10 ms·

Twitter shakes up its security team

175 points by happyopossum 5y ago

mercy_dude 5y ago
This guy really irks me. For one, since he took over it really seems Twitter is heading towards a direction to suit activist investor demands. I used to be able to browse Twitter posts of people I tend to respect (mainly scientific and academic people) without having to login and it is getting increasingly difficult without doing so lately as they keep showing me the login screen. This guy has a toxic history of narcissistic behavior as reported in several local Indian social Media and he would only seem to suck up to corporate demand and make Twitter more suffocating.
- olliej 5y ago
  What are the activist investor issues? (I haven’t been paying attention to “activist investor” behaviour for a while as so many seemed to just be pushing for “make me rich in the short term regardless of cost”)
  - uoaei 5y ago
    That definition seems at odds with the core concepts involved in the term "activist investor".
    - HillRat 5y ago
      Traditionally, the "activist" in "activist investor" simply means "an investor who is actively pushing for specific policies," generally to increase the return on their investment. "Financial activists" like Carl Icahn or Starboard frequently take > 5% stakes in order to pressure companies to sell themselves to competitors, break themselves apart in order to shed lower-performing divisions, funnel cash to shareholders through dividends or stock buybacks, or reverse policies they see as injurious to the bottom line CEOs naturally hate this, and activist investors have a reputation -- arguably often well-deserved -- for improving the profitability of their portfolios at the cost of the companies they target. Sometimes this can force companies to walk away from suboptimal strategies -- did AOL really think Patch was going to be a market maker? -- but in many cases their activism simply results in the company's acquisition, aggressive offshoring or deindustrialization, or just straight-up bankruptcy. Icahn, for example, took a heavy position in Blockbuster and was instrumental in forcing them to reinstate late fees and drop plans to enter the streaming market, which left them exceedingly vulnerable when Netflix introduced streaming (the dueling HBR articles on this are well worth reading). Over the past few decades "social activist investors" have become more common, especially amongst large public sector and union pension plans who have both financial throw-weight and a need to answer to causes somewhat beyond their immediate bottom lines, but in general they are much smaller, and less effective, groups than the usual hedge fund suspects. For example, an organization of decarbonization activists have been trying for years to force ExxonMobil to diversify its energy base beyond hydrocarbons (as other petrochemical firms have done), but they've had notably zero effect on XOM's strategy, despite having an argument based on economics as much as ecology.
      - olliej 5y ago
        And hey, here's a good activist investor story! https://edition.cnn.com/2022/01/24/investing/peloton-activist-investor/index.html https://edition.cnn.com/2022/01/24/investing/peloton-activis... :D
  - vorpalhex 5y ago
    An activist investor is someone who buys into a company with the intent of reforming or changing it. Maybe you really hate twitter, so you buy into it for $200 million and then use your power on the board to vote down anything good for twitter and vote for anything that is harmful. Activist investors often don't act in line with financial interest, instead focusing on "activism" even if it costs money.
    - sjtindell 5y ago
      Do you have any examples of activist investors who actually wanted to do harm to a company? I’m incredulous. What a waste of time and money. I usually hear about ones who think they can turn it around.
      - riskable 5y ago
        Here you go: https://www.businessinsider.com/tim-cook-versus-a-conservative-think-tank-2014-2 https://www.businessinsider.com/tim-cook-versus-a-conservati...
        kodah 5y ago
