8 ms·

I'm CTO for Manwin Canada and ultimately responsible for YouPorn. It's unfortunate that people are associating chat.youporn.com to the actual YouPorn.com site,

by pstatho 15y ago

I'm CTO for Manwin Canada and ultimately responsible for YouPorn. It's unfortunate that people are associating chat.youporn.com to the actual YouPorn.com site, but they are not affiliated at all. It was operated by a completely separate entity, which we've obviously closed as soon as we discovered it. The accounts on chat.youporn.com are different than the accounts on YouPorn. Though as was mentioned, it is probably that some have re-used the same username password combination that is highly unrecommended for all you folks out there (if you read Hacker News, you already know that). As for password policies, I've been enforcing hashing of passwords ever since joining, though as we inherit a lot of old code and sites we correct issues such as that as we come across them. I'll be around for a while, if anyone wants to ask questions.

rhizome 15y ago
Something about that URL tells me you didn't always mind if people associated the two together.
- pstatho 15y ago
  I suppose at some point the old owners did want to make that association. That deal was in place since 2008, we've been managing it for less than a year now. We've been focusing on the rewrite of the main site and are now cleaning up all the secondary dependencies.
  - rhizome 15y ago
    Nothing personal, but is there something about the industry that causes you to be evasive and use weasel words? It doesn't seem controversial that giving a company a subdomain on your site implies an associative connection, not just "I suppose..." SRS Q.
HNatWORK 15y ago
It should be trivial to determine which accounts have the same passwords, are you taking any proactive steps to help secure these accounts?
- pstatho 15y ago
  Yes we are identifying which ones are affected. Due to changes over the years of how account information was handled, we want to be extra sure we are identifying the proper accounts, if any.
rdl 15y ago
Thanks for showing up here! By hashing, do you mean current best practice (bcrypt, scrypt, or possibly a pbkdf with high work factor), or something easily brute forced like MD5 and SHA1. There are issues with migration if you're doing the latter, but not a big deal. Do you have any contractual recourse against the chat provider? Have you considered including such terms in future contracts with partners? Do you have a security audit firm? There's plenty of value to in-house audits, but some kind of independent audit is probably a reasonable choice. You probably don't have PCI concerns (it's free, right?), but users might feel better about privacy otherwise. Just the existence of an account for a given user is probably an issue for some people, so even foolish things like using the same username on a porn site as on other sites could be a leak -- being able to verify that myhusbandinvirginiasportsfan is a valid user account on youtube would potentially make a divorce attorney very happy. Would you answer general questions about the site/business, too? The whole porn tube thing seems like a big change in the industry (I was at SHOT Show in Vegas a few weeks ago, and stopped by the concurrent AVN event -- they really hate the tubes). I'm especially curious how you feel about the meta-tube sites (e.g. fantasti.cc) which seem to blatantly scrape youporn (and other tube) content. Preroll ads still show, but nothing else.
- pstatho 15y ago
  Hashing algorithms are not standardize across our network of sites yet. We use various methodology depending on what allows us to move fast and secure. You would be surprised to see the amount of moving parts there are. We are currently in very close discussions with the 3rd party. In our official statement we purposely did not name them, we don't want to throw them under the bus. Of course we are reviewing all obligations. We do deal with multiple security firms, and we regularly do security audits (both white and black box audits). We also deal with PCI, because we have paying sites as well, like Brazzers. We can talk about the industry in general another time, but obviously we believe all types of sites can co-exist.
- rplnt 15y ago
  What is wrong with salted SHA or even MD5 for that matter?
ez77 15y ago
How does that work? Who assigns the DNS values for chat.youporn.com? Moreover, youporn.com and chat.youporn.com actually point to the same IP address, namely 31.192.116.24. There must be some level of affiliation then, right?
- pstatho 15y ago
  Yes we control the DNS, since it's a subdomain. That is the new IP address of the official website.
Sukotto 15y ago
I have a 50/50 chance of traveling through Montreal & Ottawa later this year. I'd love to buy you a coffee and pick your brain a bit about your tech stack and the IT challenges you've faced at YP. May I contact you?
- pstatho 15y ago
  Sure no problem. You can reach me at: pstatho at gmail
csoghoian 15y ago
Were you the CTO at YouPorn back in 2010, when the company abused a flaw (css sniffing) in web browsers that allowed your company to covertly determine what other porn sites users had visited? See: http://www.forbes.com/sites/kashmirhill/2010/11/30/history-sniffing-how-youporn-checks-what-other-porn-sites-youve-visited-and-ad-networks-test-the-quality-of-their-data/ http://www.forbes.com/sites/kashmirhill/2010/11/30/history-s... Do you think that it was reasonable behavior to engage in without telling your users?
- pstatho 15y ago
  No I wasn't, our company had no involvement with YouPorn at that time. We spoke to the owners about the issue and they are really some of the nicest people we've met. They really did not have malicious intentions. That issue brought the privacy flaw to the forefront, and certainly the adult industry pushes those limits. We always strive to respect industry best practices regarding privacy, especially around cookie handling. We constantly review privacy policies around the world.
zaidf 15y ago
Can you elaborate on what you mean when you state that chat.youporn was operated by another entity? So you guys cut a deal with another entity to let em "rent" the subdomain chat.youporn? Just intrigued by how this works.
- b00gizm 15y ago
  It's a common practice to "rent" content from 3rd parties. You (as rentee) get your cut by affiliation or minutes fee.
  - zaidf 15y ago
    "...but they are not affiliated at all. It was operated by a completely separate entity" Well if what you say is true, then it seems like they are affiliated and the CTO's above statement seems off. Of course you can be a separate entity and still be affiliated. I would say "not affiliated" if said company was just paying them a flat fee per month to run their stuff on a subdomain. If they are, however, getting a percentage of revenue, it's a classic affiliate model.
    - pstatho 15y ago
      I don't know the financial deal that is in place, but I don't see how it impacts the affiliation. From my perspective the accounts are not shared, so you needed to register there to create an account. We don't share databases. Also, it is not our company and operates completely independent from us. This is what I meant by not affiliated. Hope that clears it up.
      - zaidf 15y ago
        Appreciate your answer. Parts of your post make it seem like you have next to nothing to do with this; while other parts make it seem like you do have responsibility for this. Also, it is not our company and operates completely independent from us. Do you mean by this that the SaaS chat application deployed at chat.youporn.com is developed by a different entity to youporn? If so, then I understand the different entity part. But does that entity also own the users and serve its own TOS than you guys for chat.youporn users? If you are merely deploying a SaaS but have your own TOS and own the users, then it seems like while YouPorn may not be at fault for the technical goof up, but you are still responsible overall since the users belonged to YouPorn(not the parent entity).

