the fork. We know that for sure because the source code was public, as is required by AGPL Mastodon uses. Specifically, this was the commit (from a mirror of the repository): https://git.rip/gab/gab-social/-/commit/6e42e3b1eca73c306db1580719a3a1bfb715f6d8 https://git.rip/gab/gab-social/-/commit/6e42e3b1eca73c306db1...
deleted 6y ago
[deleted]
wyoh 6y ago
Welp, time to change my passwords I guess.
m8s 6y ago
This is a pretty non-political rundown from Troy, and a great read as always. It's not always easy to find trustworthy people, but he's one of them. If anyone is offended by supposed political leanings in this article, I'd suggest separating Torba's political views from his words. Blaming a data breach on "mentally ill tranny demon hackers" (his words, not mine) is not a sane or rational thought. The most realistic scenario is that he knows exactly what he's saying and is doing so simply to rile up fanatics, because otherwise he actually believes that and should be in an institution. I'm not sure which one is worse.
- a_bonobo 6y ago
  >The most realistic scenario is that he knows exactly what he's saying and is doing so simply to rile up fanatics, I don't know, if there's one thing I've learned from Q-anon and other modern cultists is that they are who they tell you they are. There's no need for mental gymnastics on our part to explain awful behaviour away.
  - walrus01 6y ago
    It's sometimes hard to tell the difference between the grifters who are parroting the qanon lingo in some sort of short term attempt to make a buck or gain a following, and the true believers. In the end, if it causes the same effects by poisoning rational public discourse, does it matter whether somebody is cosplaying as a qanon believer or not?
  - mattigames 6y ago
    On the other hand it was revealed from a 2019 video that Alex Jones hates Trump, while publicly pretending to love the guy to appeal to it's target audience; my guess is that he does believe a few of the nonsense claims he makes on his show but not all; but like the sibling comment says the difference may not matter at all.
- spurgu 6y ago
  > Blaming a data breach on "mentally ill tranny demon hackers" (his words, not mine) is not a sane or rational thought. I still think it's overly sensitive to get caught up on it. People say a lot of things when they're in distress, or angry - so what. Grow some skin (I would say balls but someone might get offended :rolleyes: (oops I forgot I might offend people without skin)).
throwaway4good 6y ago
So what was Trump's password? (Or at least a hash of it.)
- ttt0 6y ago
  Trump wasn't on gab.
- wyoh 6y ago
  It was never Trump's account, only a placeholder they mad in the eventuality that Trump join the platform.
juicyjuicytemp 6y ago
Some bit of gossip about the CTO of Gab, seeing as how I've got a bit of context. (Throwaway, for obvious reasons.) The CTO was never a software engineer. They were a developer advocate so had some interaction with code, but was more of a "talk to developers using things and make sure the requirements were passed along to the dev team" sort of guy, rather than someone that knew his technical details (beyond say, the thing he was actively working on) inside and out. Fosco started out pretty reasonable. When Trump was first elected, he did a "talk to a conservative" series, and while there was the expected disagreement, it was a pretty, civil, positive, well-received olive branch overall. However, like a lot of right-leaning folks in the Trump era, he became more extreme as time went on. I had some reasonably close interactions with Fosco (not going to go into details with how), but it was being kind of clear that he had started to buy into the "Fox News caricature of what someone on the left is like" — to the point of putting words into the very people's mouths he'd so civilly made a point of talking to prior — and surrounding himself with like-minded folks. For all the talk of "diversity" that he had (and indeed, initially fostered!) he became pretty much the sort of caricature, albeit one of the opposite side of the spectrum, that he was deriding. In that sense, while there's a lot of holier-than-thou and disgust that the whole Gab situation prompts, I feel pity and sadness more than anything else. Fosco was a decent guy at one point, but even decent people can end up in their own echo chambers. It's unfortunate to see the state that he's in now.
- gfosco 6y ago
  You know pretty much nothing about me, unsurprisingly. I certainly don't need your pity, lol, this last year has been one of the best.
  - juicyjuicytemp 6y ago
    And the fact that you feel like this year's one of the best for you is exactly why you deserve the pity... The perceived support of a community is addictive. Hope you'll realize at some point what you're giving up to feed that addiction.
  - juicyjuicytemp 6y ago
neotranzi 6y ago
For someone who opens with "I only care about the data", at least half of the "analysis" is about politics, including the links tweets which range from his opinions on whether you can change your gender, to categorizing gab users as "neo-nazis". All I see are a bunch of people allying with big tech to crush their competitors while using absurdly hypocritical morals as their reason. This is the same big tech that uses slave labour while plastering their websites with BLM slogans.
ALittleLight 6y ago
Seems like the author is implying but not directly saying the hashed passwords were not salted. Am I reading that right, and does anyone know if they were salted?
- estreeper 6y ago
  The string output from the bcrypt function always contains a 22-character salt embedded within it, so these are salted. This is placed after an initial algorithm identifier (i.e. $2a$) and an adjustable cost used to generate the output string (i.e. 10$). There's an overview of the structure of the output string here if you're interested: https://en.wikipedia.org/wiki/Bcrypt https://en.wikipedia.org/wiki/Bcrypt However, if your password is "password" or another very common password, then someone can just try those with the embedded salt and still find out that was your password.
  - ALittleLight 6y ago
    Very interesting - thanks. You'd still have to crack each password individually though, right? i.e. for row 1 I would need to try X passwords from my password dictionary, and for each of the attempts bcrypt the guess with the given salt and check to see if worked, and then repeat that for each row individually, rather than checking every row simultaneously.
    - caf 6y ago
      Right, you have to check each row separately.
roenxi 6y ago
Troy has a fair take. Ultimately the Gab breach is interesting, good material for an analysis like this one, and won't matter particularly in the future. At a guess, the people on Gab are there because they feel like they are under sustained political attack. This breach will be interpreted as further evidence that they are under sustained political attack. It won't make anyone behave differently - although I hope Gab hires a security expert.
- chroem- 6y ago
  > the people on Gab are there because they feel like they are under sustained political attack I mean aren't they? I don't see another intellectually honest way of framing this. And yes, I'm aware: Popper's paradox, fighting fascism, etc., etc.
  - quantified 6y ago
    Thanks for mentioning Popper’s paradox, I looked it up just now and its scenario has been on my mind for a long time. Now I can just refer to it, in a fashion like Dunning-Kruger.
    - leereeves 6y ago
      Popper is often misunderstood. He was a passionate advocate of free speech and rational argument; when he said "intolerance" he was referring to people who would use violence to suppress free speech: > for it may easily turn out that they are not prepared to meet us on the level of rational argument, but begin by denouncing all argument; they may forbid their followers to listen to rational argument, because it is deceptive, and teach them to answer arguments by the use of their fists or pistols. And even while explaining the paradox, he expressed his opposition to censorship in general: > I do not imply, for instance, that we should always suppress the utterance of intolerant philosophies; as long as we can counter them by rational argument and keep them in check by public opinion, suppression would certainly be most unwise. https://en.wikipedia.org/wiki/Paradox_of_tolerance#Discussions https://en.wikipedia.org/wiki/Paradox_of_tolerance#Discussio...
dang 6y ago
Recent threads on this: Gab has been hacked and 70GB of data leaked - https://news.ycombinator.com/item?id=26309925 https://news.ycombinator.com/item?id=26309925 - March 2021 (744 comments) Rookie coding mistake prior to Gab hack came from site’s CTO - https://news.ycombinator.com/item?id=26319649 https://news.ycombinator.com/item?id=26319649 - March 2021 (312 comments)
stjohnswarts 6y ago
It really couldn't have happened to a nicer web site. I wouldn't care if the anonymous crowd declared open warfare on it.

