Never attribute to malice that which can equally be explained by incompetence, or something like that.

Never assume xor among different interpretations.

> My opinion is that it's more likely than not that these sites are little more than honeypots to troll the gullible into making asses of themselves so that we have another subject for our Two Minutes of Hate.

Or maybe, instead, some people really do hold extremist views and post them on the internet? I don't understand your theory here - the majority of Gab content is public already (well, behind an authwall, but otherwise public). The hack achieves nothing for these masterminds that just want to make fun of people being bigoted on the internet because they already could.

> Now that data can be used against the most ferverent Republican supporters and there's no one to blame, officially, because they were "hacked". Oops! Maybe you should think twice before publicly supporting Republicans online, I guess!

Do you seriously think the problem people had with some of the content on Gab is that users were "supporting Republicans"????

GP has edited their comment like 10 times so here's the version I'm replying to:

> I'm one of the world's biggest fans of Hanlon's razor, and I've done so much damage to it with Gab and Parler that it looks like a hairbrush now.

> My opinion is that it's more likely than not that these sites are little more than honeypots to troll the gullible into making asses of themselves so that we have another subject for our Two Minutes of Hate.

> I do a lot of research on social media mechanics, and I've used both of them. I can't quite put my finger on it, but they performed and felt differently from any other sites I've used over the past 20+ years. For one thing, you could not read or see ANY comments without registering first.

> I could just as easily be imagining it, of course. And they did paint a huge target on themselves. But they also made it easy to steal the data.

> Now that data can be used against the most ferverent Republican supporters and there's no one to blame, officially, because they were "hacked". Oops! Maybe you should think twice before publicly supporting Republicans online, I guess!

> (Not affiliated with any political party, apolitical, have friends and family who are into all different flavors. Just think it's fucked up to throw thousands of people under the bus like that, if it's true.)

I think you're encountering Poe's Law here - at some point it becomes difficult to tell the difference between a troll and someone genuinely expressing an extremist point of view.

Are there trolls on Gab and Parler? For sure. Are there purestrain rabid culture warriors on Gab and Parler? Yup. Are Gab and Parler honeypots? I don't think so, but that also depends how you define "honeypot."

Both exist because other social networks cracked down on distasteful content. Gab erupted during the era of cracking down on ethnonationalists and is full of wannabe nazis and 4chan-grown edgelords. Parler erupted during the era of cracking down on dangerous misinformation (QAnon, COVID denialism, the things that we now know lead to election denialism, etc etc) and if full of people that choose to believe that nonsense rather than reality. Parler was also signal boosted by political voices that intentionally framed crackdowns on distasteful content as an aspect of the ongoing culture war.

Both naturally courted their respective audiences.

The guy running Gab is a True Believer. Check out Gab's Twitter (heh) for some pretty questionable recent posts that blame the hack on "mentally ill trans hackers," only with a slur instead of trans, because of course there's a slur.

The Mercer family bankrolls Parler. They have a long history of throwing money at causes that follow their political viewpoints. We don't have a reason to doubt that their board and and management are True Believers in their own cause as well.

So, is it really a honeypot if it's honest by design?

>The guy running Gab is a True Believer

He's definitely not but he knows how to play to his audience. Instead of owning it and saying 'we messed up' it's easier to blame the 'mentally ill trans hackers'!

But the 'hack' was almost certainly intentional, it's the exact same play Parler did a few weeks ago. They're both honeypots, this is the easiest way to get the data out there.

Maybe they are spinoffs of reddit/facebook/twitter etc. to contain moderation cost :)

I do like your theory that it was a honeypot from the left created to produce people to attack.

I would be surprised if our intelligence agencies and law enforcement didn't have a role in creating/running extremist sites. Seeing as the FBI likes to run child porn sites and infiltrate political groups that could cause instability, they are the most obvious perpetrators.

The leader of the supposedly white supremecist Proud Boys, Enrique Tarrio, is an Afro-Cuban who turned out to be an FBI informer.

Wheels within wheels.

https://www.theguardian.com/us-news/2021/jan/27/proud-boys-l...

FWIW Gab very proudly proclaims that they report things to law enforcement if they cross a legal line. I could be wrong but I would think that if the FBI was trying to entrap people they would not want to give such a warning.

I think you are wrong, stating it prominently and repeatedly makes the warning disappear into noise for users so there's little downside and a lot of upside if it were in fact being operated by the FBI.

I doubt it is though, I don't think the FBI has the capability to be frank, but even more if the FBI were operating it as a honeypot somehow I doubt that the websites would have been banned from AWS and such.

I'm sure that if it were true the FBI could have easily just told AWS that the presence of extremist content was being allowed by law enforcement specifically to identify terrorists.