by pstatho 15y ago

rhizome 15y ago

Something about that URL tells me you didn't always mind if people associated the two together.

pstatho 15y ago
I suppose at some point the old owners did want to make that association. That deal was in place since 2008, we've been managing it for less than a year now. We've been focusing on the rewrite of the main site and are now cleaning up all the secondary dependencies.
- rhizome 15y ago
  Nothing personal, but is there something about the industry that causes you to be evasive and use weasel words? It doesn't seem controversial that giving a company a subdomain on your site implies an associative connection, not just "I suppose..." SRS Q.

HNatWORK 15y ago

It should be trivial to determine which accounts have the same passwords, are you taking any proactive steps to help secure these accounts?

pstatho 15y ago
Yes we are identifying which ones are affected. Due to changes over the years of how account information was handled, we want to be extra sure we are identifying the proper accounts, if any.

rdl 15y ago

Thanks for showing up here! By hashing, do you mean current best practice (bcrypt, scrypt, or possibly a pbkdf with high work factor), or something easily brute forced like MD5 and SHA1. There are issues with migration if you're doing the latter, but not a big deal. Do you have any contractual recourse against the chat provider? Have you considered including such terms in future contracts with partners? Do you have a security audit firm? There's plenty of value to in-house audits, but some kind of independent audit is probably a reasonable choice. You probably don't have PCI concerns (it's free, right?), but users might feel better about privacy otherwise. Just the existence of an account for a given user is probably an issue for some people, so even foolish things like using the same username on a porn site as on other sites could be a leak -- being able to verify that myhusbandinvirginiasportsfan is a valid user account on youtube would potentially make a divorce attorney very happy. Would you answer general questions about the site/business, too? The whole porn tube thing seems like a big change in the industry (I was at SHOT Show in Vegas a few weeks ago, and stopped by the concurrent AVN event -- they really hate the tubes). I'm especially curious how you feel about the meta-tube sites (e.g. fantasti.cc) which seem to blatantly scrape youporn (and other tube) content. Preroll ads still show, but nothing else.