217 points by nikbackm 6y ago

bsmith0 6y ago

Wow, it is actually shocking how disgusting the CEO's comments are.

gkoberger 6y ago
Yeah, he's the worst. I knew him in YC, and actually liked him. But I watched him spiral as he wasn't able to raise money for his startup, including starting to go to Trump rallies "out of curiosity". His FB posts began to include worse and worse rhetoric. It was crazy to watch him get radicalized in realtime. It ended in him harassing some (minority) YC founders who said they were scared by saying we should "Build the wall". (Edit: His comments were worse than I let on; here's the full context https://techcrunch.com/2016/11/12/pro-trump-ceo-gets-booted-from-y-combinator/ https://techcrunch.com/2016/11/12/pro-trump-ceo-gets-booted-...)
- konjin 6y ago
  I'm a minority, and I feel really fucking stupid that I have to say that so I don't get banned, but how on earth can anyone get expelled for saying they support the policy of the US government? That is insular to the point of caricature for out of touch democrat staffing aids, not people trying to make money.
  - gkoberger 6y ago
    Sorry, that's my fault, I'm going to edit my comment. I downplayed what he said. Here's the full comments: https://techcrunch.com/2016/11/12/pro-trump-ceo-gets-booted-from-y-combinator/ https://techcrunch.com/2016/11/12/pro-trump-ceo-gets-booted-...
    - konjin 6y ago
      Ok, I can see why you'd get expelled over that.
  - kyrra 6y ago
    .
    - konjin 6y ago
      That isn't anger, it's genuine incredulity.
  - akhilcacharya 6y ago
    As someone that is also a minority, I'm both aware and heartbroken that it became a very popular form of bullying towards children after 2015 [0]. Racist bullying isn't new of course, but this particular phrase is fairly new. [0] https://www.washingtonpost.com/graphics/2020/local/school-bullying-trump-words/ https://www.washingtonpost.com/graphics/2020/local/school-bu...
  - calciphus 6y ago
    Private groups don't have to swear fealty to the government. Individuals are allowed and encouraged to dissent, form groups of dissention, and don't owe it to anyone to grant them access to that group. Regardless of one's personal politics, insisting "if the government says it's ok, you shouldn't be allowed to reject someone who supports it" isn't really in line with the core ideals of the US, where YC is organized.
    - konjin 6y ago
      Alienating 50% of customers, and lets be honest these are the stupider customers you can more easily monetize, is not a good move for anyone trying to make money, which is the point of a startup. A well thought out Gab that was politically neutral will be able to steal the most engaged facebook users and then then sell them gold, guns and bibles, or whatever else those folks enjoy in their spare time. This isn't an issue of morals, it's an issue of money.
      - deleted 6y ago
        [deleted]
  - 8note 6y ago
    Not everyone agrees with the policies of the US government, including private businessess
  - s5300 6y ago
    Getting into the realm of Reddit tier comments in replying to this... But in a genuine attempt to clear you up - The people who made Nazi Germany a thing were "just citizens of Germany supporting the policy of the German government." Institutions, such as YC, typically tend to have a set of morals/guidelines that they follow (and usually clearly state) If it so happens that a policy of the US government goes against said morals/guidelines and you're in support of them... as what most see as a pretty important part of being in the US, they're free to give you the boot from their institution. If they who be booted perceive their bootening as something that is illegal, they're also free to sue. Whether or not that lawsuit is credible/goes anywhere is up to a judiciary.
  - skissane 6y ago
    According to Techcrunch [0]: > Torba had also tweeted a screenshot of another founder’s Facebook comment (the founder’s name was removed) that “being a black, Muslim or woman in the USA is going to be very scary” with his own comment: “Build the wall.” Then, in another thread, a YC alum alluded to Torba’s behavior without mentioning him by name, prompting him to jump in: “Say my name when you talk about me, coward. Build the wall.” He wasn't just publicly supporting Trump's border wall policy, he was doing it in an assholeish way, and directing that towards other YC founders. If he'd cut out the assholeish manner and the direction towards fellow founders, and just kept the publicly supporting Trump's policies part, I doubt YC would have responded in the same manner. That's consistent with Kat Manalac's email quoted in the same article – he was banned for behaving in a hostile way, not purely for his political beliefs. [0] https://techcrunch.com/2016/11/12/pro-trump-ceo-gets-booted-from-y-combinator/ https://techcrunch.com/2016/11/12/pro-trump-ceo-gets-booted-...
