BC INTERNET

Saved by @Mollyycolllinss

Claire Ryan
@aetherlev 5 years, 9 months ago 907 views

Save to PDF Share See On Twitter

Right, I did some reading and here’s what likely happened with Parler. Lots of crossed wires here.

First up: someone noticed that Parler uses sequential integers in the API endpoint to get content.

An API endpoint is just a URL with a value added onto the end that tells the system what you want to get back.

Using sequential integers means that a hacker can set up an automated script to start at 1 and count up, trying API calls over and over again, to get back content from Parler.

Parler apparently had no restrictions on this API endpoint, which frankly blows my mind as a web dev.

If you had a working URL, it just spat out whatever it had whether you were logged in or not.

It seems that EVERYTHING that had been uploaded - video, photos, text posts - was accessible whether it had been deleted or restricted in the app itself. Even uploaded photos of licenses etc etc.

I cannot describe how amateur hour this is, if true.

Now as well as that - Parler got kicked off Twilio so now there was no verification of phone numbers on signup. They let it fail open - allow registrations without verification. Hackers used this to create umpteen accounts, for shits n giggles apparently.

I think they closed registrations after the damage had been done.

Okay so the admin accounts - they discovered an API endpoint that let them enumerate admin users.

This is also so unbelievably bad that it boggles the mind, from a web dev perspective

Like I don’t even know why that exists. That is not something that should exist.

The admin accounts were not compromised, apparently, but holy fucking shit you DO NOT expose admin account data EVER. That is asking to get hacked even more.

Anyway the TL;DR on this is that your password probably hasn’t been compromised (I hope) but anything else uploaded to Parler might be out in the wild now even if you deleted it in the app.

Happy fucking Monday, let the train wreck of this week begin

Further update: some lively discussion of it going on here: https://t.co/swpV9JUJ5p

More from Internet

David Kaplan
@depletionmode

Linux code injection paint-by-numbers.

Can we launch a process that looks one way to (superficial) auditors but is, in fact, entirely different? (Think process hollowing and the like on Windows).

Firstly, how are processes created and what does related auditing look like?

The most common pattern is fork() → execve(). Where the fork() syscall create a duplicate of the running process context and execve() overlays a copy of the target program onto that context.

After calling fork(), we’ll have two processes, the original one and a new - duplicated - one (with a new pid).

Control will return from fork() to both process instances. In the child process, the return value will simply by 0, in the parent it will hold the pid of the child.

Thus we can determine whether we are running in the child context and call execv() accordingly, while allowing the parent to continue.

Now, let’s take a look at where the auditing hooks lie. From calling execve(), we’ll eventually land up in exec_binrpm().

Carlos E. Perez
@IntuitMachine

Chess may be a good analogy for explaining the difference between a descriptive model of reality and a generative model of reality.

A descriptive model of chess will describe the rules (i.e. initial setup, allowed moves, points per piece, objectives). This tells you how a chessboard might evolve and also narrows the combinations of realistic chess positions.

In contrast, a generative model involves the actual gameplay between competing players that follow the rules. It generates new styles and patterns. It establishes new strategies and tactics. It generates new openings, middle gameplay, and end game tactics.

A generative model is an evolutionary model that leads to emergent behavior. As a consequence, a master of chess is able to recall the layout of chess positions in a real game in an instant, yet is unable to remember pieces placed in random positions.

That is because causality is present in the movements of pieces in a chessboard. An intuitive system like the human mind is able to capture that causality as a means to understanding and recall.

Advertisement

Julia Angwin
@JuliaAngwin

Facebook is a newstand. But no one can see which news Facebook is pushing to the top.

So we built an app for that called #CitizenBrowser. Our first finding: the sharp impact of Facebook’s political ad ban reversal in the Georgia Senate elections.
https://t.co/GZNdwZOlHW /1

This is the first report from our #CitizenBrowser project. There will be many more to come. But first, I want to tell you a bit about how we did it because it’s the most ambitious thing we’ve ever done @themarkup – and we do a lot of ambitious projects. /2

#CitizenBrowser grew out of conversations @suryamattu and I had about how to audit Facebook. We had both worked on browser extensions to collect data from Facebook, but FB always threatened to shut those down, just like their recent threats against the NYU AdObservatory. /3

But the bigger problem is that browser extensions don’t capture most FB activity. Most people use FB on mobile and browser extensions only work on desktop or laptop computers.

