An Absurdly Basic Bug Let Anyone Grab All of Parler's Data

wired.com

23 points·camillovisini··8 comments

This doesn't seem like a bug. HN has autoincrementing IDs. Reddit had a fully public API, with very little rate limiting.

Being a public website is not a "bug".

Twitter goes through lengths to stop someone from downloading all its content because Twitter sells that sort of access. They are motivated by financial incentives, not a desire to be 'competent' developers, or because integer IDs are some kind of amateur logic.

Being a public website is not a "bug".

Being able to see deleted posts and download deleted videos is a bug.

I consider a bug also not stripping metadata from videos and images on upload.

Lets not confuse bad practices with bugs.

Bad practices oftentimes amount to defects -- what distinction are you making?

I find bugs to be unintentional consequences of code, not consequences of bad design. Imo if you build a house without a roof and call wet-furniture for a bug - you are using the word wrong.

They were able to scrape “deleted” posts because they were just flagged but remained visible via the API. That’s a bug.

auto incrementing ID is a bug if it allows people to get access to data they shouldn't.

HN doesn't store personal data, Parler required government provided ID and your social to participate. Hacking my HN account wouldn't let you do anything other than comment on my behalf.

Reply on news.ycombinator.com