6 ms·

> Especially since the Whistleblower seems to basically be blowing the whilst on himself. Whistleblowers are by definition insiders.

chihuahua 4y ago
Yes, but that's not the point here. A typical whistleblower would say "There were security problems, and the head of security ignored them." Here, it's "I was the head of security, and security was shitty. I was doing a shitty job, and that's a terrible scandal!"
- msh 4y ago
  Its more like "I was head of security and the CEO blocked me and tried preventing me reporting the true state of affairs to the board."
  - SilverBirch 4y ago
    I think the thing about reporting things to the board is extremely open to interpretation. The board doesn't need to know absolutely every skeleton in the closet - especially if you're aware and in the process of fixing something.
- pb7 4y ago
  He tried to change things and was stopped by people actually in power (CEO, the board). Being head of security means nothing if you aren't allowed to do your job. He was also there for less than 2 years. If you read the article, you'll find that Twitter has had awful security practices since at least 2010.
  - encryptluks2 4y ago
    How do you know that? The only way you'd find out is if there is a lawsuit that exposes said information. Everyone here is assuming because they want to believe Twitter is an evil behemoth. I'm not suggesting they are wrong, but this guy could have done the bare minimum for all we know thinking his status gave him basically a free income to do almost nothing. I would wait until more information comes out before making such generalized assumptions.
    - pb7 4y ago
      I'm relaying information from the article based on the 200-page document sent to government agencies. Everything else is speculation based on nothing.
    - prophesi 4y ago
      We're all speculating here. But if I were a betting man, I do think both Twitter and Mudge's respective track records would place me in Mudge's camp.
      - josefresco 4y ago
        I don't know Mudge and neither does 99.9% of the public. His timing here is suspect. If these problems existed for so long, why now?
        pb7 4y ago
        He just got fired in January. Preparing a 200-page legal document with references and accounts takes time. It had been submitted some time ago, it's only now that CNN got a hold of a copy.
        encryptluks2 4y ago
        A 200 page document may take some time, but we don't know how the document is even formatted. Have they even released a copy? It could be 200 pages but only 20 pages of basic accusations with no real details for all we know, just pandering to congress and a bunch of email threads trying to indicate something without any context. I still would advise everyone to withhold judgement at this time.
        prophesi 4y ago
        I'm not sure why any sizeable portion of the public would know _any_ reputable cyber security experts. Twitter's CEO said the firing was due to "the impact on top priority work", and whistleblowing 6 months later isn't a surprising timeline when you need to have long talks with an attorney and get your own work-life situated.
- Sohcahtoa82 4y ago
  As others have said, being head of security is meaningless if the people in charge of actually making changes refuse to make the changes you prescribe. I've been in that situation at a previous job. The infrastructure for our service was set up so that EC2 instances would start up and pull their code from a central repo. But this repo was open to the world and did not require authentication. It was only a matter of time before some malicious user discovered this and our proprietary server code got leaked. It took weeks of hounding and escalating until something changed, and at first all they did was change the security groups to limit where you could connect from, and even the first patch merely limited it to a few /8 and /16 CIDRs that covered massive swaths of AWS-owned IPs. They still didn't require authentication.
- PurpleRamen 4y ago
  It's not his responsibility if someone with more power is sabotaging his work. He tried to do his work, realized it was not possible, and escalated to a higher authority. A bit unusual, but technically a way to maybe solve the problem and still do the job at the end.
SilverBirch 4y ago
Sure, but it's not normally the guy in charge of security that gets to complain the security isn't good enough.
- zhengyi13 4y ago
  I seem to read fairly often about security folk (or even plain ol' sysadmins) bemoaning their companies' security, like their presence or oversight is a box checking exercise rather than a real commitment.
- bombcar 4y ago
  Being in charge of security usually means two things: 1. You find out all the problems. 2. You can't fix all of them (many reasons here, not all malicious) and are setup to take the fall. Rinse and repeat.

chihuahua 4y ago

Yes, but that's not the point here. A typical whistleblower would say "There were security problems, and the head of security ignored them." Here, it's "I was the head of security, and security was shitty. I was doing a shitty job, and that's a terrible scandal!"

msh 4y ago
Its more like "I was head of security and the CEO blocked me and tried preventing me reporting the true state of affairs to the board."
- SilverBirch 4y ago
  I think the thing about reporting things to the board is extremely open to interpretation. The board doesn't need to know absolutely every skeleton in the closet - especially if you're aware and in the process of fixing something.
pb7 4y ago
He tried to change things and was stopped by people actually in power (CEO, the board). Being head of security means nothing if you aren't allowed to do your job. He was also there for less than 2 years. If you read the article, you'll find that Twitter has had awful security practices since at least 2010.
- encryptluks2 4y ago
  How do you know that? The only way you'd find out is if there is a lawsuit that exposes said information. Everyone here is assuming because they want to believe Twitter is an evil behemoth. I'm not suggesting they are wrong, but this guy could have done the bare minimum for all we know thinking his status gave him basically a free income to do almost nothing. I would wait until more information comes out before making such generalized assumptions.
  - pb7 4y ago
    I'm relaying information from the article based on the 200-page document sent to government agencies. Everything else is speculation based on nothing.
  - prophesi 4y ago
    We're all speculating here. But if I were a betting man, I do think both Twitter and Mudge's respective track records would place me in Mudge's camp.
    - josefresco 4y ago
      I don't know Mudge and neither does 99.9% of the public. His timing here is suspect. If these problems existed for so long, why now?
      - pb7 4y ago
        He just got fired in January. Preparing a 200-page legal document with references and accounts takes time. It had been submitted some time ago, it's only now that CNN got a hold of a copy.
        encryptluks2 4y ago
        A 200 page document may take some time, but we don't know how the document is even formatted. Have they even released a copy? It could be 200 pages but only 20 pages of basic accusations with no real details for all we know, just pandering to congress and a bunch of email threads trying to indicate something without any context. I still would advise everyone to withhold judgement at this time.
      - prophesi 4y ago
        I'm not sure why any sizeable portion of the public would know _any_ reputable cyber security experts. Twitter's CEO said the firing was due to "the impact on top priority work", and whistleblowing 6 months later isn't a surprising timeline when you need to have long talks with an attorney and get your own work-life situated.
Sohcahtoa82 4y ago
As others have said, being head of security is meaningless if the people in charge of actually making changes refuse to make the changes you prescribe. I've been in that situation at a previous job. The infrastructure for our service was set up so that EC2 instances would start up and pull their code from a central repo. But this repo was open to the world and did not require authentication. It was only a matter of time before some malicious user discovered this and our proprietary server code got leaked. It took weeks of hounding and escalating until something changed, and at first all they did was change the security groups to limit where you could connect from, and even the first patch merely limited it to a few /8 and /16 CIDRs that covered massive swaths of AWS-owned IPs. They still didn't require authentication.
PurpleRamen 4y ago
It's not his responsibility if someone with more power is sabotaging his work. He tried to do his work, realized it was not possible, and escalated to a higher authority. A bit unusual, but technically a way to maybe solve the problem and still do the job at the end.

SilverBirch 4y ago

Sure, but it's not normally the guy in charge of security that gets to complain the security isn't good enough.

zhengyi13 4y ago
I seem to read fairly often about security folk (or even plain ol' sysadmins) bemoaning their companies' security, like their presence or oversight is a box checking exercise rather than a real commitment.
bombcar 4y ago
Being in charge of security usually means two things: 1. You find out all the problems. 2. You can't fix all of them (many reasons here, not all malicious) and are setup to take the fall. Rinse and repeat.