Live data from Hacker News

Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

cnn.com

561–570 of 645 posts

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#561

Earlier quoted context omitted.

Oh wait, we already had that, and then we centralized and monopolized the hell out of it [0] [0] https://staltz.com/the-web-began-dying-in-2014-heres-how.htm...

That's because decentralized networks are expensive and can't handle spam unless you make receiving messages opt-in, and then you can't @ people like you can on Twitter.

You can @ people on Mastodon with @user@domain.tld.

I have yet to receive spam on my Mastodon or XMPP address (which I treat like my telephone number).

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#562

Earlier quoted context omitted.

What is amusing is I am a fan of musk precisely because "he's truly worked very hard to be the most provacatively pustulent punkass of tech" I tend to like people that blow up social norms and conventions

What like calling a first responder a pedophile?

Thats a major error in judgement. Even billionaires are capable of this

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#563

Earlier quoted context omitted.

I read the full whistle-blower complaint, and the whole story from his perspective (and the crazy statement from Agrawal) looks like it's not B. Instead, it looks like it was a culture clash with his manager. He seems to have tried to escalate things to people above Agrawal nearly constantly. He was hired by Jack Dorsey, and felt accountable to him and to the board, but he reported to Agrawal, who believed that Mudge…

I wouldn't paint with too broad of a brush in this instance, however. Yes, mudge is the ur-hacker, but also: he worked at BBN and DARPA (where he was extremely effective) and elsewhere. He probably has the most experience of any technical/hacker on the planet of working with executives in large organizations. Agrawal's memo, in contrast, reeks of insecurity. The combination of how he's treated mudge and Rishi Sunak a…

[deleted]

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#564
post #461

Earlier quoted context omitted.

In the long run that would be a good thing. It would be an object lesson that investors shouldn't believe anything they read on social media. Investors always have the option to ignore rumors.

But investors also need to be quick to react if they want to make (serious) money. Ignoring a tweet from a verified account about a disastrous event is not reasonable at all in 99.9% of cases. What I'm trying to say is, you might be able to discredit Twitter, but you won't fix investors trying to invest ahead of the news.

Bullshit. By many measures Warren Buffett is the most successful investor of our time. He is famous for being slow to react, and he has made some serious money. So I think you don't understand investing.

And if some investors lose money then so what? That is an acceptable outcome. Let them suffer, I have zero sympathy.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#565
post #40

Earlier quoted context omitted.

I think it's safe to assume most anything you delete from a web app gets a deleted boolean or timestamp field set and the content persists in the database indefinitely. In my experience I've found it rare that user content is ever actually permanently deleted for various reasons.

I assume that storage has gotten so cheap now that storing everything forever is feasible for companies? I always knew they had to retain content for X period of time, to comply with laws about data retention for criminal investigations, but I always assumed (from reading about it 10+ years ago) that because of how much extra storage space all the "deleted" content would take up, that it wouldn't be feasible for them…

It is. I recall seeing some documentary about Facebook for the exact same thing - that it was cheaper to buy new hard drives and inactivate old content than it is to try to permanently scrub old content, and that was probably 10 years ago.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#566

Earlier quoted context omitted.

> I read the full whistle-blower complaint The content of the complaint is all that matters, and it should be judged on its own merits. It never matters who said what, and attempting to make it matter is ad hominem fallacy; it is what is said that matters. That said, I can't quite fathom why Twitter's cybersecurity matters any more than the cybersecurity of any of the myriad of online forums, HN included: the "data"…

The algorythms are not public, and as the public square of present, Twitter essentially drives public discourse... especially when a large portion of the legacy media has been reduced to sourcing their stories and directly quoting from Twitter. Secondly, private messages between people are not public either. Opening that data up or allowing it to be read or manipulated by other entities will drive a lot of outrage an…

+1. Additionally IP addresses, email and phone numbers can be extremely sensitive if leaked, so security is absolutely paramount. Case in point: imagine the risk to activists or journalists in heavily censored countries.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#567
post #559

Earlier quoted context omitted.

Can you elaborate? I'm very curious how they develop software.

Without getting into details, AFAICT they do not use any typical high-assurance software stacks, such as Ada or Spark or such that might be typical in avionics, like Airbus software. The use off-the-shelf tools like C++ and LLVM.

There's obviously a lot of legacy Ada out there, but would you say it's 'typical' for new code being written? I don't have that sense. There's probably more MISRA C/++ code floating around at this point. I have no idea how compliant SX is, but I've heard mentions of Power of 10 rules and JPL standards. For what it's worth, their track record doesn't seem concerning nowadays.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#568

God Mode, from my understanding, allows a Twitter employee to have access to an account and allows for a post to be made, under that account's id, without the account being notified or seeing the post show up in their own timeline. Is this an accurate statement? If so, why did nearly 1000 employees (12% of the workforce) have access to this mode before it was restricted, and what's the business case for that?

If you read the document "Security Chief's Final Report to Twitter" on the Washington Post article ( https://www.washingtonpost.com/technology/interactive/2022/t... ), you will see that 'god mode' just means they have IPMI access to servers.

The previous "God Mode" worked as I said. I think prior to 2020 when the Bitcoin hacks occurred against Twitter users.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#569
post #42

Earlier quoted context omitted.

The fun thing about social media is that reporters can back up any narrative they want. “People are upset about X”, “Gen Z is doing X”, “Millenails are killing X”. Find two people and it's a confirmed trend!

I saw this happen live and I couldn't believe it. There was this Netflix movie last year called "Kate" that has a white female assassin killing a lot of asian people (it takes place in Tokyo). There were a handful of articles (first in places like Yahoo news and then sites like Slate.com) written about how this is racist and they all quoted people on twitter. Since I was following this movie heavily, I saw the tweets…

It’s hard to read your comment, and the zeitgeist, and then conclude a nonviolent end is the most likely outcome.

These aren’t ideas that can be peacefully mediated.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#570
post #567
post #559

Earlier quoted context omitted.

Without getting into details, AFAICT they do not use any typical high-assurance software stacks, such as Ada or Spark or such that might be typical in avionics, like Airbus software. The use off-the-shelf tools like C++ and LLVM.

There's obviously a lot of legacy Ada out there, but would you say it's 'typical' for new code being written? I don't have that sense. There's probably more MISRA C/++ code floating around at this point. I have no idea how compliant SX is, but I've heard mentions of Power of 10 rules and JPL standards. For what it's worth, their track record doesn't seem concerning nowadays.

I think commercial avionics is the only place you still find ada. Cars have been c or c++ even for safety critical for many years. Even defense abandoned ada well over a decade ago, and they invented it right? And medical jumped right on the windows ce bandwagon as soon as it popped up... I feel like a good pipelene with lots of static analysis asan, and really good tests is probably the best you can expect out of safety critical stuff these days. The days of provably safe software, and certified compilers are probably gone. And if you told me tesla was using folders with dates in the names for version control, and they preferred to test in production, I wouldn't ne surprised. Horrified, but not surprised.
Post reply on HN