  - ben_w 6y ago
    Replying to both your nearly invisible comments: On the one hand, yes, selling things to people is the point. On the other hand, one does not need to be an ass to one group just to get trade from another. Tim Cook was part of the big tech group that used to meet with Trump, yet managed to maintain corporate policies that are (from my non American POV) stereotypical of the American left.
- totalZero 6y ago
  He got expelled from YC for saying we should build a border wall? Really?
  - gkoberger 6y ago
    I edited my comment. The full quotes are much worse. Here's the details: https://techcrunch.com/2016/11/12/pro-trump-ceo-gets-booted-from-y-combinator/ https://techcrunch.com/2016/11/12/pro-trump-ceo-gets-booted-...
    - totalZero 6y ago
      Thanks, and wow... he sounds like a perpetual drain on the energy and sanity of all of the people around him.
      - dillondoyle 6y ago
        The stuff he is tweeting from the official Gab twitter is truly hellishly insane ! "As per my policy of not communicating with non-Christian and/or communist journos, I will not be replying to this non-story. " https://twitter.com/getongab/status/1366954798524887042 https://twitter.com/getongab/status/1366954798524887042
        zz_throwaway_zz 6y ago
        He's right though..
        gkoberger 6y ago
        Just for context, the situation being referenced here is that Gab claims Donald Trump is verified on the platform but the address associated with the account is really the CEO's email (Kuhcoon was his YC company).
        refurb 6y ago
        Maybe I'm missing some context, but what about that Tweet was disgusting versus just trashy or in poor taste? Compared to some of the crap on Twitter it's pretty tame.
- antupis 6y ago
  It is like modern day version of Hitler did not getting in art school.
  - ALittleLight 6y ago
    Except he did get into YC and he's not a genocidal dictator so much as an angry and inappropriate person online.
    - atoav 6y ago
      As both an former art student and Austrian living in Germany I don't think it is forbidden to think about how Hitler became Hitler. Because for some time of his life Hitler was just some angry guy until he turned to a fully fledged genozidal fascist dictator. Hitlers antisemitism was partly created by his rejection in the viennese academy and his hurt ego made him want to pay them back for the rest of his life. Why should forbid ourselves from talking about that psychological mechanism? Because Hitler is not seen as a human but a demon? Because accepting Hitler as a human would mean this could happen again, with us in the role of the baddies? When your main reaction to personal rejection is to search for a scapegoat, because you can't handle it otherwise you are going down a similar path. Surely most will calm down on the way, surely most will not do so in a political and historical environment that allows them to become violent or even genocidal, but why not talk about it?
      - ALittleLight 6y ago
        There are many, many, more people who blamed scapegoats or were angry than became Hitler or Hitler-like figures. Likening Torba to Hitler because both of them are angry is an extreme and unproductive association. I think it's enough to say "You should treat people with respect" or "You shouldn't say that Mr. Torba", or even "Andrew Torba is a racist/transphobe/etc" without having to liken him to Hitler. Hitler didn't switch from angry guy to legitimate problem overnight. He did things like forming a political party replete with armed forces and attempting a coup. I don't think building a mostly-failed Twitter clone is comparable.
- minimaxir 6y ago
  HN thread from 2016 on Torba getting booted: https://news.ycombinator.com/item?id=12934388 https://news.ycombinator.com/item?id=12934388 Includes comments from Sam Altman and Torba, posting as rvcamo
  - hluska 6y ago
    That's an interesting thread as Fosco got involved too. https://news.ycombinator.com/item?id=12935057 https://news.ycombinator.com/item?id=12935057
    - minimaxir 6y ago
      Note that Fosco was not Gab’s CTO until recently, which makes his appearance in that thread a funny coincidence.
      - hluska 6y ago
        I found it quite fascinating how similar their ideas were in that thread but I'm interested in how people are converted into extremist movements.
  - shinsheel 6y ago
    I really hate how Sam didn't respond on the first objection about double standards when other founders openly sexually harassed women on the streets and got nothing for that. Like...what, commentator just made it all up and nobody noticed? Or it actually happened and Sam doesn't have even the minimal plausible excuse?
