9 ms·
I think it's a pretty open secret that Twitter is a fairly broken company. It's no surprise that their security practices are bad, because all their practices a
by SilverBirch 4y ago
I think it's a pretty open secret that Twitter is a fairly broken company. It's no surprise that their security practices are bad, because all their practices are bad. It's also very difficult to view this in isolation when you have the timeline of (1): Fired in January, nothing happens. (2) Musk makes offer for twitter then reneges. (3) Months before the lawsuit gets decided re-emerges with accusations.
What happened that caused him to suddenly start whistleblowing now, and not in January? Was it the same thing that caused Ken Paxton in Texas to start investigating Twitter?
This just looks like pretty plain mud-slinging from Musk's team to be honest. Especially since the Whistleblower seems to basically be blowing the whilst on himself.
- agentultra 4y agoThis was my first thought. TFA claims he started the whistleblower process before the Musk deal was signed. Seems kind of fishy though.
- pb7 4y agoMaybe, just maybe, Twitter is actually a poorly run company and it's not a conspiracy.
- themitigating 4y ago[flagged]
- TeeMassive 4y agoI don't remember conservatives threatening Twitter to censor "dangerous" views or "misinformation" or telling who to ban.
- encryptluks2 4y ago[flagged]
- Banana699 4y agoBecause a random bakery shop is totally like a pseudo-monopolistic social media giant that can censor millions arbitarily and at will.
- themitigating 4y agoit's not a monopoly because there are alternatives, and it only has a 10% market share in the US (https://gs.statcounter.com/social-media-stats/all/united-states-of-america https://gs.statcounter.com/social-media-stats/all/united-sta...). The bakery also sets precedent as it did go to the supreme court, and it was used as a rallying cry by politicians on the right.
- Banana699 4y agoSo, in simpler words, they are indeed a pseudo-monopolistic (pseudo means apparent, something very close to but not quite there) social media giant that can indeed censor millions (10% of USA's population is 30 millions) arbitarily and at will ? Ok :) And whether a bakery serves your gay wedding or not is perhaps the most petty and inconsequential thing to be upset about. There are thousands upon thousands of bakeries in a large city. You can learn how to bake a cake in a weekend and home-bake your wedding cake yourself, or any one of your wedding guests can do this as a wedding gift. You can go to a no-gays-allowed bakery but simply not tell them you're gay, and take a finished cake from them then write your own name and that of the guy you will marry on it yourself. You can not get cake at all and instead get any of the thousand other types of wedding sweets and food. It's almost like the whole thing is a hilarious non-issue that some people just invented to cry and act like victims about.
- pb7 4y agoMonopoly on what? There are not thousands of bakeries in any city. Many towns might have none, or one. In that regard, the bakery will have an actual monopoly on baked goods to people living there.
- themitigating 4y agoThey push for censorship of pornographic material, which is less dangerous than misinformation about vaccines.
- TeeMassive 4y agoWhat's the problem with making public pages SFW?
- themitigating 4y agoIt's censorship
- jacooper 4y agoApperantly he started the whistleblowing process before any Musk involvement with Twitter. https://twitter.com/KimZetter/status/1562061556745089025 https://twitter.com/KimZetter/status/1562061556745089025
- tablespoon 4y ago> Apperantly he started the whistleblowing process before any Musk involvement with twitter. According to his lawyer as reported by someone on Twitter. IIRC, lawyers make statements that guilty clients are innocent all the time. If he was working with Musk help him wiggle out of the Twitter deal, it would fatally undermine the goal for to come out publicly about the relationship. I'm skeptical unless they can provide verifiable 3rd party evidence (e.g. some document filed before the deal).
- sp332 4y agoLinking to a Twitter thread is a little indirect, but Kim Zetter is a reporter on the infosec beat, and if you scroll up, you can see the link to the CNN article she's discussing. Also here's a video that includes the lawyer saying it out loud. https://mobile.twitter.com/donie/status/1562020176278716416 https://mobile.twitter.com/donie/status/1562020176278716416 (@donie is the first person to talk in the video.)
- Larrikin 4y agoSo instead of taking a statement from the lawyer you think it makes more sense to wildly speculate and make things up? The burden of proof falls on the other side now to prove the whistle blowing started after Musk.