pstatho 15y ago
Hashing algorithms are not standardize across our network of sites yet. We use various methodology depending on what allows us to move fast and secure. You would be surprised to see the amount of moving parts there are. We are currently in very close discussions with the 3rd party. In our official statement we purposely did not name them, we don't want to throw them under the bus. Of course we are reviewing all obligations. We do deal with multiple security firms, and we regularly do security audits (both white and black box audits). We also deal with PCI, because we have paying sites as well, like Brazzers. We can talk about the industry in general another time, but obviously we believe all types of sites can co-exist.
rplnt 15y ago
What is wrong with salted SHA or even MD5 for that matter?

ez77 15y ago

How does that work? Who assigns the DNS values for chat.youporn.com? Moreover, youporn.com and chat.youporn.com actually point to the same IP address, namely 31.192.116.24. There must be some level of affiliation then, right?

pstatho 15y ago
Yes we control the DNS, since it's a subdomain. That is the new IP address of the official website.

Sukotto 15y ago

I have a 50/50 chance of traveling through Montreal & Ottawa later this year. I'd love to buy you a coffee and pick your brain a bit about your tech stack and the IT challenges you've faced at YP. May I contact you?

pstatho 15y ago
Sure no problem. You can reach me at: pstatho at gmail

csoghoian 15y ago

Were you the CTO at YouPorn back in 2010, when the company abused a flaw (css sniffing) in web browsers that allowed your company to covertly determine what other porn sites users had visited? See: http://www.forbes.com/sites/kashmirhill/2010/11/30/history-sniffing-how-youporn-checks-what-other-porn-sites-youve-visited-and-ad-networks-test-the-quality-of-their-data/ http://www.forbes.com/sites/kashmirhill/2010/11/30/history-s... Do you think that it was reasonable behavior to engage in without telling your users?

pstatho 15y ago
No I wasn't, our company had no involvement with YouPorn at that time. We spoke to the owners about the issue and they are really some of the nicest people we've met. They really did not have malicious intentions. That issue brought the privacy flaw to the forefront, and certainly the adult industry pushes those limits. We always strive to respect industry best practices regarding privacy, especially around cookie handling. We constantly review privacy policies around the world.

zaidf 15y ago

Can you elaborate on what you mean when you state that chat.youporn was operated by another entity? So you guys cut a deal with another entity to let em "rent" the subdomain chat.youporn? Just intrigued by how this works.

b00gizm 15y ago
It's a common practice to "rent" content from 3rd parties. You (as rentee) get your cut by affiliation or minutes fee.
- zaidf 15y ago
  "...but they are not affiliated at all. It was operated by a completely separate entity" Well if what you say is true, then it seems like they are affiliated and the CTO's above statement seems off. Of course you can be a separate entity and still be affiliated. I would say "not affiliated" if said company was just paying them a flat fee per month to run their stuff on a subdomain. If they are, however, getting a percentage of revenue, it's a classic affiliate model.
  - pstatho 15y ago
    I don't know the financial deal that is in place, but I don't see how it impacts the affiliation. From my perspective the accounts are not shared, so you needed to register there to create an account. We don't share databases. Also, it is not our company and operates completely independent from us. This is what I meant by not affiliated. Hope that clears it up.
    - zaidf 15y ago
      Appreciate your answer. Parts of your post make it seem like you have next to nothing to do with this; while other parts make it seem like you do have responsibility for this. Also, it is not our company and operates completely independent from us. Do you mean by this that the SaaS chat application deployed at chat.youporn.com is developed by a different entity to youporn? If so, then I understand the different entity part. But does that entity also own the users and serve its own TOS than you guys for chat.youporn users? If you are merely deploying a SaaS but have your own TOS and own the users, then it seems like while YouPorn may not be at fault for the technical goof up, but you are still responsible overall since the users belonged to YouPorn(not the parent entity).