    - TeMPOraL 6y ago
      On a surface read, the author of the second objection may have not realized that prank videos are made with actors, not unsuspecting strangers.
  - weeblewobble 6y ago
    This thread is really eye-opening about how stagnant the discourse around free speech/wokeness/political correctness has been. Four years later and the conversation would be exactly the same today.
- tibbydudeza 6y ago
  He really drunk the kool-aid becoming part of the cult. It is not everyday you see the CEO of a company saying "Gab Does Not Negotiate With Criminal Demons".
  - smaryjerry 6y ago
    It is a strange use of language so it would be interesting to see what he defines a demon as. If he has said “Gab does not negotiate with evil people” no one would have cared but saying demon criminals brings forth images of horned beings we all see in fantasy movies, perhaps that’s the imagery he was going for.
- stjohnswarts 6y ago
  Someone got freaked out because he said "build the wall"? Oh come on, I think its a magnanimous monument to stupidity but surely someone wouldn't actually be -afraid- after hearing that. Anger, resentment, disgust I understand. However being afraid of these people is ridiculous. Thanks for the article! Edit: read the article. YC threw him out because he was harassing people, not because he was conservative or threatened anyone. Obviously you have to be respectful and tolerant in a group like YC regardless of your political leanings. I see why he got the boot, his comments were hot garbage.
steve_adams_86 6y ago
Perhaps ironically his comments strike me as those of someone mentally ill. They make me feel sorry for him.
- walrus01 6y ago
  It's a severe disservice to non-bigoted, non-toxic people who struggle with a myriad of mental health issues to reduce a description of that specific person to "he must be mentally ill". Though undoubtedly it's entirely possible to be a cancerous individual and also have mental health issues simultaneously.
  - kkielhofner 6y ago
    One of the wisest things I ever heard from a mental health professional: "There's a normal range of asshole, beyond that, it's mental illness" There is an entire range of diagnosable mental illnesses, below that there are entire clusters of personality disorders that don't quite raise to the diagnosis of the others. When it comes to personality disorders, especially, the current consensus of the psychiatric community (for better or worse) is that they're made and formed in childhood. Essentially, many of these people are acting out things that were done to them; quite possibly through no fault of their own in their early development. Of course the results of their unacceptable behavior is what it is but there is some credence to the theory that these people are suffering in their own right. We're miserable just digesting their thoughts one tweet at a time. Meanwhile they walk around with that all day everyday.
    - fastball 6y ago
      Also worth pointing out that the diagnoses are just things we made up.
      - steve_adams_86 6y ago
        You’re getting downvoted but I think this actually is worth considering. It doesn’t devalue diagnoses. These categories and labels are to some degree arbitrary, and the underlying conditions are often very elastic and amorphous. The categories and labels are very helpful in some ways, but it’s unhelpful to rely on them exclusively to inform yourself if someone is having mental issues or not. I’m not sure if this is what you were touching on or not.
bgravinz 6y ago
What part do you find disgusting?
- zz_throwaway_zz 6y ago
  Presumably the demonic trannies part. Unfortunately he's not wrong...
  - hluska 6y ago
    Are you completely tone deaf, of below average intelligence or are you really this much of a bigot?
    - throwoutttt 6y ago
      Are you really in that much of a bubble reality
      - hluska 6y ago
        What? A bubble reality where we're all worthy of love, respect and the right to be our most authentic selves? If that's how you define a bubble reality, yes I am. Thank you!
      - dang 6y ago
        Would you please stop creating accounts to break HN's guidelines with? Obviously we have to ban such accounts. Continuing down this path will get your ban account banned as well, so please don't. If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.
- akhilcacharya 6y ago
  This part, linked here - https://news.ycombinator.com/item?id=26339446 https://news.ycombinator.com/item?id=26339446
walrus01 6y ago
Make shunning of bigots great again.
vixen99 6y ago
We know you're shocked but might you not have provided at least one comment (the worst, say) as a an example? On a scale of human actions from 1 to 10, how disgusting?