- Arainach 4y agoA statement from a lawyer saying "this is older" isn't evidence. Until the lawyer shows an example of any form of whistleblowing predating Musk, this is still on them.
- deleted 4y ago[deleted]
- jmeister 4y agoDid you read the article before slinging mud yourself? The whistleblower has been communicating with DC way before EM entered the picture. Media only got its hands on the leaked material now.
- SilverBirch 4y agoI read the article, and it doesn't say what you said. >Zatko began the whistleblower process before there was any indication of Musk’s involvement Define "Began the whistleblower process". Because that seems like an extremely fuzzy way of saying this. And even if you accept that he was genuinely a whistleblower in good faith trying to do this, which I'm perfectly willing to accept, the fact it's coming out in public now is still convenient timing. It does say >The disclosure, sent last month Which means that the actual firm date we have coincides perfectly with Musk's legal wranglings.
- jjulius 4y agoNot exactly. The CNN article doesn't say that, and The Verge's piece[1] on this puts it together pretty clearly. >Zatko was fired by Twitter in January and claims that this was retaliation for his refusal to stay quiet about the company’s vulnerabilities. Last month, he filed a complaint with the Securities and Exchange Commission (SEC) that accuses Twitter of deceiving shareholders and violating an agreement it made with the Federal Trade Commission (FTC) to uphold certain security standards. His complaints, totaling more than 200 pages, were obtained by CNN and The Washington Post and published in redacted form this morning. So, breaking it down more concisely: 1.) Fired in January 2.) Musk tries to buy Twitter in early April 3.) Complaint filed with SEC in July by Mudge ("way [after] EM entered the picture") 4.) WaPo published redacted, 200-page report today [1]https://www.theverge.com/2022/8/23/23317857/twitter-whistleblower-zatko-security-spam-safety https://www.theverge.com/2022/8/23/23317857/twitter-whistleb... Edit: This is not an endorsement of mud-slinging, just an attempt to make sure everyone knows what actually happened and when, at least as best we can discern at this point.
- semiquaver 4y agoFrom the complaint (pg 9): > Please note that Mudge began preparing these disclosures in > early March 2022, well before Mr. Musk expressed any > interest in acquiring Twitter, and has not communicated > these disclosures to anyone with a financial interest > in Twitter. Why debate what the timelines implied by various articles are when the primary source is available and makes a clear statement on this matter?
- deleted 4y ago[deleted]
- gonzo41 4y agoIn real life, if you're in the public square shouting your opinions at whomever will listen it's somewhat risky. Twitter are just providing the same digital risk for the modern public square. It's a feature, not a bug.
- factorialboy 4y ago> Especially since the Whistleblower seems to basically be blowing the whilst on himself. Whistleblowers are by definition insiders.
- chihuahua 4y agoYes, but that's not the point here. A typical whistleblower would say "There were security problems, and the head of security ignored them." Here, it's "I was the head of security, and security was shitty. I was doing a shitty job, and that's a terrible scandal!"
- msh 4y agoIts more like "I was head of security and the CEO blocked me and tried preventing me reporting the true state of affairs to the board."
- SilverBirch 4y agoI think the thing about reporting things to the board is extremely open to interpretation. The board doesn't need to know absolutely every skeleton in the closet - especially if you're aware and in the process of fixing something.
- pb7 4y agoHe tried to change things and was stopped by people actually in power (CEO, the board). Being head of security means nothing if you aren't allowed to do your job. He was also there for less than 2 years. If you read the article, you'll find that Twitter has had awful security practices since at least 2010.
- encryptluks2 4y agoHow do you know that? The only way you'd find out is if there is a lawsuit that exposes said information. Everyone here is assuming because they want to believe Twitter is an evil behemoth. I'm not suggesting they are wrong, but this guy could have done the bare minimum for all we know thinking his status gave him basically a free income to do almost nothing. I would wait until more information comes out before making such generalized assumptions.
- _fat_santa 4y agoIf you've worked for any major F500 Enterprise, this is all par for the course. Currently on a contract with a healthcare giant, while security is pretty tight because HIPPA, generally everything else is chaotic. I'm going to speculate that Twitter is probably worse than the mean, but at pretty much every large company that operates massive pieces of software, youre gonna get a ton of chaos by default.