So one night, late at the WeWork, @suryamattu said to me: “We’ll have to build our own browser.” /4

“No way,” I said. “That’s insane.” But slowly, I came around. Here’s why: browsers are good at running in the background. Users could log into FB once through the browser and never use it again.

Then we wouldn’t be monitoring users. We would only be monitoring their feed. /5

Nathaniel Ho-Ho-Horada...
@NW_Horadam

If you're looking at GA EV data and thinking maybe the reason D turnout looks strong relative to 11/3 is because after 2 months of Trump/GOP officials trashing mail-in ballots GOP voters are ditching it for E-Day instead...

Boy do I have some mindblowing statistics for you...

I compared the current mail-in voting tallies for each Congressional District against November mail-in votes for those districts.

The statewide figure currently sits at 62%. Guess which district leads the state?

You guessed it!

GA-14 at 69%. Marjorie Taylor Greene's district.

#2 is GA-8 at 68%.

Jody Hice of "I'm joining Marjorie Taylor Greene in her effort to throw out the Electoral College vote" fame.

GA-9 (Doug Collins) is above the state average at 64%.

IF Republicans were ditching absentee balloting en masse to vote on Election Day, you'd expect to see it by now. But the early *in-person* voting totals are what's actually lagging, not mail-in voting.

Pardon the sloppy spreadsheet, but those last 4 columns are what I'm looking at. The last one in particular.

Andy Pavlo
@andy_pavlo

If you're interested in DB internals, stop what you're doing and watch @CMUDB Quarantine Talk from Nico+Cesar about @SQLServer's Cascades query optimizer: https://t.co/FCdsbHHEaD

Many talks this semester were good. This one is the best. My thread provides key takeaways

[6:50] Microsoft hired Goetz Graffe in the 1990s to help them rewrite original Sybase optimizer into Cascades. This framework is now used across all MSFT DB products (@SQLServer, @cosmosdb, @Azure_Synapse).

[14:43] The optimizer checks whether it has stats it will need before cost-based search. If not, it blocks planning until the DBMS generates them. This is different than other approaches we saw this semester where DBMS says "we'll do it live!" with whatever stats are available.

[21:05] Their Cascades' search starts small/simple and then they make decision on the fly whether to expand search based on the expected query runtime and performance benefit from more search.

[26:33] They explicitly have a property for Halloween Problem. Operators specify whether they protect from it and then optimizer ensures property is satisfied. This is mindblowing. I have never thought about using the optimizer for this but it makes sense.

You May Also Like

SK
@sk_diary1

Sri Sanjeevi Rayar Temple located in Ayyangar Kulam,near Kanchipuram,TN

#Thread

Ancient but beautiful temple dedicated to Hanuman. This temple is a legendary one. According to the Sthala Puranam of Sanjeevi Rayar temple,it is associated with an episode from Ramayana.

Legend story -Hanuman was flying from Himalayas to Lanka bearing Sanjeevi hill to revive Lakshmana during battle between Rama& Ravana, a piece of the Sanjeevi Parvat fell at this place.Many believe this legendary story & even today that no one here dies of any kind of poisoning.

From historical background of the temple it is known that temple was originally built by a great scholar &administrator Kotikanyadanam Lakshmikumara Tatacharya. Temple itself&village were named following name of great scholar Tatacharya, who was then popularly known as Ayyangar.

He was the royal preceptor of Vijayanagara emperor Venkata Raya who had his capital at Chandragiri in AP.Upon returning from a pilgrimage,robbers tried to attack Tatacharya at this place. Being a great devotee of Hanuman,he instantly composed a poem in Sanskrit praising Hanuman.

The bandits immediately ran away &Tatacharya decided to build a temple dedicated to Anjaneya at that very place.This Sanskrit poem is called Hanumad Vimshati, has been inscribed in Grantha script inside this temple.The huge temple tank called Tatasamudram, in honor of Tatacharya.

