Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

Post by jjulius » Thu, Aug 25, 2022, 2:45 AM UTC

semiquaver wrote: post #630

jjulius wrote: post #605

Earlier quoted context omitted.

>Why debate what the timelines implied by various articles are when the primary source is available and makes a clear statement on this matter? Probably because most of us in the chain you're replying to didn't have the time to read an 84-page source document in the middle of a work day (note the time of our comments and how late to this particular chain you are), hoping that a nugget of information like that would b…

I didn’t intend any snark, it was an honest question. Apologies for having offended you.

Post by p_l » Thu, Aug 25, 2022, 8:11 AM UTC

galangalalgol wrote: post #570

fshr wrote: post #567

Earlier quoted context omitted.

There's obviously a lot of legacy Ada out there, but would you say it's 'typical' for new code being written? I don't have that sense. There's probably more MISRA C/++ code floating around at this point. I have no idea how compliant SX is, but I've heard mentions of Power of 10 rules and JPL standards. For what it's worth, their track record doesn't seem concerning nowadays.

I think commercial avionics is the only place you still find ada. Cars have been c or c++ even for safety critical for many years. Even defense abandoned ada well over a decade ago, and they invented it right? And medical jumped right on the windows ce bandwagon as soon as it popped up... I feel like a good pipelene with lots of static analysis asan, and really good tests is probably the best you can expect out of sa…

Post by leaflets2 » Thu, Aug 25, 2022, 10:08 AM UTC

mrex wrote: post #110

markwisde wrote: post #100

Earlier quoted context omitted.

Nobody seems to know how you can build a successful security org

Building a successful security organization is very easy, it just starts higher up the food chain than whatever experts you hire to do it. Security is a cultural practice, it's not a feature, it's not a bolt-on. To the extent that your security organization influences and receives buy-in from your corporate culture, becoming a part of your organization's identity, it will be successful.

Post by scott00 » Thu, Aug 25, 2022, 3:36 PM UTC

AtlasBarfed wrote: post #621

scott00 wrote: post #542

Earlier quoted context omitted.

That's not really how auditors work. Auditors either give the client a letter saying what the client wants it to say[0] or decline to provide the client with that letter. They do not go public with their reasons. [0] Companies want the letter to say whatever their regulators and/or contractual obligations demand that it say.

If a public company gets an accounting audited and they find irregularities it is not subject to public disclosure requirements? Twitter is a publicly held company. I'm sure there are conflicts of interest and some degree of confidentiality for auditors and clients, but there is a fundamental public interest of disclosure, at a minimum to the government, in the event of irregularities. From the SEC: "In addition, we…

Post by bart_spoon » Thu, Aug 25, 2022, 6:26 PM UTC

cloutchaser wrote: post #612

bart_spoon wrote: post #603

Earlier quoted context omitted.

The man injected himself into an ongoing crisis he had little insight into, and when rejected, his ego was so hurt that he used his influence to accuse individuals he knew nothing about if pedophilia, all while they were in the midst of trying to rescue a dozen children from imminent death. That’s not a “major error in judgement”. That’s the behavior of a completely deranged individual.

> completely deranged individual That's quite a large exaggeration. I can think of some much much worse things that an actual "completely deranged individual" would do. Musk was butthurt and lashed out. That does not equal "completely deranged individual"