        That's not really an activist investor, more like a quarrel over priorities in a boardroom. Carl Icahn, and Bill Ackman are examples of activist investors. The key to being an activist investor is that you have to control enough of the company to be able to make decisions that would greatly change it. A single board seat doesn't really get you much. Secondarily, activist investors are usually seizing control of failing organizations, not successful ones.
- oneepic 5y ago
  I think Twitter started having those "login screen" issues even before he took over. Like at least a month or 2 beforehand.
  - stefan_ 5y ago
    Before the site was just fake-broken. Now it basically doesn't work at all; entirely unusable. I use Nitter now but that has some issues, unfortunately.
  - riffic 5y ago
    Around August: https://www.google.com/search?q=login+wall+site:https://www.reddit.com/r/Twitter https://www.google.com/search?q=login+wall+site:https://www.... https://www.google.com/search?q=Twitter+login+wall+site:https://news.ycombinator.com https://www.google.com/search?q=Twitter+login+wall+site:http...
- xibalba 5y ago
  This entire comment needs citation, but especially: > "heading towards a direction to suit activist investor demands" and > "This guy has a toxic history of narcissistic behavior"
- pram 5y ago
  All the popups blocking content and telling you to log in is reaching Pinterest levels of hostility. Truly dire.
  - pcmoney 5y ago
    Compared to pretty much all of its peers (facebook, snapchat, instagram, tiktok, nyt, the economist) twitter allows the most content without login.
- nostromo 5y ago
  I'm glad that he and I seemingly share the same goals. That is: the downfall of Twitter. Firing everyone in sight and deploying dark patterns for short-term revenue seem like good first steps.
  - jgalt212 5y ago
    I agree with both of you. Twitter is so good, and so bad in so may ways.
- deleted 5y ago
  [deleted]
- paxys 5y ago
  He took over as CEO a month and a half ago. I really doubt he has been able to change the company culture or user experience to the extent that people can form opinions on his tenure.
  - rrix2 5y ago
    he's been the CTO since 2017
- curious_cat_163 5y ago
  > This guy has a toxic history of narcissistic behavior as reported in several local Indian social Media... Don't follow. What does that have to do with anything about the original post?
- kodah 5y ago
  Might be an aside, but I find the word "narcissistic" overused and meaningless when conveyed by people these days.
toomanyrichies 5y ago
https://web.archive.org/web/20220121064005/https://www.nytimes.com/2022/01/21/technology/twitter-security-team.html https://web.archive.org/web/20220121064005/https://www.nytim...
djrogers 5y ago
This part really stood out to me: "Mr. Agrawal said the “nature of this situation” limited what he was allowed to share with employees" Even when things are a bit contentious, companies and C-level execs like CISOs usually come to an agreement and have a joint statement about 'spending time with family' or 'pursuing other endeavors'. This sounds like it was either very one-sided, or something very bad was happening...
- tyingq 5y ago
  I can see that happening with a CISO, though, in many scenarios. Like if they presented a stark picture of current state and said that work needed to happen that would put planned revenue generating work on hold. And weren't willing to back down on the opinion that it was that critical. I imagine they wouldn't want to cite differences of opinion on security posture as the reason for departing.
  - kune 5y ago
    Somebody told me a few years back that the life time of a CISO in a larger organisation is not larger than 24 months. In my organisation that proved to be true so far. Here the rule applies as well.
    - Phlarp 5y ago
      It really feels like the CISO role has become less about the security posture of an organization and more about being a corporate whipping boy-- Predesignated as the go-to sacrificial lamb for when a public leak or government investigation comes knocking. Hard to find longevity or stability in a role that exists to fail
