Thread by @BrainClouds

In light of Parler getting hacked, I decided to attempt a deep technical dive of it to try and figure out how it was designed.

I did not get far.

Whoever made this site: (1) I hope you got paid really well, and (2) I hope no one hires you ever again.

https://twitter.com/CopingMAGA/status/1331362619396149251

I had created an account on the site before, and I have already documented that horror of a user experience. twitter.com/i/events/12781…

But the hack revealed several references to Wordpress, so I had to wonder... could this site, the site that conservatives are flocking to because it's not Twitter, really be a Wordpress derivative?

Strictly speaking as a developer, creating a site like Parler or Twitter isn't really that hard... what's hard is designing a site that can handle millions upon millions of concurrent user and not collapse under its own weight.

So for this exploration I'm not taking user load into consideration, particularly because I can't be sure how things work on the back end; I only have visibility to the client.

And, boy, what a client...

So I logged into to Parler, opened up the developer's console in Chrome, went to the "Discovery" tab, and started exploring.

Red Flag Number One: This is part of the "head" block in the page's HTML. It loads a LOT of script, but it also seems to define a virtual crapton of styles, all inline.

And each one of these inline styles is... how should we say... quite verbose.

The HTML page alone is 3 MEGS.

So off to the "Network" tab in Chrome developer's tools, and I see it transfered 22Mb of data COMPRESSED (using gzip).

That's... a lot. And I haven't actually done anything yet.

In case you're wondering, this is the page as it appears so far. All this is 22Mb gzip compressed.

OK, so let's look at Javascript only. This page loads FIFTY-ONE individual Javascript files totaling 4Mb COMPRESSED.

If you know gzip, you know that gzip compresses Javascript very well, so my estimate is that's about 20Mb uncompressed. Of JAVASCRIPT.

One file immediately caught my eye: "main.9a5b11f9c50715e54456.js"

It's 1.3Mb compressed, which - when saved and inspected - is a whopping 5.17Mb... of MINIFIED JAVASCRIPT.

That's... a lot.

I've written entire game engines in Javascript in a fraction of that.

So I tried to pull this file into Visual Studio and format it.

Visual Studio crashed.

So I tried to pull it into Notepad++. It didn't know what to do with it.

I literally could do very little with this file... So if that was your goal when you minified it, you won this one.

The only thing I was able to do was "prettify" it in Chrome developer tools, "select all", and copy/paste it into Notepad++.

The result, a Javascript file with 122,501 lines.

Now attempting to read this file is a challenge in and of itself, specifically because it was minified and a lot of the variables obfuscated, but I feel comfortable in saying one thing about it: this single Javascript file includes all the functionality of the ENTIRE SITE.

And not just that, it includes all the text strings you see in the site - again, in Javascript, mind you - in ALL LANGUAGES.

In this massive Javascript file, from line 4172 to line 41103 - yes, over 37,000 lines - are all the strings of every part of the site in every language.

For example, here are all the site strings that instruct you how to take a photo of your passport for verification purposes...

...and here are all the strings that talk about bad words and NSFW stuff...

Again, this is all IN JAVASCRIPT. Loaded ALWAYS, regardless of what language you actually want.

So they include every string the site has, even strings for pages you aren't even on (like your account settings, or verification, or whatever), in every localized language, and hauls that client-side on every page load.

And there's also some even stranger stuff in this Javascript... like how they define SVG files inline.

There is just so much in this file I don't know how to proceed with it. It's mind-numbingly massive. I've never seen anything like it.

It's one file that contains what is practically all of the site's functionality. ONE FILE.

They have thousands of lines of code in this file to parse complex date formats. Why? I don't know. It's not that hard, really.

They have a crapton of code to handle emoticons. I expected that to be abstracted, but no... they explicitly define every emoticon.

So, in a nutshell... I don't think this site's derived from Wordpress, so my initial question was answered.

Secondly, whatever developer wrote this should be beaten with a folding chair.

I'm done here. My brain is broken.

If you like what you read above, I would appreciate it if you can help me afford to drink heavily or something... I kinda need it after this. ko-fi.com/brainclouds