- johndhi 4y agothis was my reaction, too. and I'd add: the legal requirement is basically to have 'industry standard' security; no more and no less. there is no legal requirement to have air tight security (which probably isn't even technically possible at a company of this scale anyway).
- deleted 4y ago[deleted]
- mcqueenjordan 4y agoIt takes time to compile documents and write these things.
- toss1 4y ago>> thing that caused Ken Paxton in Texas to start investigating Twitter? Immediately thought of this item that came up in my Twitter news feed last week [0] >> "Elon Musk went to Kevin McCarthy’s Party last night in Wyoming—to celebrate Liz Cheney’s loss. While speaking at the MAGA party, Musk asked everyone to deny that he was there. Musk made sure that no press was allowed anywhere near the property — then people started posting selfies" I'm sure Musk wasn't there to privately insult the Republican leaders by acting like they're the ugly person that they'll date in private but don't want anyone knowing about — he's almost surely seeking some kind of influence/benefit. Maybe coincidence, but I certainly wonder about the purpose? [0] https://twitter.com/FriendEden100/status/1559974086264209414 https://twitter.com/FriendEden100/status/1559974086264209414
- jonstewart 4y agoAn important detail: the whistleblower is mudge. I'm at a bit of a loss for words comparing him to Ken Paxton.
- alvis 4y agoLooking at @paraga's response over the incidence, I don't see attacking Mudge Zatko's character does any help here. Does he know it can backfire? https://twitter.com/donie/status/1562069281545900033 https://twitter.com/donie/status/1562069281545900033
- encryptluks2 4y agoAlleged whistleblower publicly attacks company's reputation... A okay, I hate big tech companies. CEO of company defends organization and says previous employee has ulterior motives... Not okay, I hate big tech companies. See a trend here?
- nonameking2026 4y agoMudge: "Jack Dorsey reached out and asked me to come and perform a critical task at Twitter. I signed on to do it and believe I'm still performing that mission," he said." Seems like a legit answer. No need to accuse people of slinging mud.
- wpietri 4y agoJack Dorsey's not there anymore, and the current executives clearly have a different view. So I think the question of "why now and why like this" is still open. Given how many savvy technologists use HN, I'd bet we could put together a list of thousands of companies with concerning-to-reckless security practices. But for better or worse, most of us don't end up getting our concerns on CNN.
- TimCTRL 4y agoMusk's account was among those that were hacked in the 2020 high profile hack. He made the offer in 2022, he therefore can't claim to not have known that twitter's security isn't 100% and really can't use this in court, I guess
- rtkwe 4y agoThe contract Musk signed was very very one sided, from everything I've been reading there's very little Musk can claim that would let him scuttle the deal.
- labcomputer 4y agoAnd they say the Tesla fans are a cult... I'm at a loss for words.
- happyopossum 4y agoYou’re ascribing the worst possible motives to someone based on your hatred of Elon Musk. Someone who has no known relationship with Musk, who has claimed publicly they started this process before Musk was involved with twitter, and who is a long standing and well regarded figure in the infosec world. I think you’re gonna need more than Musk Derangement Syndrome fueled conspiracy theories to make your accusations stick here.
- itsoktocry 4y ago>You’re ascribing the worst possible motives to someone based on your hatred of Elon Musk. I'm not going to claim some big conspiracy here, but I do find this beyond coincidence. I don't think that this is coming out now because Mudge is acting on behalf of Elon. I think Elon's Twitter bid (and ensuing drama and upcoming lawsuit) and this revelation are part of the same agenda. For better or worse, it looks like influential powers that be are going to take down/over Twitter.
- the_doctah 4y ago>it looks like influential powers that be are going to take down/over Twitter Let them, Twitter can't get any worse. At the very least, lets get to the bottom of the bot problem and expose these companies who rely on bot activity to drive their MAU numbers and as a result, their inflated valuations.
- raxxorraxor 4y agoTo be honest, Twitter didn't manage expectations. If I register on such a platform, I expect my mail/pwd combination to stay reasonably safe. Reasonably, because there is never a guarantee. The rest of these expectations are entirely on the users. If people take security as seriously as they proclaim, they should not have registered. To now demand meticulous access controls sounds a bit neglectful to me...
- deleted 4y ago[deleted]