8 ms·

So strange that twitter can't automatically filter these. The message format is pretty consistent. Surely they could write something to at least put tweets matc

by ben174 6y ago

So strange that twitter can't automatically filter these. The message format is pretty consistent. Surely they could write something to at least put tweets matching this pattern in a moderation queue.

ageitgey 6y ago
They are blocking tweets with that address now. I'm guessing that they still have no idea what the root cause is.
- byteshock 6y ago
  Somebody is getting fired today... Edit: I was only making a joke, relax. Most likely it’s not a single person’s mistake. It’s just something you say when shit hits the fan.
  - floatingatoll 6y ago
    Promoting, praising, or otherwise endorsing the kind of reaction you state is inexcusable in IT Operations. Your unstated assumptions-by-framing are: 1) A single person is responsible for the flaw. 2) A single person is either already under performance review or committed gross neglect of duties. 3) The above single person will be terminated rather than retrained. If this is how you would speak about your own employees during a security incident, your business deserves to fail. If this is how you expect to be treated by your employer during a security incident, you should seek employment elsewhere.
    - VectorLock 6y ago
      So saying one person should be fired is not okay, but saying a whole business should be fired is okay?
    - kgraves 6y ago
      jeez, they said it's just a joke...
      - floatingatoll 6y ago
        They used the edit function to walk back their comment as a 'joke' after my post was submitted, and managed to make things worse in the process. Would you joke about firing someone for a mistake during an interview? I would consider that a dealbreaker if I were interviewing someone, as in "this interview is over, go home". Do you consider HN an appropriate forum for pithy one-liner jokes that do not contribute to the discussion? Reconsider.
    - secondcoming 6y ago
      Calm down
    - VRay 6y ago
      That dude is talking the exact way a lot of execs think. If this is due to one person's screw-up, that person is going to get railroaded out of the company's back door. I saw this happen before. A newish IT guy accidentally deployed a script to a few hundred machines that took down the whole worldwide intranet for a multi-billion dollar juggernaut for an hour or so. He was supposedly forgiven, but ended up on a "performance improvement plan" where he had a bunch of impossible tasks, and every shortcoming was documented to use against him until he was fired. I wish things worked the way you think they do, or if not that way, I wish they'd at least just shitcan the dude on the spot (with a few months' severance) and be done with it.
      - dvtrn 6y ago
        I don’t know what form it would or even should take but these kinds of “Performance Improvement Plans” where the person being coached is set up for failure needs some kind of alternative that incentivizes employers to either responsibly dismiss the person or otherwise be genuine with “performance improvement”. These tactics are hard to prove if someone goes to court over it (probably) but are just as hard to recover emotionally from and can stunt a person all the way to their next job or many.
        mc32 6y ago
        So when you see those impossible job descriptions that no one can possibly meet, that is your cover. It's not fair, but sometimes you just don't fit in and the team has to get rid of the fly in the ointment.
      - corobo 6y ago
        If you ever get put on a PIP for a reason that's obviously to get rid of you as fast as possible, have a quiet word with someone in power and float the idea of a settlement agreement. You might even get a free laptop out of it.. (This comment is only considering employment in the UK)
        mc32 6y ago
        In the US it's true companies get indemnity for this, but they also usually have better lawyers than you do, so most will play hardball and you lose and then when a company does a background search on you and see litigiousness... it's better to take your losses and move on.
    - aaron695 6y ago
      So CEOs should never be fired for IT fuckups even with gross negligence and it seriously hurts someone?
      - floatingatoll 6y ago
        It depends, same as it does for an employee. Is there a history of negligence? Did they refuse to consider warnings of risk that were presented? Did they or their peers brief their management on the risk?
    - mdpye 6y ago
      While I agree 100% with your response in general, Twitter are suggesting this is an inside job (the "social engineering" line looks like a cover for "someone has been paid for internal access"). If that's true, then someone is definitely getting fired today, and a whole lot more than fired to follow!
      - floatingatoll 6y ago
        If confirmed, that would definitely be an appropriate scenario for someone to be fired.
  - ahelwer 6y ago
    Unlikely. That isn't how hacks or outages are punished in large software service orgs, unless it was intentional or due to negligence like disabling a failing test to get something shipped to prod.
maaarghk 6y ago
Apparently all tweets containing seemingly random strings of characters are blocked: https://twitter.com/NepalBlockchain/status/1283537582249218048 https://twitter.com/NepalBlockchain/status/12835375822492180...
- TRcontrarian 6y ago
  Facebook Messenger is blocking me from sending any string containing the attacker's wallet address bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh. I'm trying to send blockchain explorer URL's to friends and it's failing.
  - esperent 6y ago
    Facebook messenger has extremely sensitive filters. It seems to block most links I try to send. Most recently, I tried to send a GIF of a beautiful city on a river to my girlfriend. Nope, blocked. The link was a GIF sharing site, I don't remember which one, but it's highly unlikely there's any malware on it so it must be a porn filter. And as for sending links to my staging site to a couple of tech friends... forget about it.
- nexuist 6y ago
  How would you write a regex that does this? How do you determine whether a string of characters is random?
  - Blackthorn 6y ago
    The classic way to do it is see how well it compresses, though that requires a certain minimum length.
  - Cthulhu_ 6y ago
    You can probably calculate the entropy / randomness of a string via a fairly simple algorithm.
- Cthulhu_ 6y ago
  Reminds me of a thing years ago where a virus used a Twitter account's messages as its command & control system. Said twitter account encoded the commands in base64 I believe.

