I also worked for Twitch and can confirm what you're saying is true. These repo's any staff member had access to - including non-engineering staff.

Revenue for the longest time was as simple as navigating to a streamers dashboard as staff, but they did finally gate that away from staff who don't need to see that info, however I am sure there are other ways to obtain revenue reporting info.

I am assuming all data - including personal - has been compromised but so far, the data leaked is data that most staff would have access to in some way or another. Some may find that shocking, but this was not a "high level hack"

I'm actually very happy to hear they finally added a flag for payout access. It's been years since I was there and my eyes bugged out when I saw what I had access to without needing it.

Parent company was no different.

Why did non engineers have access to repos?

The better question is, why did random engineers have access to the financials of the streamers on the platform, without having to go through a break-glass, audited, emergency access escalation.

Allegedly it also contains AWS access keys. I feel bad for the engineers who will have to answer for this.

So much for information compartmentalization. Does the typical engineer need access to payment details for their daily work?

No, but doing least privilege, separation of privileges, and RBAC correctly is tedious and difficult and slows development velocity, so companies rarely do it well if they even bother trying unless some outside force compels them.

I highly doubt it would be possible to do something like this at AWS, just because hosting multitenant infrastructure and working with the government forces you to implement security since you're being audited and awarded contracts on that basis. Twitch users don't give a crap about the security of the platform. They just want to monetize as quickly as they can, too.

So I'm not hugely surprised that practices and culture would be different even if they have the same parent company, especially since Twitch was an acquisition. Even if not, though, I'd expect security at Prime to be better than Twitch but worse than Marketplace, Marketplace to be worse than AWS, etc. All speculation since I've never worked at any Amazon product, but that's what I would expect.

The tradeoffs for any individual piece of data are different from the tradeoffs of a company-wide policy. Siloing off one little thing (e.g. credit card info) usually doesn't inconvenience very many people, but at the same time it only provides marginal security. No front page headline has ever read "At Least The Credit Card Info Was Safe". On the other hand, a company-wide policy of siloing everything can have more of a security impact, but it also inconveniences everyone frequently. That's the tradeoff that many tech companies don't want to make.

I don't see how this precludes just-in-time access. Even if people can re-up on their own, you can still observe the data access patterns and manage the risk. Further, when you see someone is getting blocked a lot you can improve the experience for them so they are unblocked, or have more efficient access to the data. This is just mature data and security management.

Quality of life and developer experience are important topics in many ways, but should they really trump security consistently? It's always going to be dependent on people's risk assessment and comfort, but frequently it skews the wrong way because the people making the decisions know that they'll be gone.

Implementing just-in-time access on legacy systems that pre-date just-in-time architectures is extremely expensive. Its cheaper to either give all info or no info. Which is what every legacy company does instead.

My company can shut off my access to the all the databases when they stop asking me to troubleshoot any and all data issues. Which will never happen.

Part of the appeal is working at a place like Amazon is having a voice in decision making in the product you’re building. Hard to make informed decisions or opinions without the data. Engineers in Amazon retail definitely have broad access to sales data.

Why would an intern at Twitch have access to data in production?

Saying that no 'secrets' were leaked is effectively burying the lede.

In general the broad access was to code repos early on. Some were gated. There’s lots of collaboration and the need to study other code bases for learning and collaboration, read only. It’s micro services galore there so one didn’t tend to have access to production databases for services or systems you didn’t work on. You were opted in there. Teams did their own devops for the most part.

The payout data likely wasn’t ripped from a DB but rather dashboards which customer service or partnerships likely had access to. Tier1 or Tier2 support kinda stuff.

This smells like a stolen backup or maybe network access and http scanning, finding the internal GitHub and maybe a support admin cred that allowed dashboard view.

By secrets, I mean salts, password hashes, etc.

> You also get access to every streamer's dashboard and their analytics

I would classify that as access to production systems.

Why is getting access to prod, or prod data, considered a perk, exactly?

The perk is the wrench UX denoting you are an employee to the community . Reddit/twitch allow employees to communicate with the users . It is a social media platform , being able to indicate that you are special is street cred.

The other access rights that come from staff access is either incedential or miss /debt in architecture.

It's understandable why this is a neat perk, but it also seems absurd when you look at Twitch as an entity owned by a global corporation.

Man oh man, big "No thanks" to a perk like that from me

"Hey, pick through everything I say with a fine-toothed comb and treat it as the official company stance!"

From prior (user) experience, typically staff have non-wrenched alt accounts for just chilling out in streams (with less concern about conduct, but generally tame by twitch standards). But will wrench up for higher profile streams or folks they're otherwise pretty close with personally.

I suspect that's a lot more controlled these days, but it wasn't very uncommon for signified staff to be trolling along with everyone else.

This statement makes no sense.

The leak includes source code of multiple active websites and applications that are operated under the umbrella of Twitch/Amazon.

Why would an intern have access to this data?

In many companies source code for all products is available to each and single developer.

In what world does all this data in the leak would be stored together in a unified ecosystem? It makes absolutely no sense.

If you're saying that Twitch runs their developer environment in a lousy manner (and you have proof of this), then please go ahead.

But to imply that an intern/average developer would be given access to all this branching information is ignorant.

I think many people are trying to say that in this world at many companies all that data is indeed stored and accessed together.

Maybe the super secure siloed world doesn't really exist outside of military/government organizations.

I have first hand info, and this is how it’s done. Don’t call somebody ignorant if you don’t have first hand info. Leave that for somebody who does.

>Why would an intern have access to this data?

monorepos are a thing at several companies (e.g. Google).

Monorepos can and often do have ACLs per directory.

I worked for a multi billion company and even 6 month contractors had access to basically everything with little effort.

No one in IT should have access to business data. That's simply best practice. Worst case would be a database engineer who has access to backups or some prod data for troubleshooting, and even that should be under tight control with good access accounting.

Welcome to devops. Ask Mike down the hall to add you to the “admin” group. Tell him you’re a new dev so you need everything.

(This is a joke but also, at many companies, it’s not. Twitch was once small and grew. Who knows what ancient all-access switches are still critical to running the systems, marked “tech debt” in someone’s backlog)

The whole point of devops is to automate everything according to best practices, so fuckups are a thing of the past! The only fuckups, of course, will be Terraform state issues.

No the whole point of devops is to get rid of those terrible sysadmins always keeping the devs from doing anything...

Once you have "DevOps" the devs are ops, your head count drops, and all that pesky security and other things those dirty sysadmins wanted are gone

kinda /s sometimes I think that is really want managers think about devops

As it turns out, the entire industry doesn't quite agree on "the whole point of devops."

Until the business raises a priority one incident that their monthly reports are not looking right and you need to dive into the data to find out why some other API back end decided to present its numbers this month divided by 1000 for ease of display to their own users.

I know, I know, service contacts but my point is sometimes engineers need at least temporary access to provide support at times.

Could have been a hack of a twitch engineer's laptop or something like that.

This is what I thought of as well. Maybe just an engineer was hacked.

Sounds like someone in Twitch Security needs to take a course on Least Privileged Access then