      - BeFlatXIII 5y ago
        Once this is known throughout the industry, it also means that the whipping boys keep getting fired and then taking up their next tenure at the startup next door until they're fired again.
easterncalculus 5y ago
After Mudge got the position I had a feeling it wouldn't last, but I figured it would be later. It's sad to see him go, but I'm sure he'll continue to do awesome stuff.
- gonehome 5y ago
  Any specific reason? Why did you think it wouldn't last?
  - baby 5y ago
    It's very hard to find security people who can keep business needs in the back of their minds as well. That's why developers make the best security people, and pure security people are often too hard headed. (I'm saying that as a pure security person who learned the hard way.)
slg 5y ago
Remember like a year and half ago when some of the most powerful people on the planet had their Twitter accounts hacked in some bitcoin scam and then the story just sort of went away without any real discussion about how dangerous that could have been if the hackers had different motivations (EDIT: there was an implied "and how to prevent that in the future" here)?
- staticassertion 5y ago
  Not really. I remember it being a pretty huge deal and everyone talking about how it could have been so much worse. What more did you want?
  - ct0 5y ago
    How would we even know if someone has pulled this off again with an entirely different motive and hasn't been discovered as a hack?
    - staticassertion 5y ago
      If Twitter knows about it they're legally obligated to report it.
  - mrguyorama 5y ago
    Pretty sure they were implying we never got the how they were hacked. It seemed very unlikely to be credential stuffing or other common things. It seemed more like a rogue inside person or back office hack.
    - aharris6 5y ago
      I think this was answered: https://www.wired.com/story/inside-twitter-hack-election-plan/ https://www.wired.com/story/inside-twitter-hack-election-pla...
    - staticassertion 5y ago
      I know how it happened but I don't remember if it's public knowledge or not. I'm pretty sure at least some details made it out.
iqanq 5y ago
What's this new thing that the nytimes does of ending articles titles with a full stop?
- unethical_ban 5y ago
  It is occasional, and seems to be in the context of their "smaller" stories covering various topics in a briefing format. I bet this is really an H2 heading in a broader "Today's news" screen.
- jer0me 5y ago
  It’s a collection of short business stories from the day. It’s been a thing for at least a few years.
eganist 5y ago
I'm probably drawing early conclusions, but it's not a surprise hearing an engineering head or ex-CTO type eliminate security given security is often seen as a roadblock, even in Twitter's case where their leadership and team often worked to make it a business enablement function.
- asdfsd234234444 5y ago
  Let this be a lesson that the business comes first. Security is important - but the business is more important.
  - eganist 5y ago
    > Let this be a lesson that the business comes first. Security is important - but the business is more important. Sound security practices enable good business, e.g giving teams a paved road (https://www.slideshare.net/diannemarsh/the-paved-road-at-netflix https://www.slideshare.net/diannemarsh/the-paved-road-at-net...) that enables rapid and secure releases in place of gates. At least from what few accounts I've heard from engineering in Twitter, it doesn't sound like Mr. Agrawal has much faith in this idea, but that just means he'll be the first to go in the event of the next inevitable breach. Watch it be over something dumb like stolen NFTs.
  - _pdp_ 5y ago
    It is often failure of the security leadership when security is not aligned with business goals.
    - asdfsd234234444 5y ago
      Agreed, 100%
baby 5y ago
My crazy wild guess: they had a weird internal tantrum because of Twitter's PR moves around cryptocurrencies, and they got fired because they went too far.
- tptacek 5y ago
  Seems like a weird thing to put on Zatko.