gkoberger 6y ago

There's been lots of previous discussion, such as: https://news.ycombinator.com/item?id=26319649 https://news.ycombinator.com/item?id=26319649 I'm not surprised. Parler and Gab were just thrown together, and made themselves hugely attractive sites to attack.

encryptluks2 6y ago

Gab is a joke. I got banned for making a post asking how are all the domestic terrorists Trump supporters doing after the capitol riot. I guess that is ban-worthy on their free speech network while advocating for assassinating public officials is a-ok.

jb775 6y ago
I bet it felt good to create an account for a website just so you could log in and say "how are all the domestic terrorists Trump supporters doing after the capitol riot?". That's pretty much the online equivalent of peeling-out in your car and thinking it made you look awesome.
- spamizbad 6y ago
  True but it’s also free speech and as such should be permitted on a social network oriented around free speech. Unless trolling doesn’t count as free speech?
  - gfosco 6y ago
    With that definition, would you think unlimited spam is also ok? Most likely you got reported by the community and picked up by the same sort of algorithm that exists on every other platform.
    - twooster 6y ago
      Was that comment spam, or just snark? But I guess bigotry is okay. Free speech platform so long as it doesn't step on any in-group toes.
    - deleted 6y ago
      [deleted]
    - encryptluks2 6y ago
      Spam would indicate some type of repetitious behavior, or unwanted advertisement. A single snarky comment generally wouldn't be considered spam. Every other platform would be fine with the comment.

choppaface 6y ago

Not only that but their CTO has violated the license of Mastadon https://arstechnica.com/gadgets/2021/03/rookie-coding-mistake-prior-to-gab-hack-came-from-sites-cto/ https://arstechnica.com/gadgets/2021/03/rookie-coding-mistak...

