Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies • Hacker News Board

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#181

Post by nonameking2026 » Tue, Aug 23, 2022, 2:17 PM UTC

SilverBirch wrote: post #127

I think it's a pretty open secret that Twitter is a fairly broken company. It's no surprise that their security practices are bad, because all their practices are bad. It's also very difficult to view this in isolation when you have the timeline of (1): Fired in January, nothing happens. (2) Musk makes offer for twitter then reneges. (3) Months before the lawsuit gets decided re-emerges with accusations. What happene…

Mudge: "Jack Dorsey reached out and asked me to come and perform a critical task at Twitter. I signed on to do it and believe I'm still performing that mission," he said."

Seems like a legit answer. No need to accuse people of slinging mud.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#182

Post by SilverBirch » Tue, Aug 23, 2022, 2:20 PM UTC

factorialboy wrote: post #146

SilverBirch wrote: post #127

I think it's a pretty open secret that Twitter is a fairly broken company. It's no surprise that their security practices are bad, because all their practices are bad. It's also very difficult to view this in isolation when you have the timeline of (1): Fired in January, nothing happens. (2) Musk makes offer for twitter then reneges. (3) Months before the lawsuit gets decided re-emerges with accusations. What happene…

> Especially since the Whistleblower seems to basically be blowing the whilst on himself. Whistleblowers are by definition insiders.

Sure, but it's not normally the guy in charge of security that gets to complain the security isn't good enough.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#183

Post by TimCTRL » Tue, Aug 23, 2022, 2:21 PM UTC

SilverBirch wrote: post #127

I think it's a pretty open secret that Twitter is a fairly broken company. It's no surprise that their security practices are bad, because all their practices are bad. It's also very difficult to view this in isolation when you have the timeline of (1): Fired in January, nothing happens. (2) Musk makes offer for twitter then reneges. (3) Months before the lawsuit gets decided re-emerges with accusations. What happene…

Musk's account was among those that were hacked in the 2020 high profile hack. He made the offer in 2022, he therefore can't claim to not have known that twitter's security isn't 100% and really can't use this in court, I guess

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#184

Post by zimpenfish » Tue, Aug 23, 2022, 2:23 PM UTC

thesuperbigfrog wrote: post #137

"Twitter has hidden negligent security practices, misled federal regulators about its safety, and failed to properly estimate the number of bots on its platform, according to testimony from the company’s former head of security, the legendary hacker-turned-cybersecurity-expert Peiter “Mudge” Zatko." "Zatko was fired by Twitter in January and claims that this was retaliation for his refusal to stay quiet about the com…

> Maybe Elon Musk's complaints about Twitter have more merit than anyone expected.

Not the bot complaints, anyway, because "failed to properly estimate the number of bots on its platform" has been covered off by Twitter's consistent "this is how we estimate by sampling, it's a finger in the air guess, could be right, could be miles off, there's no standard methodology for this" stance in their SEC filings since 2013 (which no-one has questioned until now, mind.)

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#185

Post by zimpenfish » Tue, Aug 23, 2022, 2:24 PM UTC

mrex wrote: post #174

philipov wrote: post #171

Earlier quoted context omitted.

His complaints don't hold merit because he entered into a binding agreement to buy Twitter after waiving due diligence rights. Zatko was fired in January. Musk had and waived his chance to discover these things. It's too late now.

>waiving due diligence rights Pop legal quiz - does "waving due diligence rights" during an acquisition remove the other party's liability for fraud they've committed against the prospective buyer?

> the other party's liability for fraud

What fraud though?

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#186

Post by rtkwe » Tue, Aug 23, 2022, 2:25 PM UTC

TimCTRL wrote: post #183

SilverBirch wrote: post #127

I think it's a pretty open secret that Twitter is a fairly broken company. It's no surprise that their security practices are bad, because all their practices are bad. It's also very difficult to view this in isolation when you have the timeline of (1): Fired in January, nothing happens. (2) Musk makes offer for twitter then reneges. (3) Months before the lawsuit gets decided re-emerges with accusations. What happene…

Musk's account was among those that were hacked in the 2020 high profile hack. He made the offer in 2022, he therefore can't claim to not have known that twitter's security isn't 100% and really can't use this in court, I guess

The contract Musk signed was very very one sided, from everything I've been reading there's very little Musk can claim that would let him scuttle the deal.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#187

Post by criddell » Tue, Aug 23, 2022, 2:26 PM UTC

hibikir wrote: post #169

boomboomsubban wrote: post #28

>one or more current employees may be working for a foreign intelligence service. I don't doubt this, but the source is someone with fairly deep ties to the US intelligence services. Why should he be allowed a job and not people with ties to foreign agencies?

I don't believe that what Mudge is saying there is all that well quoted or explained. The argument I've heard him make, in other settings, is that companies that are interesting enough will get job applicants that are really moles for intelligence agencies. This is very difficult to stop, and once your company has enough employees, downright impossible. His recommendation however is not to make it impossible for peop…

> companies that are interesting enough will get job applicants that are really moles for intelligence agencies

Or they will use money or kompromat to turn existing employees.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#188

Post by SilverBirch » Tue, Aug 23, 2022, 2:26 PM UTC

msh wrote: post #173

chihuahua wrote: post #160

Earlier quoted context omitted.

Yes, but that's not the point here. A typical whistleblower would say "There were security problems, and the head of security ignored them." Here, it's "I was the head of security, and security was shitty. I was doing a shitty job, and that's a terrible scandal!"

Its more like "I was head of security and the CEO blocked me and tried preventing me reporting the true state of affairs to the board."

I think the thing about reporting things to the board is extremely open to interpretation. The board doesn't need to know absolutely every skeleton in the closet - especially if you're aware and in the process of fixing something.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#189

Post by Beldin » Tue, Aug 23, 2022, 2:26 PM UTC

winternett wrote: post #89

Honestly, can you really trust anything about major social media sites any more? Has Twitter ever been in the news for properly making even a thousand people successful from scratch really ever in the product's life? They have pipelines of exploitation for everyone that gets "discovered" into contractual nightmare deals, they require tons of free labor and costly hurdles just to become notable and visible on the plat…

> Has Twitter ever been in the news for properly making even a thousand people successful from scratch really ever in the product's life?

There was the Arab Spring (https://en.m.wikipedia.org/wiki/Arab_Spring), where it played a significant role.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#190

Post by Dma54rhs » Tue, Aug 23, 2022, 2:27 PM UTC

core-utility wrote: post #14

bkq wrote: post #2

It is rather disconcerting how a platform that is apparently rather integral to the discourse of today is in the hands of a single private company. It doesn't matter who owns it, if it's Musk or someone else, the fact that it's at the whims of a private company, is the primary channel for discourse, and is something legislatures cannot even comprehend because of their age, should have alarm bells going off. Coupled w…

> the primary channel for discourse Primary for whom? If you polled 50 people on the streets of NYC, I bet fewer than 3 would say they actively use twitter. Now do the same for Des Moines, IA and you maybe get 1?

The three are the elites of society, blue checkmarks - journalists, politicians, propagandists, influencers. For the society as whole they have way more influence where it's going than average Joe in front of corner shop.