  - baby 5y ago
    I said it was a crazy wild guess :p
motohagiography 5y ago
I remember commenting when Mudge was hired that Twitter/Jack needed someone of that profile to offset his massive organizational weight as a founder, where Zatko would have the technical and community cred to make decisions for the entire org without, a) other people going around him and trying to get Jack's attention, and b) to demonstrate there is no doubt about the competence of the security team of the platform to satisfy some regulatory risk. I also thought it sounded like a bit of an overpowered choice for the role, unless it was not intended to be long term, and mostly as a tactical near term solution. That may have forshadowed this development a bit as well. Into the territory of startup fanfic, I'd assert from Agrawal's perspective, he needs his own team, and a top technologist indexed on engineering competence is overpowered as an individual at that level - and for the agility the CEO will need for the next stage of his company. He needs his own people to execute for him. The company is no longer a startup, and its explosive growth phase is behind it. Now it's an asset to be managed, and doing that is an orthogonal set of skills to building and managing growth, so you need people who operate aligned to a longer horizon. The previous CEO's tactical super-hire isn't necessarily going to be the same asset for a new CEO's strategy. It's odd to comment on this like its sports writing, but that's effectively what following these companies is. Knowing very little about the individuals, I don't need to mind read, as there are clear external incentives for this that make it a fairly neutral change. When you inherit a powerful asset like that, as CEO that can be double edged. It's great to have someone that amazing around, but if they can undermine the momentum in your leadership even (especially?) unintentionally, while you're driving a massive organizational change, the choice really makes itself independent of the individual characteristics of the people involved. Ceasing to work at twitter is probably the least interesting thing Zatko has ever done, so I don't forsee this reflecting on him at all, but before there are drill downs on personalities and culture stuff, it's worth looking at it from straight business incentives.
- tptacek 5y ago
  The CSO role has basically nothing to do with the stuff that made Zatko famous; it's mostly boring organizational management stuff, with a sprinkling of being real good in meetings. It's not surprising to me that a new CEO who had just shaken up the whole engineering team would also clear the decks on security as well. For instance: this kind of thing happens when a company decides it wants security more closely integrated with engineering --- or the opposite. I have no insight into what's happening at Twitter but if you made me bet, I'd bet against there being any interesting drama here.
tptacek 5y ago
For whatever it's worth, Lea Kissner has a pretty great reputation among the security nerds I talk to, and you'd assume that if something shady or dramatic was happening here, Kissner wouldn't be happily jumping into the lion's jaws. Twitter has been shaking up management for a couple months now. I have no inside knowledge, but this is pretty plausibly just more of the same kind of thing.
- jonstewart 5y ago
  The odd thing seems to be the one-sidedness of it, though, instead of the our-extraordinary-journey-to-spend-more-time-with-family-fade-to-gray with the nice severance that smooths everything over. Mudge hasn’t said jack, Sethi’s tweet is sad. Getting fired is all part of the job as an exec in a tech firm, but the messaging is enough out of the norm that it does make one wonder about them refusing to do X or Y, etc.
  - bredren 5y ago
    Does mudge typically issue these kind of statements?
    - tptacek 5y ago
      Nope.
    - jonstewart 5y ago
      I wouldn’t expect him to say “going to spend more time with my family.” But more like, “today’s my last day! It’s been a fun year.” rather than have a NYT article about getting fired.

