Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

cnn.com

Post reply on HN
Print view View original

291–300 of 645 posts

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#291

Post by nullc »

motohagiography wrote: post #129

The whistleblowing case is a new dimension. To me as an outsider it implies Agrawal may have also been the manager in his previous technical role for a lot of the tech problems Zatko identified, and what made Agrawal CEO was his ability to leverage these problems to play ball with all the interests in that company and board, while sustaining through neglect some of those concerning practices within the organization.…

Part of the allegation seems to be that the beneficiaries may be foreign state actors who have infiltrated the organization.

Not particularly shocking as they'd have to be incompetent to not try to infiltrate a major communications platform, and if the internal controls are as bad as alleged (and has exposed in some of the prior hacks, e.g. the control panel screenshots) they'd have to be incompetent to fail.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#292

Post by [deleted] »

purpleblue wrote: post #167

Millenials and GenZ may have no idea who Mudge is. I, however, almost lost my first job out of college at a bank because I ran l0phtcrack against our Windows NT 4 server to see if it could crack passwords. I showed my boss, and he pulled me aside into another room and tore my head off for irresponsibly running this tool against a production server. He said I could have been fired if this got out, but he covered my as…

[deleted]

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#294

Post by mrex »

sroussey wrote: post #276
mrex wrote: post #172

Earlier quoted context omitted.

Some options that shareholders would have in the situation where investors were knowingly deceived by false disclosures of a publicly traded company are missing from this response.

Their disclosures are similar to this: we check for bots, use a process, the process could be wrong.

Mudge alleges that their disclosures were a less than good faith attempt to gauge the figure.

Mudge also raises a number of allegations not pertaining to bots, including that Twitter has deliberately failed to abide by the terms of a federal consent decree. If proven out, that fact alone would constitute material adverse affect.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#295

Post by hn_throwaway_99 »

jonahbenton wrote: post #33
Signez wrote: post #3

This excerpt is frightening: > About half of the company's 500,000 servers run on outdated software that does not support basic security features such as encryption for stored data or regular security updates by vendors

The "does not support basic security features such as encryption for stored data" unquoted line of reporting is almost certainly not what Mudge wrote and is likely not literally true. That 500k servers in Twitter infra are missing patches certainly is true and what was likely in the original was a statement that stored data that should have been encrypted at rest was not, and/or that acceptable standards for data at…

I have discovered that there are vastly different definitions of "encryption for stored data" that can mean critically different things for security.

One definition is "the underlying disk is encrypted". This is true, by default, of virtually all cloud environments these days. But it really only protects you against physical access to the storage media, which actually is far from the top threat.

The other, more useful/meaningful definition, is "we encrypt everything at the application layer before it is placed into the DB, and all decryption requests are logged by user". For example, using an envelope encryption scheme to encrypt data before it is stored in a DB, and upon retrieval decrypting the data with a call to something like KMS. In that environment you can literally give readonly DB access to all your developers and not have to worry about PII being exposed. If hackers somehow got access to your DB, they wouldn't be able to read sensitive data, and if they also managed to get access to your KMS credentials, any attempts to decrypt the data would be tracked and logged.

My point is that when many companies say "we encrypt your data", they are usually just talking about the first thing, but that doesn't really provide that much additional security. The second definition is really what you should be doing.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#296

Post by speeder »

Beldin wrote: post #189
winternett wrote: post #89

Honestly, can you really trust anything about major social media sites any more? Has Twitter ever been in the news for properly making even a thousand people successful from scratch really ever in the product's life? They have pipelines of exploitation for everyone that gets "discovered" into contractual nightmare deals, they require tons of free labor and costly hurdles just to become notable and visible on the plat…

> Has Twitter ever been in the news for properly making even a thousand people successful from scratch really ever in the product's life? There was the Arab Spring ( https://en.m.wikipedia.org/wiki/Arab_Spring ), where it played a significant role.

I wouldn't consider that as the success op means...

I mean, surely, it some people were successful, but success of warlords intending to genocide blacks in Lybia or starting a new violent caliphate or kidnapping boys en masse to be child soldiers is not the sort or success I want to be enabled with technology.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#297

Post by crow_t_robot »

When is mudge going to audit tesla/spacex for "non-compliant kernels", "encryption at rest", etc, etc?

Everyone in this shameful industry knows that literally any company in the US would get shredded in such a vigorous audit and the silliest part is that twitter is a fucking shitposting platform that doesn't have my SSN or financial data so equating it to equifax in any way is absolutely laughable.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#298

Post by akkartik »

jonahbenton wrote: post #33
Signez wrote: post #3

This excerpt is frightening: > About half of the company's 500,000 servers run on outdated software that does not support basic security features such as encryption for stored data or regular security updates by vendors

The "does not support basic security features such as encryption for stored data" unquoted line of reporting is almost certainly not what Mudge wrote and is likely not literally true. That 500k servers in Twitter infra are missing patches certainly is true and what was likely in the original was a statement that stored data that should have been encrypted at rest was not, and/or that acceptable standards for data at…

No need to speculate, thanks to the links provided by mzs at https://news.ycombinator.com/item?id=32562815#32564900

From https://www.washingtonpost.com/technology/interactive/2022/t..., page 6:

"..more than half of Twitter's 500,000 servers are running out-of-date operating systems so out of date that many do not support basic privacy and security features and lack vendor support. More than quarter of the 10,000 employee computers have software updates disabled! More than half of Twitter employees have access to Twitter's production environment -- unheard of in a company the age and importance of Twitter, where nearly all employees have access to systems or data they should not. At Twitter engineers work on live data when building and testing software because Twitter lacks testing and stage environments; work is conducted instead in production and with live data..

"This did not happen overnight. To get where Twitter is today took.. many years.. required repeated downplaying of problems, selective reporting, and leadership ignorance around basic security expectations and practices."

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#299

Post by stuckinhell »

solarkraft wrote: post #252
stuckinhell wrote: post #222

The bots problem is absolutely nightmare issue for a social network. I can't imagine what I'd do if I discovered my network was fake. The whole point of my network is building professional connections and gaining skills for work. Also seeing various weird topics on twitter like kpop or other random things always made me wonder how much artificial bot boosting was done for those who had money to pay the bot net.

> The whole point of my network is building professional connections and gaining skills for work And you're afraid of getting interesting insights from and interacting with bots ... ?

Well if a Bot could recommend me for a job, I'd feel different.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#300

Post by hn_throwaway_99 »

memling wrote: post #166
hunter-gatherer wrote: post #65

Earlier quoted context omitted.

C has such a bad wrap with the HN crowd...

> C has such a bad wrap with the HN crowd... why?

It really doesn't. After all, many (most?) other languages like Java and JavaScript are implemented primarily in C and/or C++.

Where it gets deserved opprobrium is that it has no memory safety features, and thus inherently contributes to gobs of security vulnerabilities, and there are safer alternatives now, like Rust.

C is basically "portable assembly", and it's rarely the right tool for the job these days.

Post reply on HN