by ben174 6y ago

ageitgey 6y ago

They are blocking tweets with that address now. I'm guessing that they still have no idea what the root cause is.

byteshock 6y ago
Somebody is getting fired today... Edit: I was only making a joke, relax. Most likely it’s not a single person’s mistake. It’s just something you say when shit hits the fan.
- floatingatoll 6y ago
  Promoting, praising, or otherwise endorsing the kind of reaction you state is inexcusable in IT Operations. Your unstated assumptions-by-framing are: 1) A single person is responsible for the flaw. 2) A single person is either already under performance review or committed gross neglect of duties. 3) The above single person will be terminated rather than retrained. If this is how you would speak about your own employees during a security incident, your business deserves to fail. If this is how you expect to be treated by your employer during a security incident, you should seek employment elsewhere.
  - VectorLock 6y ago
    So saying one person should be fired is not okay, but saying a whole business should be fired is okay?
  - kgraves 6y ago
    jeez, they said it's just a joke...
    - floatingatoll 6y ago
      They used the edit function to walk back their comment as a 'joke' after my post was submitted, and managed to make things worse in the process. Would you joke about firing someone for a mistake during an interview? I would consider that a dealbreaker if I were interviewing someone, as in "this interview is over, go home". Do you consider HN an appropriate forum for pithy one-liner jokes that do not contribute to the discussion? Reconsider.
  - secondcoming 6y ago
    Calm down
  - VRay 6y ago
    That dude is talking the exact way a lot of execs think. If this is due to one person's screw-up, that person is going to get railroaded out of the company's back door. I saw this happen before. A newish IT guy accidentally deployed a script to a few hundred machines that took down the whole worldwide intranet for a multi-billion dollar juggernaut for an hour or so. He was supposedly forgiven, but ended up on a "performance improvement plan" where he had a bunch of impossible tasks, and every shortcoming was documented to use against him until he was fired. I wish things worked the way you think they do, or if not that way, I wish they'd at least just shitcan the dude on the spot (with a few months' severance) and be done with it.
    - dvtrn 6y ago
      I don’t know what form it would or even should take but these kinds of “Performance Improvement Plans” where the person being coached is set up for failure needs some kind of alternative that incentivizes employers to either responsibly dismiss the person or otherwise be genuine with “performance improvement”. These tactics are hard to prove if someone goes to court over it (probably) but are just as hard to recover emotionally from and can stunt a person all the way to their next job or many.
      - mc32 6y ago
        So when you see those impossible job descriptions that no one can possibly meet, that is your cover. It's not fair, but sometimes you just don't fit in and the team has to get rid of the fly in the ointment.
    - corobo 6y ago
      If you ever get put on a PIP for a reason that's obviously to get rid of you as fast as possible, have a quiet word with someone in power and float the idea of a settlement agreement. You might even get a free laptop out of it.. (This comment is only considering employment in the UK)
      - mc32 6y ago
        In the US it's true companies get indemnity for this, but they also usually have better lawyers than you do, so most will play hardball and you lose and then when a company does a background search on you and see litigiousness... it's better to take your losses and move on.
  - aaron695 6y ago
    So CEOs should never be fired for IT fuckups even with gross negligence and it seriously hurts someone?
    - floatingatoll 6y ago
      It depends, same as it does for an employee. Is there a history of negligence? Did they refuse to consider warnings of risk that were presented? Did they or their peers brief their management on the risk?
  - mdpye 6y ago
    While I agree 100% with your response in general, Twitter are suggesting this is an inside job (the "social engineering" line looks like a cover for "someone has been paid for internal access"). If that's true, then someone is definitely getting fired today, and a whole lot more than fired to follow!
    - floatingatoll 6y ago
      If confirmed, that would definitely be an appropriate scenario for someone to be fired.
- ahelwer 6y ago
  Unlikely. That isn't how hacks or outages are punished in large software service orgs, unless it was intentional or due to negligence like disabling a failing test to get something shipped to prod.

maaarghk 6y ago

Apparently all tweets containing seemingly random strings of characters are blocked: https://twitter.com/NepalBlockchain/status/1283537582249218048 https://twitter.com/NepalBlockchain/status/12835375822492180...

TRcontrarian 6y ago
Facebook Messenger is blocking me from sending any string containing the attacker's wallet address bc1qxy2kgdygjrsqtzq2n0yrf2493p83kkfjhx0wlh. I'm trying to send blockchain explorer URL's to friends and it's failing.
- esperent 6y ago
  Facebook messenger has extremely sensitive filters. It seems to block most links I try to send. Most recently, I tried to send a GIF of a beautiful city on a river to my girlfriend. Nope, blocked. The link was a GIF sharing site, I don't remember which one, but it's highly unlikely there's any malware on it so it must be a porn filter. And as for sending links to my staging site to a couple of tech friends... forget about it.
nexuist 6y ago
How would you write a regex that does this? How do you determine whether a string of characters is random?
- Blackthorn 6y ago
  The classic way to do it is see how well it compresses, though that requires a certain minimum length.
- Cthulhu_ 6y ago
  You can probably calculate the entropy / randomness of a string via a fairly simple algorithm.
Cthulhu_ 6y ago
Reminds me of a thing years ago where a virus used a Twitter account's messages as its command & control system. Said twitter account encoded the commands in base64 I believe.