Enigma
@ainittomai

The Eye of Horus. 1/*

I believe that @ripple_crippler and @looP_rM311_7211 are the same person. I know, nobody believes that. 2/*

Today I want to prove that Mr Pool smile faces mean XRP and price increase. In Ripple_Crippler, previous to Mr Pool existence, smile faces were frequent. They were very similar to the ones Mr Pool posts. The eyes also were usually a couple of "x", in fact, XRP logo. 3/*

The smile XRP-eyed face also appears related to the Moon. XRP going to the Moon. 4/*

And smile XRP-eyed faces also appear related to Egypt. In particular, to the Eye of Horus. https://t.co/i4rRzuQ0gZ 5/*

Advertisement

Jonathan Ware
@ReassessHistory

Rhino Barges

One of the dullest, coolest, more bizarre and fascinating pieces of kit used in Normandy.

Which NO ONE REALLY CARES ABOUT.

BUT I DO AND YOU SHOULD TOO.
/1

#WW2 #SWW #History

Planning for Overlord and Neptune had a serious snag, how to get troops from LSTs onto the beach as simply ramming them onto the beaches and dropping the ramp was known to damage the exceptionally vulnerable LSTs and felt to be unsustainable in the mid to long term. /2

LSTs were essential in sustaining Overlord's progress and were a subject of major headaches in the planning phase, and a real subject of friction when it came to launching additional amphibious operations such as Dragoon.

A single LSTs loss represented a capability nick. /3

So, logic dictated, we don't really want these remarkable but rare and highly valuable vessels constantly doing beach landings, we want something to act as a medium between ship to shore, and in came the (mostly) American designed Rhino. /4

I fucking love Rhinos.

Seriously.

Graceful lines of pure industrial pedigree.

Modular.

LOOK AT IT. /5

Suhas S. Hardutt
@HarduttSuhas

THE BATTLE OF PRATAPGARH (10 Nov, 1659)

Chhatrapati Shivaji Maharaj's impeccable military genius and matchless courage humbled the Adil Shahi Sultanate.

The beginning of what was to come later for the M0ghuls from one of the most indefatigable defenders of Dharma!

(Thread)

Shivaji’s growing influence in Maval region, made him a threat to the Adil Shahi ruler of Bijapur who sought to restrain him. The man who was given the responsibility of this mission, was their commander, Afzal Khan. Afzal was a formidable warrior known for his ruthlessness.(1)

His strategy was to bring Shivaji out into the plains, where he held an advantage, compared to the rocky Deccan terrain. Afzal attacked the holy town of Pandharpur, and later demolished the temple of Bhavani at Tuljapur to instigate Shivaji in a bid to bring him out.(2)

Shivaji was angry but remained patient. Knowing that he could not defeat Bijapuri Sultanate in an open battle, Shivaji moved to Pratapgarh fort, located on rocky heights, surrounded by thick forests of Jawali.(3)

This set the pattern for future Maratha attacks, using guerrilla warfare against larger invading armies rendering them ineffective in unfavorable terrain.(4)

Jaya_Upadhyaya
@Jayalko1

SRI MOOKAMBIKA DEVI, KOLLUR (KAR)

There was an Asura, Kaumasura, who was doing penance to please Shiva and get a boon. To prevent him from asking for a boon, Devi Saraswati made him dumb (hence called Mookasur)
Later, Adi Parashakti slayed him and came to be called Mookambika.

It is said that Adi Shankaracharya had a vision in which Devi agreed to follow him provided he did not look back. He kept walking and was assured of her presence due to the sound of anklets. When he reached here in Kollur, he turned back as the sound of anklets had stopped.

So Devi stayed here and merged with the lingam. The place came to be called Mookambika Kshetram.
The linga has integrated on it’s left side MahaKali, Maha Lakshmi and Maha Saraswathi and on the right side- Brahma, Vishnu and Shiva.

A swarna rekha (gold line) divides this linga into left and right portion. Adi Shakthi in this Udhbhavlinga form appears only here.
Devi sits in padmasana and has 4 hands.
Adi Shankaracharya installed the Sri Chakra in front of Devi and also composed the Soundarya Lahiri here.