Right, I did some reading and here’s what likely happened with Parler. Lots of crossed wires here.

First up: someone noticed that Parler uses sequential integers in the API endpoint to get content.

An API endpoint is just a URL with a value added onto the end that tells the system what you want to get back.
Using sequential integers means that a hacker can set up an automated script to start at 1 and count up, trying API calls over and over again, to get back content from Parler.
Parler apparently had no restrictions on this API endpoint, which frankly blows my mind as a web dev.

If you had a working URL, it just spat out whatever it had whether you were logged in or not.
It seems that EVERYTHING that had been uploaded - video, photos, text posts - was accessible whether it had been deleted or restricted in the app itself. Even uploaded photos of licenses etc etc.

I cannot describe how amateur hour this is, if true.
Now as well as that - Parler got kicked off Twilio so now there was no verification of phone numbers on signup. They let it fail open - allow registrations without verification. Hackers used this to create umpteen accounts, for shits n giggles apparently.
I think they closed registrations after the damage had been done.

Okay so the admin accounts - they discovered an API endpoint that let them enumerate admin users.

This is also so unbelievably bad that it boggles the mind, from a web dev perspective
Like I don’t even know why that exists. That is not something that should exist.

The admin accounts were not compromised, apparently, but holy fucking shit you DO NOT expose admin account data EVER. That is asking to get hacked even more.
Anyway the TL;DR on this is that your password probably hasn’t been compromised (I hope) but anything else uploaded to Parler might be out in the wild now even if you deleted it in the app.

Happy fucking Monday, let the train wreck of this week begin
Further update: some lively discussion of it going on here: https://t.co/swpV9JUJ5p

More from Internet

A thread of resources for aspiring & new Product Managers:

(should also be useful for Eng, Design, Data Science, Mktg, Ops folks who want to get better at PM work or want to build more empathy for your PM friends ☺️)

(oh, and pls also share *your* favorite resources below)

👇🏾

1/

Product Management - Start Here by @cagan
(hard to go wrong if you start with Marty Cagan’s

2/

Tips for Breaking into PM by @sriramk
(I’ve recommended this thread in my DMs more often than any other thread, by a pretty wide


3/

Top 100 Product Management Resources by @sachinrekhi
(well-categorized index so you can focus on whatever’s most useful right

4/

Brief interruption.

It’s important to understand your preferred learning style and go all in on that learning style (vs. struggling / procrastinating as you force a non-preferred learning

You May Also Like

THIS.

Russia hasn't been a willing partner in this treaty for almost 3 decades. We should have ended the pretense long ago.

Naturally, Rand Paul is telling anyone who will listen to him that Trump is making a HUGE MISTAKE here.


Rand is just like his dad, Ron. 100% isolationist.

They've never grasped that 100% isolationist is not 'America First' when you examine it. It really means 'America Alone'.

The consistent grousing of pursuing military alliances with allies - like Trump is doing now with Saudi Arabia.

So of course Rand has also spent the last 2 days loudly calling for Trump to kill the arms deal with Saudi Arabia and end our alliance with them.

What Obama was engineering with his foreign policy was de facto isolationism: pull all the troops out of the ME, abandon the region to Iranian control as a client state of Russia.

Obama wasn't building an alliance with Iran; he was facilitating abandoning the ME to Iran.

Obama wouldn't even leave behind a token security force, so of course what happened was the rise of ISIS. He also pumped billions of dollars into the Iranian coffers, which the Mullah's used to fund destabilizing activity [wars/terrorism] & criminal enterprises all over the globe
Recently, the @CNIL issued a decision regarding the GDPR compliance of an unknown French adtech company named "Vectaury". It may seem like small fry, but the decision has potential wide-ranging impacts for Google, the IAB framework, and today's adtech. It's thread time! 👇

It's all in French, but if you're up for it you can read:
• Their blog post (lacks the most interesting details):
https://t.co/PHkDcOT1hy
• Their high-level legal decision: https://t.co/hwpiEvjodt
• The full notification: https://t.co/QQB7rfynha

I've read it so you needn't!

Vectaury was collecting geolocation data in order to create profiles (eg. people who often go to this or that type of shop) so as to power ad targeting. They operate through embedded SDKs and ad bidding, making them invisible to users.

The @CNIL notes that profiling based off of geolocation presents particular risks since it reveals people's movements and habits. As risky, the processing requires consent — this will be the heart of their assessment.

Interesting point: they justify the decision in part because of how many people COULD be targeted in this way (rather than how many have — though they note that too). Because it's on a phone, and many have phones, it is considered large-scale processing no matter what.