9 ms·

Am an admirer of Mudge & co. from back in the day, though my initial reaction was doesn't he seem a bit over powered for Twitter? Their recent security issues w

Am an admirer of Mudge & co. from back in the day, though my initial reaction was doesn't he seem a bit over powered for Twitter? Their recent security issues with that hack were devops management and governance problems, no new science involved, they just dropped the ball on some solved problems. Speculating on what kind of problems Twitter would need that calibre of person for, maybe detecting inevitable AI driven botnets and deepfakes? Could also see how they need leadership with that tangible cred as a decider function, e.g. the personality cult around Jack might make delegation and scaling their management team a challenge if everyone is trying to find a way to compete for his attention, so they need someone with enough weight that he can legitimately defer to on security issues. Congrats to all involved. Interesting times.

lostcolony 6y ago
PR as much as anything. Also probably breadth of knowledge (the depth is nice, of course). And for Mudge, for why it might be worth taking on relatively 'simple' problems - money. Money is nice.
- deleted 6y ago
  [deleted]
npunt 6y ago
When it comes to security, better to err on the side of too much than too little. I'm sure there's enough work to keep him busy, question might be whether it's intellectually stimulating enough for him.
jcims 6y ago
I would imagine nobody takes Twitter security seriously (quite evidently including themselves) which probably creates recruiting impediment. If Jack feels he needs some gravitas to attract a good team, hiring Mudge isn't a bad idea. (Might also provide some legitimacy to an off-menu Twitter threat intel product as well.) There's probably a little bit of housekeeping for infrastructure and operations security. I imagine all of the fun stuff is customer-facing.
p0rkbelly 6y ago
Twitter has global geo-political implications. Literally, a war could have broken out with Trump's account being hijacked. He just left Stripe, where he was responsible for a PCI environment. If anything, his last job he was "overpowered" for relative to Twitter.
lmilcin 6y ago
For some reason, high level managers need very expensive consultants to tell them the obvious truths. As a very expensive consultant I am frequently appalled at how management teams completely ignore their own employees. Forget about wasteful, these companies can afford consultants. It is just disrespectful to their own staff. Developers and operations guys already know the solution but can't get through layers upon layers of management. And so it takes a guy with salary high enough that he can be allowed to talk to the a high level manager directly, to get the message.
- cyberpunk 6y ago
  Ssssh! Don't give the game away ;)
  - TheRealPomax 6y ago
    it's okay, folks at that level of management don't tend to read hacker news.
- freeopinion 6y ago
  I was once in a uni class where the prof was a very expensive consultant. He said that a large % of his jobs for companies like GM or Ford was to grab a notepad and walk the floor. He would ask line employees why they did things the way they did and what they would change. He got reams of suggestions, typed them up, submitted them and collected a giant paycheck. Sometimes they were blindingly obvious things. One employee would drive two bolts, quickly change heads, then drive a third bolt. While the carcass advanced to the next station, the emloyee would change back to the original head and be ready for the next carcass. That employee's suggestion: Make all three bolts the same size so I don't have to change heads. Of course, that is just a fun anecdote. All such efficiencies have been implemented long ago... for auto assembly. But the point is still valid. Your employees know a ton about your business. Even the ones who do the most mundane tasks. Listen to them. Or... pay a very expensive consultant to listen to them.
  - motohagiography 6y ago
interestica 6y ago
> Their recent security issues with that hack were devops management and governance problems, no new science involved, they just dropped the ball on some solved problems. You don't hire security personnel to address previous breaches.
jordanpg 6y ago
This is why: https://www.theverge.com/interface/2020/7/15/21325708/twitter-hack-global-security-crisis-nuclear-war-bitcoin-scam https://www.theverge.com/interface/2020/7/15/21325708/twitte... See also: https://www.kcl.ac.uk/csss/assets/10957%E2%80%A2twitterconflictreport-15july.pdf https://www.kcl.ac.uk/csss/assets/10957%E2%80%A2twitterconfl... https://www.getrevue.co/profile/caseynewton/issues/a-catastrophe-at-twitter-263960 https://www.getrevue.co/profile/caseynewton/issues/a-catastr...
Lammy 6y ago
A watering-hole as large as Twitter will be under constant attacks of every sort and every source, from individual white/grey/black-hats trying to poke holes in the service itself, spammers who want to figure out how to create as many automated accounts and tweets as possible without getting blocked, government-sponsored hackers trying to get personal information on dissidents or defectors, etc etc.
peterwwillis 6y ago
> Their recent security issues with that hack were devops management and governance problems If those are the hard business/technology management problems (and they are), then try solving those while also securing them. Security by itself is relatively straightforward: 0days, red teaming, scanning for known vulns, etc. Just like every other aspect of the business, you hire someone to do one specific thing and you've got lots of options. But then try to infuse security into every single aspect of a business and product, in a way that increases both velocity & quality of product dev, without sacrificing efficient organizational management. There are already a ton of inscrutable complexities between all facets of the organization and its products. Trying to add security to all that is like teaching a juggling elephant to ice skate. So you need someone who's very good at managing security in the context of all those other problems. That's hard to find. It helps to have people who've seen problems in the same general space from a lot of different angles.
codezero 6y ago
Hypothesis: large numbers of state actors run influence networks on Twitter and have no clue where to start now that the actors have had years to adapt to the weak response from Twitter.
ourcat 6y ago
I hate to sound cynical, but it does keep investers happy.
f00zz 6y ago
They have more money than they know what to do with. Let's face it, this is a company that runs what's essentially a very simple web site, yet they have a 34B market cap.
DaniloDias 6y ago
It’s like watching a celebrated hero board the titanic.
busterarm 6y ago
Twitter hired Mudge because Twitter needs a security engineer with a friendly ear in the US Government. Mudge has been building goodwill with Congress since the 90s and Twitter is seeking to leverage that.
KnobbleMcKnees 6y ago
The fact that you don't often see announcements for big tech head-of-security appointments on the front page of hackernews says a lot about why they hired him.