deleted 6y ago
[deleted]

pope_meat 6y ago

I'm very tired and for a moment I read it as: "God Has Been Breached" First RSA falls, now god, what's next.

burundi_coffee 6y ago
RSA is dead. RSA remains dead. And we have killed it. How shall we comfort ourselves, the murderers of all murderers? What was holiest and mightiest of all that the world has yet owned has bled to death under our knives: who will wipe this blood off us? What water is there for us to clean ourselves? What festivals of atonement, what sacred games shall we have to invent? Is not the greatness of this deed too great for us?
- kps 6y ago
  God made the integers; factoring them is the work of man.
walrus01 6y ago
If one were to posit that we are in fact living in a simulation of some sort, breaching god would probably look something like a method to gain host bare-metal memory access or code to escape from a virtual machine.

HNfriend234 6y ago

I use gab quite frequently but mainly for the memes and jokes. The vast majority of people on there use pseudonymous aliases anyways so no one cares if the site gets hacked. People on the right-wing have also been subject to extensive persecution (harassment, doxing etc.) from the left-wing so we're all quite used to it by now. I'm been trying to teach as many people as possible about how to stay anonymous online, how to use high-privacy tools and why using technologies like monero is extremely important.

Pfhreak 6y ago
Do you think the average user, whose passwords are things like "password", used an email address that couldn't be tied to then to sign up? Because my guess is that a whole bunch of people do very much care that the stuff they wrote on gab can be traced back to the email account they use everywhere. >> extensive persecution from the left-wing Check your biases if you think this is somehow a one directional concern.
zz_throwaway_zz 6y ago
Ironic this is the lowest rated comment in the thread. Conservatives are the new untermensch in this dystopian technocracy.
Clewza313 6y ago
They're not pseudonymous anymore if their email addresses got leaked, which seems to have happened.

mberning 6y ago

It seems like the author cares about the politics and religion of the Gab founder quite a lot, despite his assertions to the contrary. If you strip away all that it is still a very embarrassing breach. Having a data exfiltration of that magnitude is simply devastating.

Pfhreak 6y ago
What quotes lead you to that conclusion? How much of the overall article is dedicated to them? His article felt quite objective in tone.
HNfriend234 6y ago
No one using the platform even cares. Everyone on the platform just shares memes and jokes anyways. The people using gab aren't stupid like the people who use facebook where they put all their personal information out in the open for all to see.

bmarquez 6y ago

> There's also the risk of incorrectly assuming that a presence in the breach implies your views have some degree of alignment with those regularly expressed on the site, yet clearly based on the presence of my own email address, that assumption is incorrect. I've seen comments elsewhere saying something to the effect of "Gab is just a bunch of right-wing terrorists, who cares if their personal info gets hacked" There are plenty of everyday people who have Gab accounts, some just wanted to reserve their username, others (like Troy Hunt) don't post about politics, others were just checking it out and haven't posted anything. It would suck if their info was leaked and they started getting spammed even though they have no connection to illegal activity. Fortunately Troy took steps to limit searching for email addresses, I hope others with full access are just as cautious.

HNfriend234 6y ago
Ironically enough, I saw someone make a post on another site I read where they were saying in order to exploit cancel culture and doxing, they were working on a bot that would scrape public data from facebook profiles (mainly the name and profile picture) and then have that bot cross create the account on gab and parler. Then the bot would go and repost content from the site and add comments. The idea is that other people would come to the website looking to doxx people or harass people but the reality is the people they would be trying to harass are just fake profiles that the individual person never actually made. It is kind of interesting to think about because if you go on facebook, you can see lots of people using their real facial picture and real first name, last name and the people doing the doxing/harassments don't really put much thought into how that profile account was created.
- vmception 6y ago
  I pollute alot of data for alot of people Dont let your dreams be dreams
  - logicchains 6y ago
    > I pollute alot of data for alot of people Ah, you must be a fellow C++ programmer.

dt3ft 6y ago

If you just want to know how the breach[1] happened: it was SQL injection, where string interpolation was used to construct a query, rather than use parametrized queries. [1] https://arstechnica.com/gadgets/2021/03/rookie-coding-mistake-prior-to-gab-hack-came-from-sites-cto/ https://arstechnica.com/gadgets/2021/03/rookie-coding-mistak...

