Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

cnn.com

Post reply on HN
Print view View original

551–560 of 645 posts

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#551

Post by cgy1 »

colinmhayes wrote: post #469
raarts wrote: post #427

Earlier quoted context omitted.

Musk posted a meme explaining why he pulled out. https://twitter.com/elonmusk/status/1546344529460174849

He literally said he was buying it to fix the bot problem. It's not like he was unaware that bots existed on twitter.

Right? Elon was pretty much insinuating, before the deal, that he thought the bot problem on twitter was much bigger than what Twitter officially stated. And now he's trying to get out of the deal by claiming that the bot problem on twitter was much bigger than what Twitter officially stated.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#552

Post by trasz »

hotpotamus wrote: post #51
vlan0 wrote: post #36

Eh, you could take out Twitter and insert many other company names and it'll still hold true. And those companies hold so much more sensitive data about you than Twitter. I know of insurance companies that have help desk employees with domain admin access. And all crippling ransomware attacks take advantage lax permissions. This is rampant. How is this a story?

Cybersecurity is one of my roles I suppose (small place with an operations team of approximately 2.5), and I have to say that I have no idea what proper security is supposed to mean today; it's very hard for me to tell the marketing from best practice now. It seems like what most products really are is an ass covering service so you can tell your leadership and your customers that you did the right things. Basically…

>It seems like what most products really are is an ass covering service

You do have a pretty good idea then. Sadly, this is exactly what it looks like at the moment: because business decisions are made by clueless dummies, there’s no way to sell a proper product; to make money you need to focus on snake oil instead.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#553

Post by aetherson »

hammock wrote: post #464
gonehome wrote: post #434

Earlier quoted context omitted.

Yeah - but that's dumb bullshit. He can't legally pull out because of that. He waived all of that to force Twitter to agree to the deal (because it'd be basically impossible for the board to reject it). This made sense at the time, because the board was looking for ways to weasel out of it because (imo) they politically don't like Musk. Then the market crashed and suddenly he was overpaying a ton for Twitter, then he…

>I think he earnestly wanted to buy Twitter for principled reasons around speech which I agree with. He structured the deal in such a way where Twitter's board couldn't reject it (because it was so favorable to shareholders). Then when the market tanked the deal way overpriced Twitter, but he had already committed to it so he's trying everything to get out of it. That's not how business valuations work (it's how spec…

I mean, okay. But it's not like he had $44B in cash lying around.

Implicitly, this was always, "I'm going to trade X% of Tesla for 100% of Twitter." Then the valuation of both Twitter and Tesla dropped, so to the extent that you think the "value" of a business is wholly determined by its fundamentals, then okay, they're both still the same "value" but now have lower prices.

Except that he hadn't sold the Tesla yet, so he was trading Tesla (at new lower price) for Twitter (at old higher price), and if you previously thought that X% of Tesla was worth Twitter, and Twitter is still worth the same thing, it's now X+Y% of Tesla.

Of course, it's not like the fundamentals of Twitter didn't change. Twitter's revenue comes from advertising, and it's entirely reasonable to believe that it was actually materially affected by the economic downturn, not just in terms of the speculation of the stock, but by how the business functions.

(None of this is to take the position that Musk ought to be able to back out of the deal: if the market had gone even hotter and now Musk could've traded less than X% of Tesla for the agreed upon, now conservative price for Twitter, it's not like the deal would've been renegotiated.)

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#554

Post by throwaway892238 »

The "whistleblower" is Mudge? Ok, I didn't care before, but if Mudge is putting his reputation on the line, this is probably actually serious and legit.

Literally the entire security community knows and looks up to Mudge. If anyone finds out that anything he said was bullshit, it will get blasted from the rooftops and he'll become a laughing stock. He would have to want the rest of his career to be working for morons and be ostracized from his friends and community to make this shit up.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#555

Post by kjkjadksj »

phpisthebest wrote: post #550
zeruch wrote: post #412

Earlier quoted context omitted.

Yeah, I think we're in lockstep here. I'm no fan of Musk (he's truly worked very hard to be the most provacatively pustulent punkass of tech) but that doesn't mean that Twitter leadership is any better. Just not as well PR'd. Dorsey himself was mostly an imbecile who drank too much of his own Kool Aid. Twitter has for years been the standard bearer for the most opaque, and incoherent content management; from user fee…

What is amusing is I am a fan of musk precisely because "he's truly worked very hard to be the most provacatively pustulent punkass of tech" I tend to like people that blow up social norms and conventions

What like calling a first responder a pedophile?

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#556

Post by colinmhayes »

hammock wrote: post #464
gonehome wrote: post #434

Earlier quoted context omitted.

