4 ms·
It doesn't seem right that the big players like Facebook and Twitter enjoy much better security. Is there really no open source offering that just gets this stu
by millstone 6y ago
It doesn't seem right that the big players like Facebook and Twitter enjoy much better security. Is there really no open source offering that just gets this stuff right? A Twitter-in-a-box, like WordPress is a blog-in-a-box, but secure this time?
Apparently Gab used Mastodon. Is Mastodon intrinsically hard to secure?
- EtherTyper 6y agoNo, we can't conclude that yet. Gab modified their instance heavily from Mastodon code over several years. People are also pointing to an addition made by Gab, where an SQL query is used without input sanitization, as a possible culprit for the breach.
- yborg 6y agoThis had nothing to do with the Mastodon code, Gab has made a big deal about all the "improvements" they've made.
- input_sh 6y agoSQL injection that was used for the breach was introduced after the fork. We know that for sure because the source code was public, as is required by AGPL Mastodon uses. Specifically, this was the commit (from a mirror of the repository): https://git.rip/gab/gab-social/-/commit/6e42e3b1eca73c306db1580719a3a1bfb715f6d8 https://git.rip/gab/gab-social/-/commit/6e42e3b1eca73c306db1...