5 ms·

> B) a strong tech hire who can’t lead a program. I worked with Mudge (not super close, but enough to see how he worked across teams etc) and can certainly say

> B) a strong tech hire who can’t lead a program. I worked with Mudge (not super close, but enough to see how he worked across teams etc) and can certainly say this is not the case. At least when I saw him Mudge was excellent at the program leadership aspect of his role. At one point he ended up a DARPA PM. You can't go from L0pht to DARPA without getting really good at working with other people and leading projects. While he was always a notable presence, he was also never prone to drama, and very good at having ego when it was important but never letting it get in the way. Additionally all of the details sound like every KPI chasing consumer facing tech company I've ever worked with. I think we all know a few very competent people who have stood up to leadership at insane tech companies and ultimately gotten fired for it.

latchkey 4y ago
Even 20 years ago, extremely well spoken and has worked at high political levels... https://www.cnn.com/videos/business/2022/08/23/peiter-mudge-zatko-2000-vault-orig.cnn https://www.cnn.com/videos/business/2022/08/23/peiter-mudge-...
AtlasBarfed 4y ago
The subject of security consultants, security departments, and whistleblowing seems to me to be of particular concern. I mean, if an auditor publicly reports an audit finding that is ignored by the company and his ethics demand its reporting, is he branded a "whistleblower"? I do not think so, instead it is an "auditor finding". Why does that not apply here? It kind of dovetails with how pathetically organized IT in general is from a professional standpoint. Lawyers, Doctors, ... ?Accountants? and the like have centuries-codified procedures, principles, and the like for ethics. You generally don't get to hire one of those and tell them how to breach ethics (now, there are a lot of corrupt lawyers and a lot of corrupt accountants see: Arthur Andersen). The exploit industry has the 0day and x days of forewarning process, so there is that, but the fact a security consultant/professional gets accused of whistleblowing when... um, isn't that sort of the point? You hire a security consultant kind of like an auditor. And if auditors find major failings and they aren't addressed, aren't they supposed to report them? I'm pretty sure the security IT industry does not have even accountant levels of professional conduct and organizations. As IT subsumes and infiltrates, now to the point that fundamental bill of rights / human rights are dependent on secure and functioning IT systems, it gets... a bit more important. Arguably more important than the ethics around accountants and doctors. Lawyers, because they deal with the law, are probably more important still, but it shows that IT security may be rising in import to that level.
- scott00 4y ago
  That's not really how auditors work. Auditors either give the client a letter saying what the client wants it to say[0] or decline to provide the client with that letter. They do not go public with their reasons. [0] Companies want the letter to say whatever their regulators and/or contractual obligations demand that it say.
  - AtlasBarfed 4y ago
    If a public company gets an accounting audited and they find irregularities it is not subject to public disclosure requirements? Twitter is a publicly held company. I'm sure there are conflicts of interest and some degree of confidentiality for auditors and clients, but there is a fundamental public interest of disclosure, at a minimum to the government, in the event of irregularities. From the SEC: "In addition, we will continue to focus on auditors. As the Supreme Court noted nearly 30 years ago in U.S. v. Arthur Young & Co., 465 U.S. 805 (1984), auditors play a crucial role in the financial reporting process by serving as the “public watchdog.” So, it is important that we carefully monitor their work and ensure that they fully comply with their professional obligations. If there is a significant restatement or if we learn about improper accounting from a whistleblower, our proactive efforts, or the media, then you can expect that we will scrutinize not only the CEO, CFO and Controller, but also the engagement partner, engagement quality reviewer, and the auditing firm as a whole. We are going to probe the quality of the audit and determine whether the auditors missed or ignored red flags, whether they have proper documentation, and whether they followed professional standards. And it is important to remember that our ability to bring Rule 102(e) bars against auditors extends beyond instances where there are accounting irregularities at a public company. Our Rule 102(e) program is remedial in nature and meant to protect the integrity of the Commission’s processes. As a result, we can and have investigated auditors when their audits fail to meet the most basic standards, regardless of whether there was an actual problem with the auditing client. By pursuing actions over these bad audits, we can fully leverage the Division’s resources and close off access to those who shirk their responsibilities as gatekeepers to the securities markets." ------- From there you can see legal and institutional gravitas, ethics, and expectations of accountants and auditors of public companies. That's kind of what I'm getting at re: elevating security and certain IT roles to higher responsibility and codification. Now, is this a smear attempt by Jack Dorsey in relation to the Elon Musk lawsuit? Eh, maybe.
bink 4y ago
I agree with everything you said, but I'd like to play devil's advocate here. Mudge has worked: * L0pht / @stake: security research, red teaming, and source code auditing, IIRC. * BBN: research. * NFR: technical advisory board. * DARPA: Managing a program that provided grants for new security products and tools. * Google ATAP: Google's "invention studio". * CyberUL: Testing of security products. None of these jobs really suggest a background in building a security program. I've worked with some large companies in a similar space to Twitter building their security programs and you can spend the first 6-12 months just trying to justify the new budget. Often that money has to come from another team or teams and he would have to justify that. He was apparently only there roughly a year. Again, I don't doubt Mudge's bonafides. I don't doubt his security knowledge. But this job was nothing like any he's had in the past. I also don't doubt his claims. Everything he's stated is almost certainly true. It does take more than a year to fix most of these problems and I wonder if he just got frustrated with the political battles that occur in these situations.
- mthomasmw 4y ago
  You left out that he built the security program at Stripe.
  - spudlyo 4y ago
    He led the Security team at Stripe for a time, but it was a functioning team before he arrived.
- michaelt 4y ago
  Well, you can devils-advocate anyone into an incompetent. Decades of experience as a rebellious hacker? Well, that's not commercial experience. Founded a security consultancy? Too small, they just don't know how to operate in a large bureaucracy. Worked at a secretive company as an individual contributor? They've been completely silent in public, clearly they haven't achieved anything interesting in years. Working elsewhere as an individual contributor? They just don't know how to build a team. Decades as a senior manager at a huge multinational corporation? Out of touch bullshitter, stale coding skills, doesn't know how we really do things these days.

latchkey 4y ago

Even 20 years ago, extremely well spoken and has worked at high political levels... https://www.cnn.com/videos/business/2022/08/23/peiter-mudge-zatko-2000-vault-orig.cnn https://www.cnn.com/videos/business/2022/08/23/peiter-mudge-...