I think the idea that it's a honeypot is a very poor fit to the available information.

Occam‘s razor would disagree. While it‘s certainly thinkable that it‘s a honeypot of the FBI, set up from the left (just like it‘s possible that it was Antifa who stormed the capitol posing as Trump supporters), it‘s far more likely this was a job done by nutjobs, for nutjobs.

If you also think the earth is flat or the election was stolen despite literal mountains of evidence, how are you supposed to properly weigh any other rational evidence like the existence of SQL injections?

Or maybe they just didn't build a strong enough engineering team and quickly ran into the limits of their experience and skills levels.

There are numerous examples of start ups and even mature companies making basic mistakes. This is easily explainable without resorting to conspiracy theories.

> maybe they just didn't build a strong enough engineering team and quickly ran into the limits of their experience and skills levels.

"Free Speech platform Gab has announced Fosco Marotto as the company’s new Chief Technical Officer (CTO). According to a blog post from the company, Marotto was formerly a software engineer, production engineer, and developer advocate during a seven-year career at Facebook.

Marotto reportedly brings 23 years of industry experience to the platform along with extensive knowledge in backend infrastructure and insight that will help Gab scale as it becomes increasingly popular."

CTO: https://github.com/gfosco

Parse Server: https://github.com/parse-community/parse-server

Parse Server API doc snippet:

"If your app is compromised, it’s not only you as the developer who suffers, but potentially the users of your app as well. Continue reading for our suggestions for sensible defaults and precautions to take before releasing your app into the wild."

https://docs.parseplatform.org/rest/guide/#security

Per Ars, he removed security code.

So there are a couple of things here:

*A strong engineering team should've had vulnerability scans at some point in their build process. That SQL injection vulnerability would've been easy to spot

*That SQL injection probably should've been picked up in a code review

*They should have been using parameterized queries in the first place. The fact he removed input sanitization methods is besides the point, that they shouldn't have been relying on those in the first place.

*A senior engineer or CTO should've known better. But I've seen very senior people make bad mistakes before. These mistakes are much more likely with immature processes and safeguards.

*Sometimes someone can get to a 'senior' level without necessarily knowing how to do some aspects of software engineering well.

A strong engineering team is about the performance and practices of the whole group. You can have individuals who are experienced at particular skills but have big gaps in the skills and experience needed to build a strong team.

I couldn’t reply earlier (“posting too fast”).

These are all solid points modulo the optics of memory holing commits.

I mean, "worked at Facebook for a while" isn't a guarantee of competence. And some security boilerplate text isn't a guarantee of being good at security.

You want guarantees in software resources? Have you heard about the famous interview torture for jobs?

Your OP wanted to paint a picture of inexperienced development team. Both items in my post show that both the team (who initially had it right) and the CTO (who inexplicably removed the two lines) are definitely experienced.

That Parse Server looks like a substantial piece of code and there is a community around it, so let's be fair and grant the CTO a measure of competence, shall we?

I mean, given a choice between "an incompetent programmer with seven years work experience exists", and "Gab as a whole is some sort of weird honeypot", Occam's razor probably suggests the incompetent programmer.

23 years of experience + Existing codebase demonstrating care for matter such as filtering input == experienced. Certainly not clueless.

I said absolutely nothing about a honey pot. Review my posts. Occam's razor strongly suggests to not make un-necessary assumptions. My post challenges your assertion of incompetence. You need to remove that assumption from your analysis.

The thread was about the claim that it _must_ be a honeypot because it's so incompetent. What's your theory for how this happened, if neither incompetence nor deliberate?

Well, take that up with the GP.

> What's your theory for how this happened, if neither incompetence nor deliberate?

Honestly no theories, just rubber necking here :) but since you ask, here is what my shaving session with Occam brings up:

- cognitive impairment (alcohol, various fun chemicals)

- emotional agitation (relationship, personal matter, etc)

- rushed for time (silly mistake)

- arrogance ("I can do C++, Scala, JS, and PhP. This Ruby stuff will be cake, and I do not need to ask my team why they had those 'funny' filters on top of the function")

- malicious coding ("Sure, I'll help you scale it. I hate SV too. I hate it so much I spent 7 years at FB.")

So re. that last possibility, I also do not agree with your GP that this indicates that that platform was a honeypot. This specific event can be construed as placing a backdoor in their code.

True. I worked at a company that once hired this former Yahoo engineer when they were hot and he sang the Smurf song often and wrote shit code. All the engineers were happy he was the only dev in his section because he also smelled.

Even with all that, I would still expect him to not make any commit similar to this CTO.

"solarwinds123" comes to mind.

This comment is highly underrated.

Malice or incompetence? Why choose? They've got both!