Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter warns that private tweets were public for years

bbc.com

Post reply on HN
Print view View original

131–140 of 196 posts

Re: Twitter warns that private tweets were public for years

#131

Post by whyte_mackay »

VikingCoder wrote: post #55
bilbo0s wrote: post #9

Just my own opinion, but at this point I think it's prudent to assume that pretty much anything you send out into the digital network world is public. If it's not something you would want the world knowing you said, don't put it out there. Security breaches happen. Bugs happen. Sometimes law enforcement just comes by and says, "Give me everything that user X has ever done." In short, sh!t happens. "Everything I do on…

Eric Schmidt: "If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place." People have taken this different ways, but personally I think it's sage advice. We've lost our ability to keep secrets. Information wants to be free. We're terrible at digital security. Pretend everything you type into a computer is on the front page of the New York Times.

A case of "do as I say and not as I do". Besides Eric Schmidt is powerful and rich enough to stop people from talking. Not exactly a level playing field there.

Maybe Eric should not have a private Instagram account which follows young models. Maybe Eric should not ask Google to delete results about his political donations.

Re: Twitter warns that private tweets were public for years

#132

Post by jakear »

jerf wrote: post #91

I've noticed a hole in a lot of people's thinking where even if they thing to write automated testing or QA testing to ensure that a given thing is available to a certain user or role, there is often not a lot of thought given to writing tests to enure that users or roles that should not have access to the data can't get it. I'm not sure I've ever found a permission system without explicit testing that the denials wo…

Testing a negative is much more difficult. Testing the positive is “can this user access this private data using this procedure”. Testing the negative is “can any use access any private data using any procedure”. That’s almost impossible to verify.

Re: Twitter warns that private tweets were public for years

#133

Post by enraged_camel »

mrspeaker wrote: post #65
bilbo0s wrote: post #9

Just my own opinion, but at this point I think it's prudent to assume that pretty much anything you send out into the digital network world is public. If it's not something you would want the world knowing you said, don't put it out there. Security breaches happen. Bugs happen. Sometimes law enforcement just comes by and says, "Give me everything that user X has ever done." In short, sh!t happens. "Everything I do on…

I'm often surprised how much people share via Slack as if it's an impenetrable fortress: perfect for pasting admin passwords, keys, and incriminating opinions and business secrets... if that floodgate ever opens then it will be a crazy time for us devs!

Security is always a matter of cost vs. benefit, i.e. you need to weigh the cost of the risk (likelihood * impact) with the benefit of the action.

For example, I have shared credentials on Slack before, but that's because said credentials were for a non-critical system, and if hackers somehow a) hacked Slack and b) identified the information I shared and used it, the only thing they would get their hands on would be a curated collection of cat pictures with funny captions (and I don't re-use passwords).

Therefore, blanket rules like "don't share credentials on Slack" tend to miss the point. Obviously, don't share your bank account info on there. But you can totally talk about otherwise sensitive stuff if the risk profile is sufficiently negligible.

Re: Twitter warns that private tweets were public for years

#134

Post by setquk »

bookofjoe wrote: post #130
setquk wrote: post #111

Earlier quoted context omitted.

Yes I worked for a totally airgapped defence contractor many years ago. It was very boring :)

2015: https://www.techrepublic.com/article/air-gapped-computers-ar... 2018: https://www.tektonikamag.com/index.php/2018/05/18/your-air-g... 2018: https://www.zdnet.com/article/how-safe-is-your-air-gapped-pc...

It was an RF tight triple wall secure engineering facility with no windows and power filtering. Vehicles and people searched on entry and exit. They knew very well of these risks a long time ago. To give you an idea, the building was designed in the 1950s where they even had dampers on the water pipes coming on site due to the use of typewriters historically.

Re: Twitter warns that private tweets were public for years

#135

Post by lotyrin »

vollmond wrote: post #117
marcosdumay wrote: post #98

Earlier quoted context omitted.

All those lines would be better with ", except when you want it to" appended at the end.

The entire point of the post is that "what you want" doesn't apply to this.

GP's point was, I think, that if you wish for something to be permanent, then it won't be (have backups). Not exactly relevant but not contrary to the core concept we're discussing (being pessimistic about the quality of service).

Re: Twitter warns that private tweets were public for years

#137

Post by burtonator »

ams6110 wrote: post #68
burtonator wrote: post #62

Earlier quoted context omitted.

I'm working on an app with some social collaboration features: https://getpolarized.io/ These security breaches are really screwing me over. Our user base is really really pissed at Facebook, Twitter, etc. and the pendulum has swung the other direction. I think they're borderline paranoid about sharing their data. I mean whether they are justified or not is one thing but I definitely do not personally have any nefari…

Even a service without nefarious goals can have a breach. The biggest companies that devote huge teams of people to preventing them still have them. Can happen to anyone.

Oh certainly ... I agree. I think the point I'm trying to make is that most of the things we're storing aren't classified docs.

Re: Twitter warns that private tweets were public for years

#138

Post by dymk »

mikestew wrote: post #31
dymk wrote: post #23

Earlier quoted context omitted.

A very poor analogy when encryption exists

Who said skywriting can't use encryption?

What skywriting uses encryption? How is that a useful metaphor for describing the downsides of "cloud storage"?

Re: Twitter warns that private tweets were public for years

#139

Post by jen20 »

schaefer wrote: post #81
VikingCoder wrote: post #55

Earlier quoted context omitted.

Eric Schmidt: "If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place." People have taken this different ways, but personally I think it's sage advice. We've lost our ability to keep secrets. Information wants to be free. We're terrible at digital security. Pretend everything you type into a computer is on the front page of the New York Times.

^^^ VikingCoder: That's simultaneously an admirable ethical stance... ...and total BS. Put your money where your mouth is. Post your full banking and personally identifying details immediately, without hesitation or regret. If you;d rather not, maybe you actually agree that not all issues of privacy come down to ethics. Some details of a person's life really do deserve privacy.

Furthermore, for Eric Schmidt (of all people) to be taken seriously when he says this kind of thing, he should publish all of his personal data too.

Re: Twitter warns that private tweets were public for years

#140

Post by PhasmaFelis »

VikingCoder wrote: post #55
bilbo0s wrote: post #9

Just my own opinion, but at this point I think it's prudent to assume that pretty much anything you send out into the digital network world is public. If it's not something you would want the world knowing you said, don't put it out there. Security breaches happen. Bugs happen. Sometimes law enforcement just comes by and says, "Give me everything that user X has ever done." In short, sh!t happens. "Everything I do on…

Eric Schmidt: "If you have something that you don’t want anyone to know, maybe you shouldn’t be doing it in the first place." People have taken this different ways, but personally I think it's sage advice. We've lost our ability to keep secrets. Information wants to be free. We're terrible at digital security. Pretend everything you type into a computer is on the front page of the New York Times.

Am I missing something? That seems to be equivalent to "the innocent have nothing to fear" in assuming that no one is ever persecuted who doesn't deserve it.
Post reply on HN