5 ms·
It's probably more difficult for social media companies like Twitter to prevent something like this than it is to actually properly secure and protect user data
by FillardMillmore 7y ago
It's probably more difficult for social media companies like Twitter to prevent something like this than it is to actually properly secure and protect user data.
- thrower123 7y agoEven Twitter money pales in comparison to sheik money. I'm not sure you can defend against somebody giving an engineer with admin access a suitcase with $300k in it. Not to mention any other pressures that MBS could potentially have brought to bear in these cases.
- chii 7y agoHow do banks defend against insider trying to rob it? I'm sure twitter can do it - it's a matter of cost vs benefits. They don't want to spend the money required to secure access and audit.
- toomuchtodo 7y agoInsider risk controls and oversight, two person systems, data loss prevention, etc.
- smcl 7y agoThink that was a rhetorical question
- henryfjordan 7y agoThat is GP's point, that no engineer should have admin access to PII when you are operating at Twitter scale. Or at least not without a lot of red tape to make it very easy to catch rule breakers.
- thrower123 7y agoPart of it is, Twitter doesn't fully think of itself as Twitter-scale. It's not that long ago that Twitter was fail-whaling around, a non-serious place for stream-of-consciousness shitposting by anonymous egg accounts. It's still move-fast-and-break-things. Someone else made the comparison to banks, and well, banks deal with real money and have always been dead serious, and they've got decades of head start on handling this stuff properly.
- FillardMillmore 7y agoVery true, when the means meet the will or motivation, this sort of thing is bound to happen, especially as these Silicon Valley companies have so much influence. I hope this doesn't become a trend, lest we get calls for a "Silicon Valley blacklist" ala Hollywood during the Cold War. https://en.m.wikipedia.org/wiki/Hollywood_blacklist https://en.m.wikipedia.org/wiki/Hollywood_blacklist
- foobiekr 7y agoI wonder what the maximum here is. Cash is harder to spend than it used to be and in addition you’d be at risk that the actual people facilitating the payment delivery would be your biggest risk since it would be very likely they would turn around later and rob/murder you. There’s probably some optimal “suitcase full of cash” number that basically optimizes for spendability and risk.
- adolph 7y agoMaybe it could be a house or other asset bought for a less than market amount or sold for a greater than market amount. Example: https://www.insidehighered.com/admissions/article/2019/04/08/report-purchase-coachs-house-brings-admissions-scandal-harvard https://www.insidehighered.com/admissions/article/2019/04/08...
- Touche 7y agoWhy would they murder you when you have access to invaluable data they can get from you at any time? If anything they might blackmail you to do future investigations for cheaper, but why would they mess with a good thing? We're talking about people who can basically print money.
- adrr 7y agoAudit log around administration tool with frequent reviews of the log. Banks and financial firms do this type of auditing all the time. The consequences just need to be there to incentivize social media companies to take action.
- raxxorrax 7y agoBut for financial data there is a mssive industry for auditing problems. I would like that because it would make administrating user data extremely expensive, but I don't see it becoming feasible.
- swalsh 7y agoI work on a big data system in the healthcare industry. Every query executed on the database is logged.