stanrivers 6y ago
Niiiiice
walrus01 6y ago
drop table fash;
Intermernet 6y ago
Little Jimmy Tables strikes again.
- _muff1nman_ 6y ago
  I believe Bobby Tables is the more well known name: https://xkcd.com/327/ https://xkcd.com/327/
  - gibolt 6y ago
    Must have been changed via SQL injection
    - dmje 6y ago
      upvote
      - dmje 6y ago
        What? I said I'd upvoted the parent comment because I thought it was funny and I get downvoted? Wtf, sometimes I just don't get HN :-/

millstone 6y ago

It doesn't seem right that the big players like Facebook and Twitter enjoy much better security. Is there really no open source offering that just gets this stuff right? A Twitter-in-a-box, like WordPress is a blog-in-a-box, but secure this time? Apparently Gab used Mastodon. Is Mastodon intrinsically hard to secure?

EtherTyper 6y ago
No, we can't conclude that yet. Gab modified their instance heavily from Mastodon code over several years. People are also pointing to an addition made by Gab, where an SQL query is used without input sanitization, as a possible culprit for the breach.
yborg 6y ago
This had nothing to do with the Mastodon code, Gab has made a big deal about all the "improvements" they've made.
input_sh 6y ago
SQL injection that was used for the breach was introduced after the fork. We know that for sure because the source code was public, as is required by AGPL Mastodon uses. Specifically, this was the commit (from a mirror of the repository): https://git.rip/gab/gab-social/-/commit/6e42e3b1eca73c306db1580719a3a1bfb715f6d8 https://git.rip/gab/gab-social/-/commit/6e42e3b1eca73c306db1...

deleted 6y ago

[deleted]

wyoh 6y ago

Welp, time to change my passwords I guess.

m8s 6y ago

This is a pretty non-political rundown from Troy, and a great read as always. It's not always easy to find trustworthy people, but he's one of them. If anyone is offended by supposed political leanings in this article, I'd suggest separating Torba's political views from his words. Blaming a data breach on "mentally ill tranny demon hackers" (his words, not mine) is not a sane or rational thought. The most realistic scenario is that he knows exactly what he's saying and is doing so simply to rile up fanatics, because otherwise he actually believes that and should be in an institution. I'm not sure which one is worse.

a_bonobo 6y ago
>The most realistic scenario is that he knows exactly what he's saying and is doing so simply to rile up fanatics, I don't know, if there's one thing I've learned from Q-anon and other modern cultists is that they are who they tell you they are. There's no need for mental gymnastics on our part to explain awful behaviour away.
- walrus01 6y ago
  It's sometimes hard to tell the difference between the grifters who are parroting the qanon lingo in some sort of short term attempt to make a buck or gain a following, and the true believers. In the end, if it causes the same effects by poisoning rational public discourse, does it matter whether somebody is cosplaying as a qanon believer or not?
- mattigames 6y ago
  On the other hand it was revealed from a 2019 video that Alex Jones hates Trump, while publicly pretending to love the guy to appeal to it's target audience; my guess is that he does believe a few of the nonsense claims he makes on his show but not all; but like the sibling comment says the difference may not matter at all.
spurgu 6y ago
> Blaming a data breach on "mentally ill tranny demon hackers" (his words, not mine) is not a sane or rational thought. I still think it's overly sensitive to get caught up on it. People say a lot of things when they're in distress, or angry - so what. Grow some skin (I would say balls but someone might get offended :rolleyes: (oops I forgot I might offend people without skin)).

throwaway4good 6y ago

So what was Trump's password? (Or at least a hash of it.)

ttt0 6y ago
Trump wasn't on gab.
wyoh 6y ago
It was never Trump's account, only a placeholder they mad in the eventuality that Trump join the platform.

juicyjuicytemp 6y ago

Some bit of gossip about the CTO of Gab, seeing as how I've got a bit of context. (Throwaway, for obvious reasons.) The CTO was never a software engineer. They were a developer advocate so had some interaction with code, but was more of a "talk to developers using things and make sure the requirements were passed along to the dev team" sort of guy, rather than someone that knew his technical details (beyond say, the thing he was actively working on) inside and out. Fosco started out pretty reasonable. When Trump was first elected, he did a "talk to a conservative" series, and while there was the expected disagreement, it was a pretty, civil, positive, well-received olive branch overall. However, like a lot of right-leaning folks in the Trump era, he became more extreme as time went on. I had some reasonably close interactions with Fosco (not going to go into details with how), but it was being kind of clear that he had started to buy into the "Fox News caricature of what someone on the left is like" — to the point of putting words into the very people's mouths he'd so civilly made a point of talking to prior — and surrounding himself with like-minded folks. For all the talk of "diversity" that he had (and indeed, initially fostered!) he became pretty much the sort of caricature, albeit one of the opposite side of the spectrum, that he was deriding. In that sense, while there's a lot of holier-than-thou and disgust that the whole Gab situation prompts, I feel pity and sadness more than anything else. Fosco was a decent guy at one point, but even decent people can end up in their own echo chambers. It's unfortunate to see the state that he's in now.