175 points by happyopossum 5y ago

This guy really irks me. For one, since he took over it really seems Twitter is heading towards a direction to suit activist investor demands. I used to be able to browse Twitter posts of people I tend to respect (mainly scientific and academic people) without having to login and it is getting increasingly difficult without doing so lately as they keep showing me the login screen. This guy has a toxic history of narcissistic behavior as reported in several local Indian social Media and he would only seem to suck up to corporate demand and make Twitter more suffocating.

olliej 5y ago
What are the activist investor issues? (I haven’t been paying attention to “activist investor” behaviour for a while as so many seemed to just be pushing for “make me rich in the short term regardless of cost”)
- uoaei 5y ago
  That definition seems at odds with the core concepts involved in the term "activist investor".
  - HillRat 5y ago
    Traditionally, the "activist" in "activist investor" simply means "an investor who is actively pushing for specific policies," generally to increase the return on their investment. "Financial activists" like Carl Icahn or Starboard frequently take > 5% stakes in order to pressure companies to sell themselves to competitors, break themselves apart in order to shed lower-performing divisions, funnel cash to shareholders through dividends or stock buybacks, or reverse policies they see as injurious to the bottom line CEOs naturally hate this, and activist investors have a reputation -- arguably often well-deserved -- for improving the profitability of their portfolios at the cost of the companies they target. Sometimes this can force companies to walk away from suboptimal strategies -- did AOL really think Patch was going to be a market maker? -- but in many cases their activism simply results in the company's acquisition, aggressive offshoring or deindustrialization, or just straight-up bankruptcy. Icahn, for example, took a heavy position in Blockbuster and was instrumental in forcing them to reinstate late fees and drop plans to enter the streaming market, which left them exceedingly vulnerable when Netflix introduced streaming (the dueling HBR articles on this are well worth reading). Over the past few decades "social activist investors" have become more common, especially amongst large public sector and union pension plans who have both financial throw-weight and a need to answer to causes somewhat beyond their immediate bottom lines, but in general they are much smaller, and less effective, groups than the usual hedge fund suspects. For example, an organization of decarbonization activists have been trying for years to force ExxonMobil to diversify its energy base beyond hydrocarbons (as other petrochemical firms have done), but they've had notably zero effect on XOM's strategy, despite having an argument based on economics as much as ecology.
    - olliej 5y ago
      And hey, here's a good activist investor story! https://edition.cnn.com/2022/01/24/investing/peloton-activist-investor/index.html https://edition.cnn.com/2022/01/24/investing/peloton-activis... :D
- vorpalhex 5y ago
  An activist investor is someone who buys into a company with the intent of reforming or changing it. Maybe you really hate twitter, so you buy into it for $200 million and then use your power on the board to vote down anything good for twitter and vote for anything that is harmful. Activist investors often don't act in line with financial interest, instead focusing on "activism" even if it costs money.
  - sjtindell 5y ago
    Do you have any examples of activist investors who actually wanted to do harm to a company? I’m incredulous. What a waste of time and money. I usually hear about ones who think they can turn it around.
    - riskable 5y ago
      Here you go: https://www.businessinsider.com/tim-cook-versus-a-conservative-think-tank-2014-2 https://www.businessinsider.com/tim-cook-versus-a-conservati...
      - kodah 5y ago
        That's not really an activist investor, more like a quarrel over priorities in a boardroom. Carl Icahn, and Bill Ackman are examples of activist investors. The key to being an activist investor is that you have to control enough of the company to be able to make decisions that would greatly change it. A single board seat doesn't really get you much. Secondarily, activist investors are usually seizing control of failing organizations, not successful ones.
oneepic 5y ago
I think Twitter started having those "login screen" issues even before he took over. Like at least a month or 2 beforehand.
- stefan_ 5y ago
  Before the site was just fake-broken. Now it basically doesn't work at all; entirely unusable. I use Nitter now but that has some issues, unfortunately.
- riffic 5y ago
  Around August: https://www.google.com/search?q=login+wall+site:https://www.reddit.com/r/Twitter https://www.google.com/search?q=login+wall+site:https://www.... https://www.google.com/search?q=Twitter+login+wall+site:https://news.ycombinator.com https://www.google.com/search?q=Twitter+login+wall+site:http...
xibalba 5y ago
This entire comment needs citation, but especially: > "heading towards a direction to suit activist investor demands" and > "This guy has a toxic history of narcissistic behavior"
pram 5y ago
All the popups blocking content and telling you to log in is reaching Pinterest levels of hostility. Truly dire.
- pcmoney 5y ago
  Compared to pretty much all of its peers (facebook, snapchat, instagram, tiktok, nyt, the economist) twitter allows the most content without login.
nostromo 5y ago
I'm glad that he and I seemingly share the same goals. That is: the downfall of Twitter. Firing everyone in sight and deploying dark patterns for short-term revenue seem like good first steps.
- jgalt212 5y ago
  I agree with both of you. Twitter is so good, and so bad in so may ways.
deleted 5y ago
[deleted]
paxys 5y ago
He took over as CEO a month and a half ago. I really doubt he has been able to change the company culture or user experience to the extent that people can form opinions on his tenure.
- rrix2 5y ago
  he's been the CTO since 2017
curious_cat_163 5y ago
> This guy has a toxic history of narcissistic behavior as reported in several local Indian social Media... Don't follow. What does that have to do with anything about the original post?
kodah 5y ago
Might be an aside, but I find the word "narcissistic" overused and meaningless when conveyed by people these days.

toomanyrichies 5y ago

https://web.archive.org/web/20220121064005/https://www.nytimes.com/2022/01/21/technology/twitter-security-team.html https://web.archive.org/web/20220121064005/https://www.nytim...