AtlasBarfed 4y ago

The subject of security consultants, security departments, and whistleblowing seems to me to be of particular concern. I mean, if an auditor publicly reports an audit finding that is ignored by the company and his ethics demand its reporting, is he branded a "whistleblower"? I do not think so, instead it is an "auditor finding". Why does that not apply here? It kind of dovetails with how pathetically organized IT in general is from a professional standpoint. Lawyers, Doctors, ... ?Accountants? and the like have centuries-codified procedures, principles, and the like for ethics. You generally don't get to hire one of those and tell them how to breach ethics (now, there are a lot of corrupt lawyers and a lot of corrupt accountants see: Arthur Andersen). The exploit industry has the 0day and x days of forewarning process, so there is that, but the fact a security consultant/professional gets accused of whistleblowing when... um, isn't that sort of the point? You hire a security consultant kind of like an auditor. And if auditors find major failings and they aren't addressed, aren't they supposed to report them? I'm pretty sure the security IT industry does not have even accountant levels of professional conduct and organizations. As IT subsumes and infiltrates, now to the point that fundamental bill of rights / human rights are dependent on secure and functioning IT systems, it gets... a bit more important. Arguably more important than the ethics around accountants and doctors. Lawyers, because they deal with the law, are probably more important still, but it shows that IT security may be rising in import to that level.

scott00 4y ago
That's not really how auditors work. Auditors either give the client a letter saying what the client wants it to say[0] or decline to provide the client with that letter. They do not go public with their reasons. [0] Companies want the letter to say whatever their regulators and/or contractual obligations demand that it say.
- AtlasBarfed 4y ago
  If a public company gets an accounting audited and they find irregularities it is not subject to public disclosure requirements? Twitter is a publicly held company. I'm sure there are conflicts of interest and some degree of confidentiality for auditors and clients, but there is a fundamental public interest of disclosure, at a minimum to the government, in the event of irregularities. From the SEC: "In addition, we will continue to focus on auditors. As the Supreme Court noted nearly 30 years ago in U.S. v. Arthur Young & Co., 465 U.S. 805 (1984), auditors play a crucial role in the financial reporting process by serving as the “public watchdog.” So, it is important that we carefully monitor their work and ensure that they fully comply with their professional obligations. If there is a significant restatement or if we learn about improper accounting from a whistleblower, our proactive efforts, or the media, then you can expect that we will scrutinize not only the CEO, CFO and Controller, but also the engagement partner, engagement quality reviewer, and the auditing firm as a whole. We are going to probe the quality of the audit and determine whether the auditors missed or ignored red flags, whether they have proper documentation, and whether they followed professional standards. And it is important to remember that our ability to bring Rule 102(e) bars against auditors extends beyond instances where there are accounting irregularities at a public company. Our Rule 102(e) program is remedial in nature and meant to protect the integrity of the Commission’s processes. As a result, we can and have investigated auditors when their audits fail to meet the most basic standards, regardless of whether there was an actual problem with the auditing client. By pursuing actions over these bad audits, we can fully leverage the Division’s resources and close off access to those who shirk their responsibilities as gatekeepers to the securities markets." ------- From there you can see legal and institutional gravitas, ethics, and expectations of accountants and auditors of public companies. That's kind of what I'm getting at re: elevating security and certain IT roles to higher responsibility and codification. Now, is this a smear attempt by Jack Dorsey in relation to the Elon Musk lawsuit? Eh, maybe.

bink 4y ago

I agree with everything you said, but I'd like to play devil's advocate here. Mudge has worked: * L0pht / @stake: security research, red teaming, and source code auditing, IIRC. * BBN: research. * NFR: technical advisory board. * DARPA: Managing a program that provided grants for new security products and tools. * Google ATAP: Google's "invention studio". * CyberUL: Testing of security products. None of these jobs really suggest a background in building a security program. I've worked with some large companies in a similar space to Twitter building their security programs and you can spend the first 6-12 months just trying to justify the new budget. Often that money has to come from another team or teams and he would have to justify that. He was apparently only there roughly a year. Again, I don't doubt Mudge's bonafides. I don't doubt his security knowledge. But this job was nothing like any he's had in the past. I also don't doubt his claims. Everything he's stated is almost certainly true. It does take more than a year to fix most of these problems and I wonder if he just got frustrated with the political battles that occur in these situations.

mthomasmw 4y ago
You left out that he built the security program at Stripe.
- spudlyo 4y ago
  He led the Security team at Stripe for a time, but it was a functioning team before he arrived.
michaelt 4y ago
Well, you can devils-advocate anyone into an incompetent. Decades of experience as a rebellious hacker? Well, that's not commercial experience. Founded a security consultancy? Too small, they just don't know how to operate in a large bureaucracy. Worked at a secretive company as an individual contributor? They've been completely silent in public, clearly they haven't achieved anything interesting in years. Working elsewhere as an individual contributor? They just don't know how to build a team. Decades as a senior manager at a huge multinational corporation? Out of touch bullshitter, stale coding skills, doesn't know how we really do things these days.