T/S: Defamer v. Gawker

http://gawker.com/5690499/an-american-apparel-employee-says-goodbye-dov-charney-is-an-ethical-pervert?skyline=true&s=i

this is p desperate

ASSISTANT BACKSTOCK MANAGER

http://gizmodo.com/5690749/

983,440 page views

the power of drudge

can tell why lifehacker and gizmodo are the money spinners in this operation

http://lifehacker.com/5693312/make-mashed-potatoes-for-just-two-people

don't forget about the classic

http://lifehacker.com/5379940/how-to-clean-your-debit-and-credit-cards

good god

making mashed potatoes for 2, cleaning their credit cards, wow, these must be the most efficient, productive, successful people out there and not desperate shut-ins

lifehacker is so funny

there is one really useful article for every five instances of ocd insanity

Next take the eraser (we prefer Pink Pearl erasers, but the one on the end of a pencil will do just fine) and gently erase/rub the magnetic strip on the back. It will remove any gunk that's built up over time.

jesus

fucking

christ

pageviews on the mashed potatoes article: 13,433

will it? will it do just fine? i don't have to run out and pick up a three-pack of Pink Pearls, you're letting that one go? or should i spring for the bulk box of 36, because the offgassing of retail plastic packaging causes the rubber to age inconsistently? huh? can i get a fucking answer over here?

if you use the eraser on a dixon ticongeroga itll irreparably destroy your credit score

gonna try the credit card cleaning trick on my library card, will report back

Haha, I thought that was going to be like "wiping out your debt."

mashed potatoes for two could so easily be a jezebel article

you make it and reserve 1.85 servings for yourself and .15 for your cat, then you f5 jezebel and read a daily mail repost about how men are repulsed by fatasses (with two sentences of "my third-wave ladies can you believe this shit?" commentary) thus inciting a fit of self-loathing which perpetuates the cycle of #groupthink

btw i am totally going to try an erasing on the mag strip of my debit card--that shit is fucked up

don't try it on your library card unless you want the RIDE OF YOUR LIFE

lol

http://gawker.com/5712646/advisory-notice-no-action-required

max have you been compromised??!

FYI: That post linking to a torrent of our source code was not written by me. We've been hacked.
41 minutes ago via web
Retweeted by 22 people

Adrianchen
Adrian Chen

http://www.mediaite.com/online/worse-than-previously-thought-gawker-content-management-system-hacked/

max PLEASE REPORT IN so we know you're ok

have we heard whether or not gawker has activated reston 5

^^ post/display name

~~~THIS IS ANONYMOUS POSTING FROM MAXS HACKED ILX ACCT~~~

SLOCKI UR NEXT~~~~GET READY 4 SOME REAL HACKER ISH

*DONS GUY FAWKES MASK*

plz dont go after slocki he's just a canadian who got mixed up with the wrong sort of blogger

Due to the leak of the GANJA framework from within our company

GANJA

This story is somewhat entertaining. It’s also a legendary clusterfuck.

BTW: Gawker still hasn’t notified users. WTF.

The discussion on Hacker News that's a worthwhile read:

http://news.ycombinator.com/item?id=1998642

Some choice quotes:

This is serious. I just checked out the torrent with the text file of the 200,000 cracked passwords. I searched for @me.com account and logged into someone's apple account. It was possible for me to order stuff via their account. I quickly emailed the guy to let him know to change his password. Gawker needs to take responsibility of this situation and email everyone in their database.

Edit 2: Wow: I know a lot of people on this list. I'm letting them know, and recommend that others scan on behalf of friends and family as well. I've been told that there has not been active communication; wish gawker would confirm either way.

A quick search shows staff email addresses at techcrunch, apple, microsoft, google, goldman sachs, etc.

All the usernames and passwords for users with ✧@lifehac✧✧✧.c✧✧, @gawker.com, etc.} email addresses in the torrent (plaintext, not hashed). The torrent claims Nick Denton’s password was an 8-character sequence of even numbers, and that he used it everywhere. (Edit in reply: The hackers used this on e.g. his Twitter account IIRC so it wasn’t truncated to 8 characters.) Some of them are even '11223344' or a substring of the author’s username!

obv this will be seen more seriously than a simple ddos attack & might lead to some prosecution down the road

nice for max to have a night off, tho

For Gawker? Or “Gnosis”?

I suspect it won’t be “Gnosis” since it’s evident from this dump that Gawker’s engineering and I.T. department is shockingly amateurish (e.g. using DES hashes and running everything off of an individual DB schema). Is Gawker liable for their incompetence and bizarrely deficient security practices?

We protect our data with UNIX Standard hash encryption method crypt(3), which is absolutely 100% impossible to crack.

LOLZ. Goodnight.

FYI: http://undertow.jedsmith.org/gawker/

Is Gawker liable for their incompetence and bizarrely deficient security practices?

maybe? i don't know the law about this kinda thing, but i suspect if a bank leaves $100,000 lying out on its tables, it's still not okay for you to steal it

http://pastebin.com/9rRmf6W5

I think the real mistake was in creating a gawker account

lol good luck w/ the "prosecution"

we need to find max

He's probably out posting tweets about acai berries.

not really supposed to talk abt this but uh wed notified users by 3:30 pm yesterday, before the torrent was even released

not really supposed to talk abt this but uh wed notified users by 3:30 pm yesterday, before the torrent was even released

My e-mail was included and I wasn't notified. I also haven't heard anyone claim that they've been contacted by Gawker. However, this morning I received an e-mail from hint.io (???) informing me about the hack and recommending that I change my password.

BTW: Supposedly, there's going to be another dump this afternoon.

http://25.media.tumblr.com/tumblr_ldd2j0jWOT1qdyc51o1_500.png

From Felix Salmon:

Update: Gawker Media now has a FAQ up, which stops short of an apology. What Gawker didn’t do — but what the good people at Hint did do — is email everybody whose email and password were made public, to inform them of that fact. “In situations like this, time is of the essence, which is why we were surprised & shocked to find that Gawker Media hadn’t taken the initiative to notify you of this privacy breach immediately,” they wrote. I’m with them: Gawker should have done what Hint did. But, thankfully, now they don’t need to. And if you haven’t received an email from Hint, there’s a good chance that your email and password have not been made public.

http://blogs.reuters.com/felix-salmon/2010/12/13/gawker-media-gets-hacked/

I hacked my mates facebook account so I could right stuff in his status. His password was his surname. When he discovered that someone had hacked it he changed his password.... to password. When his staus's started changing again he just started commenting on them saying "WHO ARE YOU!!!" instead of changing his password again because he thought it was impossible someone could have guessed it twice.

I suspect it won’t be “Gnosis” since it’s evident from this dump that Gawker’s engineering and I.T. department is shockingly amateurish (e.g. using DES hashes and running everything off of an individual DB schema). Is Gawker liable for their incompetence and bizarrely deficient security practices?

I think it's pretty obvious that Gawker got hardpwned because of some pretty egregious security practices on the part of administrators who should know better, but if you leave your house key under the doormat, people are still criminals if they use them to come in and steal your shit.

That said, Gawker Media is still waaaay understating the risk here, and should be contacting all users via email. It's true that there was some level of obfuscation on user email addresses/passwords, but someone had access to the full database, the source code, and root access on the server. There's nothing in that database that's completely safe.

XD

i think max should write each user individually