Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Twitter Says Parts of Its Source Code Were Leaked Online

nytimes.com

Post reply on HN
Print view View original

11–20 of 28 posts

Re: Twitter Says Parts of Its Source Code Were Leaked Online

#11

Post by seanieb »

textadventure wrote: post #7

"It was unclear how long the leaked code had been online, but it appeared to have been public for at least several months." Interesting. I wonder what the repo was called, I imagine it couldn't have been anything extremely obvious or we would have heard about this earlier.

Yahoo!'s cache still has a cache of the page: https://cc.bingj.com/cache.aspx?q=https%3a%2f%2fgithub.com%2...

It wasn't obliviously named at all. The toplevel folders were:

- adp

- ann

- auth

- aws-dal-reg-svc

The README.md file just said "PublicSpace"

And the breakdown of languages used is odd for twitter: - Scala 56.2%

- Java 27.3%

- Python 7.9%

- Starlark 4.7%

- Shell 2.4%

- Thrift 1.2%

- Other 0.3%

Re: Twitter Says Parts of Its Source Code Were Leaked Online

#12

Post by lapcat »

jonny_eh wrote: post #10
lapcat wrote: post #9

> One concern is that the code includes security vulnerabilities I find this kind of funny, because open source is typically viewed as a benefit as far as security is concerned. Given how few engineers remain at Twitter, they probably ought to open source their code and allow outsiders to find and fix security vulnerabilities, freeing up Twitter engineers to figure out how in the world to generate revenue for the ser…

For client code sure. Not server code that protects user data that could be exploited with a 0-day exploit.

Linux is open source. PHP is open source. Mastodon is open source.

Ruby on Rails, WordPress, ssh. I'm sure I'm forgetting a bunch of things too.

Re: Twitter Says Parts of Its Source Code Were Leaked Online

#13

Post by Scoundreller »

seanieb wrote: post #11
textadventure wrote: post #7

"It was unclear how long the leaked code had been online, but it appeared to have been public for at least several months." Interesting. I wonder what the repo was called, I imagine it couldn't have been anything extremely obvious or we would have heard about this earlier.

Yahoo!'s cache still has a cache of the page: https://cc.bingj.com/cache.aspx?q=https%3a%2f%2fgithub.com%2... It wasn't obliviously named at all. The toplevel folders were: - adp - ann - auth - aws-dal-reg-svc The README.md file just said "PublicSpace" And the breakdown of languages used is odd for twitter: - Scala 56.2% - Java 27.3% - Python 7.9% - Starlark 4.7% - Shell 2.4% - Thrift 1.2% - Other 0.3%

Appears their user account was created on Jan 3, 2023, so unless it was somewhere else too, it's not exactly "several" months

Re: Twitter Says Parts of Its Source Code Were Leaked Online

#14

Post by wmf »

lapcat wrote: post #9

> One concern is that the code includes security vulnerabilities I find this kind of funny, because open source is typically viewed as a benefit as far as security is concerned. Given how few engineers remain at Twitter, they probably ought to open source their code and allow outsiders to find and fix security vulnerabilities, freeing up Twitter engineers to figure out how in the world to generate revenue for the ser…

Code that's intentionally open source tends to have better security long-term. Proprietary code that was accidentally leaked is pretty bad for security in the short term.

Re: Twitter Says Parts of Its Source Code Were Leaked Online

#15

Post by brianwawok »

lapcat wrote: post #12
jonny_eh wrote: post #10

Earlier quoted context omitted.

For client code sure. Not server code that protects user data that could be exploited with a 0-day exploit.

Linux is open source. PHP is open source. Mastodon is open source. Ruby on Rails, WordPress, ssh. I'm sure I'm forgetting a bunch of things too.

Right. Now go work for a f500. Ask if you can post your source code on GitHub to improve security? There isn’t some magic thing that posting your source does, except in the short term make 0 days 10000x easier.

Re: Twitter Says Parts of Its Source Code Were Leaked Online

#16

Post by mdaniel »

seanieb wrote: post #11
textadventure wrote: post #7

"It was unclear how long the leaked code had been online, but it appeared to have been public for at least several months." Interesting. I wonder what the repo was called, I imagine it couldn't have been anything extremely obvious or we would have heard about this earlier.

Yahoo!'s cache still has a cache of the page: https://cc.bingj.com/cache.aspx?q=https%3a%2f%2fgithub.com%2... It wasn't obliviously named at all. The toplevel folders were: - adp - ann - auth - aws-dal-reg-svc The README.md file just said "PublicSpace" And the breakdown of languages used is odd for twitter: - Scala 56.2% - Java 27.3% - Python 7.9% - Starlark 4.7% - Shell 2.4% - Thrift 1.2% - Other 0.3%

Either the cache entry has expired or (if "bingj.com" is associated with the Bing) I can easily imagine someone in Microsoft "helped" it along

I'll save you the trouble: Wayback only has the DMCA notice since the snapshot was taken today

Re: Twitter Says Parts of Its Source Code Were Leaked Online

#17

Post by nubinetwork »

danso wrote: post #4
erickhill wrote: post #3

Is an anonymous user on Github protected from Twitter learning their actual identity?

I would think their identity is as subject to subpoena as any anon user at any social media service. From the article: > Twitter also asked the U.S. District Court for the Northern District of California to order GitHub to identify the person who shared the code and any other individuals who downloaded it, according to the filing. I wonder if GitHub could be compelled to turn over ever IP that did a git clone?

I wonder if twitter can be compelled to show how they manipulated the website to promote elon tweets /s

https://www.theverge.com/2023/2/14/23600358/elon-musk-tweets...

Re: Twitter Says Parts of Its Source Code Were Leaked Online

#18

Post by nubinetwork »

wmf wrote: post #8
barlo wrote: post #2

This certainly could be uncomfortable for Musk.

He'll just use it as more evidence that the people he laid off deserved to be laid off.

Laid off would imply that they could be rehired at some point... let's just call it what it is... mass firings.

Re: Twitter Says Parts of Its Source Code Were Leaked Online

#19

Post by sverhagen »

lapcat wrote: post #9

> One concern is that the code includes security vulnerabilities I find this kind of funny, because open source is typically viewed as a benefit as far as security is concerned. Given how few engineers remain at Twitter, they probably ought to open source their code and allow outsiders to find and fix security vulnerabilities, freeing up Twitter engineers to figure out how in the world to generate revenue for the ser…

> and allow outsiders to find and fix security vulnerabilities, freeing up Twitter engineers to figure out how

...to boost Musk's tweets.

Re: Twitter Says Parts of Its Source Code Were Leaked Online

#20

Post by wmf »

nubinetwork wrote: post #18
wmf wrote: post #8

Earlier quoted context omitted.

He'll just use it as more evidence that the people he laid off deserved to be laid off.

Laid off would imply that they could be rehired at some point... let's just call it what it is... mass firings.

These terms have accepted meanings and I looked it up just to be sure.

"Being fired means that the company ended your employment for reasons specific to you. Getting laid off means that the company eliminated your position for strategic or financial reasons and not through any fault of yours."

Post reply on HN