gfosco 6y ago
You know pretty much nothing about me, unsurprisingly. I certainly don't need your pity, lol, this last year has been one of the best.
- juicyjuicytemp 6y ago
  And the fact that you feel like this year's one of the best for you is exactly why you deserve the pity... The perceived support of a community is addictive. Hope you'll realize at some point what you're giving up to feed that addiction.
- juicyjuicytemp 6y ago

neotranzi 6y ago

For someone who opens with "I only care about the data", at least half of the "analysis" is about politics, including the links tweets which range from his opinions on whether you can change your gender, to categorizing gab users as "neo-nazis". All I see are a bunch of people allying with big tech to crush their competitors while using absurdly hypocritical morals as their reason. This is the same big tech that uses slave labour while plastering their websites with BLM slogans.

ALittleLight 6y ago

Seems like the author is implying but not directly saying the hashed passwords were not salted. Am I reading that right, and does anyone know if they were salted?

estreeper 6y ago
The string output from the bcrypt function always contains a 22-character salt embedded within it, so these are salted. This is placed after an initial algorithm identifier (i.e. $2a$) and an adjustable cost used to generate the output string (i.e. 10$). There's an overview of the structure of the output string here if you're interested: https://en.wikipedia.org/wiki/Bcrypt https://en.wikipedia.org/wiki/Bcrypt However, if your password is "password" or another very common password, then someone can just try those with the embedded salt and still find out that was your password.
- ALittleLight 6y ago
  Very interesting - thanks. You'd still have to crack each password individually though, right? i.e. for row 1 I would need to try X passwords from my password dictionary, and for each of the attempts bcrypt the guess with the given salt and check to see if worked, and then repeat that for each row individually, rather than checking every row simultaneously.
  - caf 6y ago
    Right, you have to check each row separately.

roenxi 6y ago

Troy has a fair take. Ultimately the Gab breach is interesting, good material for an analysis like this one, and won't matter particularly in the future. At a guess, the people on Gab are there because they feel like they are under sustained political attack. This breach will be interpreted as further evidence that they are under sustained political attack. It won't make anyone behave differently - although I hope Gab hires a security expert.

chroem- 6y ago
> the people on Gab are there because they feel like they are under sustained political attack I mean aren't they? I don't see another intellectually honest way of framing this. And yes, I'm aware: Popper's paradox, fighting fascism, etc., etc.
- quantified 6y ago
  Thanks for mentioning Popper’s paradox, I looked it up just now and its scenario has been on my mind for a long time. Now I can just refer to it, in a fashion like Dunning-Kruger.
  - leereeves 6y ago
    Popper is often misunderstood. He was a passionate advocate of free speech and rational argument; when he said "intolerance" he was referring to people who would use violence to suppress free speech: > for it may easily turn out that they are not prepared to meet us on the level of rational argument, but begin by denouncing all argument; they may forbid their followers to listen to rational argument, because it is deceptive, and teach them to answer arguments by the use of their fists or pistols. And even while explaining the paradox, he expressed his opposition to censorship in general: > I do not imply, for instance, that we should always suppress the utterance of intolerant philosophies; as long as we can counter them by rational argument and keep them in check by public opinion, suppression would certainly be most unwise. https://en.wikipedia.org/wiki/Paradox_of_tolerance#Discussions https://en.wikipedia.org/wiki/Paradox_of_tolerance#Discussio...

dang 6y ago

Recent threads on this: Gab has been hacked and 70GB of data leaked - https://news.ycombinator.com/item?id=26309925 https://news.ycombinator.com/item?id=26309925 - March 2021 (744 comments) Rookie coding mistake prior to Gab hack came from site’s CTO - https://news.ycombinator.com/item?id=26319649 https://news.ycombinator.com/item?id=26319649 - March 2021 (312 comments)

stjohnswarts 6y ago

It really couldn't have happened to a nicer web site. I wouldn't care if the anonymous crowd declared open warfare on it.