Yeah - but that's dumb bullshit. He can't legally pull out because of that. He waived all of that to force Twitter to agree to the deal (because it'd be basically impossible for the board to reject it). This made sense at the time, because the board was looking for ways to weasel out of it because (imo) they politically don't like Musk. Then the market crashed and suddenly he was overpaying a ton for Twitter, then he…

>I think he earnestly wanted to buy Twitter for principled reasons around speech which I agree with. He structured the deal in such a way where Twitter's board couldn't reject it (because it was so favorable to shareholders). Then when the market tanked the deal way overpriced Twitter, but he had already committed to it so he's trying everything to get out of it. That's not how business valuations work (it's how spec…

Valuation involves imperfect information. As the information changes so does the valuation.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#557

Post by olliej »

hn_throwaway_99 wrote: post #295
jonahbenton wrote: post #33

Earlier quoted context omitted.

The "does not support basic security features such as encryption for stored data" unquoted line of reporting is almost certainly not what Mudge wrote and is likely not literally true. That 500k servers in Twitter infra are missing patches certainly is true and what was likely in the original was a statement that stored data that should have been encrypted at rest was not, and/or that acceptable standards for data at…

I have discovered that there are vastly different definitions of "encryption for stored data" that can mean critically different things for security. One definition is "the underlying disk is encrypted". This is true, by default, of virtually all cloud environments these days. But it really only protects you against physical access to the storage media, which actually is far from the top threat. The other, more usefu…

I think the good comparison that people encounter day-to-day is full disk encryption. It's the default on macOS, the only option on iOS, (those are the two platforms I use), and I assume the case on windows and android.

The thing is FDE essentially only protects your data when your machine is powered off. Once your machine is booted and you've logged in any block level encryption ceases to be relevant, because to get to the point of running your machine has to have loaded in the relevant key material to decrypt. From that point on user space code no longer sees a difference between encrypted and decrypted drives. In other words FDE is not relevant is you lose a powered on device (post login if relevant to the platform), and you're the kind of person people are actively targeting (I recall recently? the content of someone's phone or such being dumped by the FBI because they grabbed it while it was being used).

That's why modern OS's have different key classes, there's the lowest level which is just FDE, but you can have higher levels where requesting key material essentially just gives you a handle to that material. Then the OS, or preferably hardware with a much less complex OS, manages those handles and invalidates them according to policy rules. e.g you may want your phone to have access to your address book while your phone is locked, which does not mean you need your call history available as well.

The policies provided by OSs tend to be fairly simple because it's better to have an easy to understand API that is easy to use and hard to screw up than a more "powerful" API that is easy to screw up and hard to use (the latter resulting in people simply not encrypting things at all). e.g iOS/macOS only has the following file protections when you create files: "NSFileProtectionComplete", "NSFileProtectionCompleteUnlessOpen", "NSFileProtectionCompleteUntilFirstUserAuthentication", "NSFileProtectionNone", but they're very easy to understand.[1]

I tried to find the android equivalent but I don't know the terminology that's used and I just get linked to instructions on using AES, so if someone could link the correct doc I'd appreciate it.

[1] https://support.apple.com/guide/security/data-protection-cla... and https://support.apple.com/guide/security/keychain-data-prote...

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#558

Post by Bud »

TeeMassive wrote: post #371
encryptluks2 wrote: post #243

Earlier quoted context omitted.

[flagged]

You are making a false comparison. They refused to write a particular message, not to not serve the customer a cake.

False. Get your facts straight before misstating established facts in public. The baker in fact refused to make any cake whatsoever for a same-sex wedding. If you are fuzzy on this, watch the interview with the baker himself in this article:

https://www.nytimes.com/2018/06/04/us/politics/supreme-court...

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#559

Post by titzer »

galangalalgol wrote: post #548
titzer wrote: post #502

Earlier quoted context omitted.

Never been a "fan" of a personality, but I used to really like Tesla and SpaceX, but after hearing a little about how their critical software is...not developed like critical software...I am very wary of what kind of engineering is going over there. With Musk deciding to amp up his celebrity with Twitter antics, I just can't respect him any more.

Can you elaborate? I'm very curious how they develop software.

Without getting into details, AFAICT they do not use any typical high-assurance software stacks, such as Ada or Spark or such that might be typical in avionics, like Airbus software. The use off-the-shelf tools like C++ and LLVM.

Re: Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

#560

Post by Bud »

Banana699 wrote: post #401
themitigating wrote: post #344

Earlier quoted context omitted.

it's not a monopoly because there are alternatives, and it only has a 10% market share in the US ( https://gs.statcounter.com/social-media-stats/all/united-sta... ). The bakery also sets precedent as it did go to the supreme court, and it was used as a rallying cry by politicians on the right.

So, in simpler words, they are indeed a pseudo-monopolistic (pseudo means apparent, something very close to but not quite there) social media giant that can indeed censor millions (10% of USA's population is 30 millions) arbitarily and at will ? Ok :) And whether a bakery serves your gay wedding or not is perhaps the most petty and inconsequential thing to be upset about. There are thousands upon thousands of bakerie…

Discrimination against gays may be "petty" for you, but actually, you're the petty one for saying that.
Post reply on HN