djrogers 5y ago

This part really stood out to me: "Mr. Agrawal said the “nature of this situation” limited what he was allowed to share with employees" Even when things are a bit contentious, companies and C-level execs like CISOs usually come to an agreement and have a joint statement about 'spending time with family' or 'pursuing other endeavors'. This sounds like it was either very one-sided, or something very bad was happening...

tyingq 5y ago
I can see that happening with a CISO, though, in many scenarios. Like if they presented a stark picture of current state and said that work needed to happen that would put planned revenue generating work on hold. And weren't willing to back down on the opinion that it was that critical. I imagine they wouldn't want to cite differences of opinion on security posture as the reason for departing.
- kune 5y ago
  Somebody told me a few years back that the life time of a CISO in a larger organisation is not larger than 24 months. In my organisation that proved to be true so far. Here the rule applies as well.
  - Phlarp 5y ago
    It really feels like the CISO role has become less about the security posture of an organization and more about being a corporate whipping boy-- Predesignated as the go-to sacrificial lamb for when a public leak or government investigation comes knocking. Hard to find longevity or stability in a role that exists to fail
    - BeFlatXIII 5y ago
      Once this is known throughout the industry, it also means that the whipping boys keep getting fired and then taking up their next tenure at the startup next door until they're fired again.

easterncalculus 5y ago

After Mudge got the position I had a feeling it wouldn't last, but I figured it would be later. It's sad to see him go, but I'm sure he'll continue to do awesome stuff.

gonehome 5y ago
Any specific reason? Why did you think it wouldn't last?
- baby 5y ago
  It's very hard to find security people who can keep business needs in the back of their minds as well. That's why developers make the best security people, and pure security people are often too hard headed. (I'm saying that as a pure security person who learned the hard way.)

slg 5y ago

Remember like a year and half ago when some of the most powerful people on the planet had their Twitter accounts hacked in some bitcoin scam and then the story just sort of went away without any real discussion about how dangerous that could have been if the hackers had different motivations (EDIT: there was an implied "and how to prevent that in the future" here)?

staticassertion 5y ago
Not really. I remember it being a pretty huge deal and everyone talking about how it could have been so much worse. What more did you want?
- ct0 5y ago
  How would we even know if someone has pulled this off again with an entirely different motive and hasn't been discovered as a hack?
  - staticassertion 5y ago
    If Twitter knows about it they're legally obligated to report it.
- mrguyorama 5y ago
  Pretty sure they were implying we never got the how they were hacked. It seemed very unlikely to be credential stuffing or other common things. It seemed more like a rogue inside person or back office hack.
  - aharris6 5y ago
    I think this was answered: https://www.wired.com/story/inside-twitter-hack-election-plan/ https://www.wired.com/story/inside-twitter-hack-election-pla...
  - staticassertion 5y ago
    I know how it happened but I don't remember if it's public knowledge or not. I'm pretty sure at least some details made it out.

iqanq 5y ago

What's this new thing that the nytimes does of ending articles titles with a full stop?

unethical_ban 5y ago
It is occasional, and seems to be in the context of their "smaller" stories covering various topics in a briefing format. I bet this is really an H2 heading in a broader "Today's news" screen.
jer0me 5y ago
It’s a collection of short business stories from the day. It’s been a thing for at least a few years.

eganist 5y ago

I'm probably drawing early conclusions, but it's not a surprise hearing an engineering head or ex-CTO type eliminate security given security is often seen as a roadblock, even in Twitter's case where their leadership and team often worked to make it a business enablement function.

