3 ms·

> Dorsey should sue and sue and sue and not settle and get these companies to unfuck themselves. If you are a captain of a ship that sees an out of control oil

> Dorsey should sue and sue and sue and not settle and get these companies to unfuck themselves. If you are a captain of a ship that sees an out of control oil tanker heading for it, the solution is not to sue the oil tanker owners, rather it is to get out of its way which in Jack's case should be ordering an immediate implementation of a non-SMS 2FA

tialaramex 7y ago
COLREGs (international rules to not have collisions at sea on account of everybody is agreed that would be bad) A.2b. "In construing and complying with these rules due regard shall be had to all dangers of navigation and collision and to any special circumstances, including the limitations of the vessels involved, which may make a departure from these rules necessary to avoid immediate danger" Basically, if obeying the other rules mean you'll get hit by an oil tanker, Rule 2b says ignore those other rules so that you don't get hit by an oil tanker. So yeah, Jack ought to order his engineers to go fix this.
- jxcl 7y ago
  In case anyone regularly has trouble not getting hit by an Oil Tanker, I'd like to recommend John W. Trimmer's excellent book: How to Avoid Huge Ships[1]. [1]: https://www.amazon.com/Avoid-Huge-Ships-John-Trimmer/dp/0870334336/ref=sr_1_1?keywords=how+to+avoid+huge+ships&qid=1568222579&s=gateway&sr=8-1 https://www.amazon.com/Avoid-Huge-Ships-John-Trimmer/dp/0870...
chimeracoder 7y ago
> which in Jack's case should be ordering an immediate implementation of a non-SMS 2FA Twitter supports U2F. Jack Dorsey just prefers not to use it, according to reports.
- notyourday 7y ago
  U2F requires the presence of SMS fallback. It cannot be disabled as of two days ago when I tried it last.
  - chimeracoder 7y ago
    > U2F requires the presence of SMS fallback. It cannot be disabled as of two days ago when I tried it last. The original statement is: > 1 point by chimeracoder 11 minutes ago | parent | edit | favorite | on: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap... > which in Jack's case should be ordering an immediate implementation of a non-SMS 2FA Which, as I point out, is superfluous, because Twitter already has three other forms of non-SMS 2FA. Twitter does also support SMS-based password reset, which is a problem, but that's not actually how Jack Dorsey's account got hacked in the first place. Aside from any improvements to Twitter's security practices that could be made, Jack Dorsey himself was not using the existing security features that Twitter already offers. Which is the real problem.
    - notyourday 7y ago
      I am not Twitter's CEO. I'm twitter's user. I cannot use that feature without opening my account to this attack. Therefore that feature for all intended purposes does not exist because it is unusable for the purpose of protecting the account.
khalilravanna 7y ago
Why not both? Steer the ship aside (give directive to product/engineering teams to implement proper 2FA) while calling your lawyer.

tialaramex 7y ago

COLREGs (international rules to not have collisions at sea on account of everybody is agreed that would be bad) A.2b. "In construing and complying with these rules due regard shall be had to all dangers of navigation and collision and to any special circumstances, including the limitations of the vessels involved, which may make a departure from these rules necessary to avoid immediate danger" Basically, if obeying the other rules mean you'll get hit by an oil tanker, Rule 2b says ignore those other rules so that you don't get hit by an oil tanker. So yeah, Jack ought to order his engineers to go fix this.

jxcl 7y ago
In case anyone regularly has trouble not getting hit by an Oil Tanker, I'd like to recommend John W. Trimmer's excellent book: How to Avoid Huge Ships[1]. [1]: https://www.amazon.com/Avoid-Huge-Ships-John-Trimmer/dp/0870334336/ref=sr_1_1?keywords=how+to+avoid+huge+ships&qid=1568222579&s=gateway&sr=8-1 https://www.amazon.com/Avoid-Huge-Ships-John-Trimmer/dp/0870...

chimeracoder 7y ago

> which in Jack's case should be ordering an immediate implementation of a non-SMS 2FA Twitter supports U2F. Jack Dorsey just prefers not to use it, according to reports.

notyourday 7y ago
U2F requires the presence of SMS fallback. It cannot be disabled as of two days ago when I tried it last.
- chimeracoder 7y ago
  > U2F requires the presence of SMS fallback. It cannot be disabled as of two days ago when I tried it last. The original statement is: > 1 point by chimeracoder 11 minutes ago | parent | edit | favorite | on: Hackers Hit Twitter CEO Jack Dorsey in a ‘SIM Swap... > which in Jack's case should be ordering an immediate implementation of a non-SMS 2FA Which, as I point out, is superfluous, because Twitter already has three other forms of non-SMS 2FA. Twitter does also support SMS-based password reset, which is a problem, but that's not actually how Jack Dorsey's account got hacked in the first place. Aside from any improvements to Twitter's security practices that could be made, Jack Dorsey himself was not using the existing security features that Twitter already offers. Which is the real problem.
  - notyourday 7y ago
    I am not Twitter's CEO. I'm twitter's user. I cannot use that feature without opening my account to this attack. Therefore that feature for all intended purposes does not exist because it is unusable for the purpose of protecting the account.

khalilravanna 7y ago

Why not both? Steer the ship aside (give directive to product/engineering teams to implement proper 2FA) while calling your lawyer.