lostcolony 6y ago

PR as much as anything. Also probably breadth of knowledge (the depth is nice, of course). And for Mudge, for why it might be worth taking on relatively 'simple' problems - money. Money is nice.

deleted 6y ago
[deleted]

npunt 6y ago

When it comes to security, better to err on the side of too much than too little. I'm sure there's enough work to keep him busy, question might be whether it's intellectually stimulating enough for him.

jcims 6y ago

I would imagine nobody takes Twitter security seriously (quite evidently including themselves) which probably creates recruiting impediment. If Jack feels he needs some gravitas to attract a good team, hiring Mudge isn't a bad idea. (Might also provide some legitimacy to an off-menu Twitter threat intel product as well.) There's probably a little bit of housekeeping for infrastructure and operations security. I imagine all of the fun stuff is customer-facing.

p0rkbelly 6y ago

Twitter has global geo-political implications. Literally, a war could have broken out with Trump's account being hijacked. He just left Stripe, where he was responsible for a PCI environment. If anything, his last job he was "overpowered" for relative to Twitter.

lmilcin 6y ago

For some reason, high level managers need very expensive consultants to tell them the obvious truths. As a very expensive consultant I am frequently appalled at how management teams completely ignore their own employees. Forget about wasteful, these companies can afford consultants. It is just disrespectful to their own staff. Developers and operations guys already know the solution but can't get through layers upon layers of management. And so it takes a guy with salary high enough that he can be allowed to talk to the a high level manager directly, to get the message.

cyberpunk 6y ago
Ssssh! Don't give the game away ;)
- TheRealPomax 6y ago
  it's okay, folks at that level of management don't tend to read hacker news.
freeopinion 6y ago
I was once in a uni class where the prof was a very expensive consultant. He said that a large % of his jobs for companies like GM or Ford was to grab a notepad and walk the floor. He would ask line employees why they did things the way they did and what they would change. He got reams of suggestions, typed them up, submitted them and collected a giant paycheck. Sometimes they were blindingly obvious things. One employee would drive two bolts, quickly change heads, then drive a third bolt. While the carcass advanced to the next station, the emloyee would change back to the original head and be ready for the next carcass. That employee's suggestion: Make all three bolts the same size so I don't have to change heads. Of course, that is just a fun anecdote. All such efficiencies have been implemented long ago... for auto assembly. But the point is still valid. Your employees know a ton about your business. Even the ones who do the most mundane tasks. Listen to them. Or... pay a very expensive consultant to listen to them.
- motohagiography 6y ago

interestica 6y ago

> Their recent security issues with that hack were devops management and governance problems, no new science involved, they just dropped the ball on some solved problems. You don't hire security personnel to address previous breaches.

jordanpg 6y ago

This is why: https://www.theverge.com/interface/2020/7/15/21325708/twitter-hack-global-security-crisis-nuclear-war-bitcoin-scam https://www.theverge.com/interface/2020/7/15/21325708/twitte... See also: https://www.kcl.ac.uk/csss/assets/10957%E2%80%A2twitterconflictreport-15july.pdf https://www.kcl.ac.uk/csss/assets/10957%E2%80%A2twitterconfl... https://www.getrevue.co/profile/caseynewton/issues/a-catastrophe-at-twitter-263960 https://www.getrevue.co/profile/caseynewton/issues/a-catastr...

Lammy 6y ago

A watering-hole as large as Twitter will be under constant attacks of every sort and every source, from individual white/grey/black-hats trying to poke holes in the service itself, spammers who want to figure out how to create as many automated accounts and tweets as possible without getting blocked, government-sponsored hackers trying to get personal information on dissidents or defectors, etc etc.

peterwwillis 6y ago

> Their recent security issues with that hack were devops management and governance problems If those are the hard business/technology management problems (and they are), then try solving those while also securing them. Security by itself is relatively straightforward: 0days, red teaming, scanning for known vulns, etc. Just like every other aspect of the business, you hire someone to do one specific thing and you've got lots of options. But then try to infuse security into every single aspect of a business and product, in a way that increases both velocity & quality of product dev, without sacrificing efficient organizational management. There are already a ton of inscrutable complexities between all facets of the organization and its products. Trying to add security to all that is like teaching a juggling elephant to ice skate. So you need someone who's very good at managing security in the context of all those other problems. That's hard to find. It helps to have people who've seen problems in the same general space from a lot of different angles.

codezero 6y ago

Hypothesis: large numbers of state actors run influence networks on Twitter and have no clue where to start now that the actors have had years to adapt to the weak response from Twitter.

ourcat 6y ago

I hate to sound cynical, but it does keep investers happy.

f00zz 6y ago

They have more money than they know what to do with. Let's face it, this is a company that runs what's essentially a very simple web site, yet they have a 34B market cap.

DaniloDias 6y ago

It’s like watching a celebrated hero board the titanic.

busterarm 6y ago

Twitter hired Mudge because Twitter needs a security engineer with a friendly ear in the US Government. Mudge has been building goodwill with Congress since the 90s and Twitter is seeking to leverage that.

KnobbleMcKnees 6y ago

The fact that you don't often see announcements for big tech head-of-security appointments on the front page of hackernews says a lot about why they hired him.