asdfsd234234444 5y ago
Let this be a lesson that the business comes first. Security is important - but the business is more important.
- eganist 5y ago
  > Let this be a lesson that the business comes first. Security is important - but the business is more important. Sound security practices enable good business, e.g giving teams a paved road (https://www.slideshare.net/diannemarsh/the-paved-road-at-netflix https://www.slideshare.net/diannemarsh/the-paved-road-at-net...) that enables rapid and secure releases in place of gates. At least from what few accounts I've heard from engineering in Twitter, it doesn't sound like Mr. Agrawal has much faith in this idea, but that just means he'll be the first to go in the event of the next inevitable breach. Watch it be over something dumb like stolen NFTs.
- _pdp_ 5y ago
  It is often failure of the security leadership when security is not aligned with business goals.
  - asdfsd234234444 5y ago
    Agreed, 100%

baby 5y ago

My crazy wild guess: they had a weird internal tantrum because of Twitter's PR moves around cryptocurrencies, and they got fired because they went too far.

tptacek 5y ago
Seems like a weird thing to put on Zatko.
- baby 5y ago
  I said it was a crazy wild guess :p

motohagiography 5y ago

I remember commenting when Mudge was hired that Twitter/Jack needed someone of that profile to offset his massive organizational weight as a founder, where Zatko would have the technical and community cred to make decisions for the entire org without, a) other people going around him and trying to get Jack's attention, and b) to demonstrate there is no doubt about the competence of the security team of the platform to satisfy some regulatory risk. I also thought it sounded like a bit of an overpowered choice for the role, unless it was not intended to be long term, and mostly as a tactical near term solution. That may have forshadowed this development a bit as well. Into the territory of startup fanfic, I'd assert from Agrawal's perspective, he needs his own team, and a top technologist indexed on engineering competence is overpowered as an individual at that level - and for the agility the CEO will need for the next stage of his company. He needs his own people to execute for him. The company is no longer a startup, and its explosive growth phase is behind it. Now it's an asset to be managed, and doing that is an orthogonal set of skills to building and managing growth, so you need people who operate aligned to a longer horizon. The previous CEO's tactical super-hire isn't necessarily going to be the same asset for a new CEO's strategy. It's odd to comment on this like its sports writing, but that's effectively what following these companies is. Knowing very little about the individuals, I don't need to mind read, as there are clear external incentives for this that make it a fairly neutral change. When you inherit a powerful asset like that, as CEO that can be double edged. It's great to have someone that amazing around, but if they can undermine the momentum in your leadership even (especially?) unintentionally, while you're driving a massive organizational change, the choice really makes itself independent of the individual characteristics of the people involved. Ceasing to work at twitter is probably the least interesting thing Zatko has ever done, so I don't forsee this reflecting on him at all, but before there are drill downs on personalities and culture stuff, it's worth looking at it from straight business incentives.

tptacek 5y ago
The CSO role has basically nothing to do with the stuff that made Zatko famous; it's mostly boring organizational management stuff, with a sprinkling of being real good in meetings. It's not surprising to me that a new CEO who had just shaken up the whole engineering team would also clear the decks on security as well. For instance: this kind of thing happens when a company decides it wants security more closely integrated with engineering --- or the opposite. I have no insight into what's happening at Twitter but if you made me bet, I'd bet against there being any interesting drama here.

tptacek 5y ago

For whatever it's worth, Lea Kissner has a pretty great reputation among the security nerds I talk to, and you'd assume that if something shady or dramatic was happening here, Kissner wouldn't be happily jumping into the lion's jaws. Twitter has been shaking up management for a couple months now. I have no inside knowledge, but this is pretty plausibly just more of the same kind of thing.

jonstewart 5y ago
The odd thing seems to be the one-sidedness of it, though, instead of the our-extraordinary-journey-to-spend-more-time-with-family-fade-to-gray with the nice severance that smooths everything over. Mudge hasn’t said jack, Sethi’s tweet is sad. Getting fired is all part of the job as an exec in a tech firm, but the messaging is enough out of the norm that it does make one wonder about them refusing to do X or Y, etc.
- bredren 5y ago
  Does mudge typically issue these kind of statements?
  - tptacek 5y ago
    Nope.
  - jonstewart 5y ago
    I wouldn’t expect him to say “going to spend more time with my family.” But more like, “today’s my last day! It’s been a fun year.” rather than have a NYT article about getting fired.