4 ms·

Is it just me, or does some of this feel less whistleblower-y and more petty? For example: > The company also lacks sufficient redundancies and procedures to r

by kyrofa 4y ago

Is it just me, or does some of this feel less whistleblower-y and more petty? For example: > The company also lacks sufficient redundancies and procedures to restart or recover from data center crashes, Zatko's disclosure says, meaning that even minor outages of several data centers at the same time could knock the entire Twitter service offline, perhaps for good. That said, this is Mudge. I have a lot of respect for the guy, and I believe what he says. I'll chalk the pettiness up to this article being a summary of a more complete document that I'd like to read at some point.

chipgap98 4y ago
> The company also lacks sufficient redundancies and procedures to restart or recover from data center crashes, Zatko's disclosure says, meaning that even minor outages of several data centers at the same time could knock the entire Twitter service offline, perhaps for good. I mean if it were true that seems pretty negligent. If that were the entire extent of the whistleblower complaint (not sure if complaint is the right term?), I would agree, but it seems as though there are some significant issue raised in the rest of the report.
- kyrofa 4y ago
  I dunno, pointing out that something has a poor architecture and pointing out that something has severe, known, and ignored security issues feels different.
  - mzs 4y ago
    Knocking-out twitter (used by journalists and govs) during a crisis IS a security concern.
    - yupper32 4y ago
      A security concern for the governments, not twitter. It's not twitter's fault that governments are using it as a primary form of communication, nor should it be their responsibility to have amazing uptime just because governments are using their platform.
      - Willish42 4y ago
        It's a national security concern (and international?) if Twitter can be compromised by nefarious actors and/or brought down via said compromised access. The idea that this isn't worthy of whistleblowing because Twitter is a corporation is insane. There are countless examples in the last year of Twitter being used for communication during a crisis.
        yupper32 4y ago
        That's ridiculous. If I created a service and the government happened to start using it, my service being taken down should not be labeled a national security issue against me. The national security issue would be the government deciding to rely on my service.
        shapefrog 4y ago
        For all the first amendment protectors out there - the government forcing a private company to comply with some mythical security / uptime standard so it can propagandise its population - that is an actual violation.
        jasonm23 4y ago
        Ludicrous, but this is the situation... holy cow, imagine a future where TikTok likes, determine the outcome of an election. You can watch it live in 2024, when all of social media has morphed into TikTok clones.
  - jnwatson 4y ago
    Availability is the A in the CIA triad. DR and resilience in general is part of security.
    - ryan_lane 4y ago
      That's never actually the case in an org chart, though. A CISO may require that a DR plan exists, but they're not the ones in charge of implementing it. Also, if they can handle a primary datacenter outage, they have a working DR plan. If I was working on an infrastructure team and was told I needed to handle multiple, simultaneous datacenter outages, I'd start looking for another job.
maximilianburke 4y ago
I don't think it's petty; availability of data and systems is a core component of security design.
riffic 4y ago
for a company that likes to speak of itself as being a valuable piece of communication infrastructure (it isn't, Twitter's a website), this is pretty concerning and shows a lack of seriousness compared to oh, say, the Bell System. Gov (a term that ranges from your head of state down your county dog-catcher,) needs to get off these services asap. Twitter, TikTok, Instagram, FB are all modern versions of your old AOL Keyword. Today we have ActivityPub, a W3C recommendation, which would be a great alternative.
MuffinFlavored 4y ago
It doesn't help that he's a "disgruntled employee who was fired". I added that "disgruntled" part but... who gets fired for poor performance and doesn't become at least slightly disgruntled?
- Sebb767 4y ago
  Someone who's happy with his employer is not going to become a whistleblower, so this isn't really an argument against him but more so against whisteleblowers overall. And it's quite save to say that we had a lot of important facts uncovered by whisteleblowers.
cheeselip420 4y ago
Ah yes - the minor outage of several data centers... Next you'll tell me that Twitter would't survive global thermonuclear war.
ryan_lane 4y ago
Quite a few parts of it are petty, and honestly feel like he was at war with most of the leaders. He wasn't responsible for disaster recovery, or reliability, yet he was reporting to the board (going above his reporting chain), telling them that the company wasn't doing enough because it can't handle _multiple_ data center outages at once? Very, very few companies could handle that. If twitter can handle their primary datacenter failing, then they do have a working DR plan. They aren't lying. Is the DR plan to Mudge's liking? Obviously not, but his idea of a DR plan is out of line with what the vast majority of the industry considers a reasonable DR plan. Similarly, mDAU vs user/bot numbers aren't lies. The company switched their reporting metric. They're accurately reporting their growth metric to the board, and to the shareholders. The raw user numbers could actually matter to the board/shareholders, but the board could have required them to report them and didn't. Just because they aren't reporting the metric you'd prefer them to report doesn't mean they're lying to anyone. There are a number of legitimate complaints in the disclosure related to poor security practices, but many of them feel like internal problems that don't rise to the level of crimes. Sadly, he may have had a hard time moving the needle on those issues because he was spending his time fighting everyone. He's a gifted engineer, and may even be a gifted leader, but that doesn't mean he was doing a good job in the culture he was working in. I read the whole document, and the majority feels like someone running headfirst into bad cultural issues and burning out while making enemies.

by kyrofa 4y ago

chipgap98 4y ago

> The company also lacks sufficient redundancies and procedures to restart or recover from data center crashes, Zatko's disclosure says, meaning that even minor outages of several data centers at the same time could knock the entire Twitter service offline, perhaps for good. I mean if it were true that seems pretty negligent. If that were the entire extent of the whistleblower complaint (not sure if complaint is the right term?), I would agree, but it seems as though there are some significant issue raised in the rest of the report.

kyrofa 4y ago
I dunno, pointing out that something has a poor architecture and pointing out that something has severe, known, and ignored security issues feels different.
- mzs 4y ago
  Knocking-out twitter (used by journalists and govs) during a crisis IS a security concern.
  - yupper32 4y ago
    A security concern for the governments, not twitter. It's not twitter's fault that governments are using it as a primary form of communication, nor should it be their responsibility to have amazing uptime just because governments are using their platform.
    - Willish42 4y ago
      It's a national security concern (and international?) if Twitter can be compromised by nefarious actors and/or brought down via said compromised access. The idea that this isn't worthy of whistleblowing because Twitter is a corporation is insane. There are countless examples in the last year of Twitter being used for communication during a crisis.
      - yupper32 4y ago
        That's ridiculous. If I created a service and the government happened to start using it, my service being taken down should not be labeled a national security issue against me. The national security issue would be the government deciding to rely on my service.
        shapefrog 4y ago
        For all the first amendment protectors out there - the government forcing a private company to comply with some mythical security / uptime standard so it can propagandise its population - that is an actual violation.
      - jasonm23 4y ago
        Ludicrous, but this is the situation... holy cow, imagine a future where TikTok likes, determine the outcome of an election. You can watch it live in 2024, when all of social media has morphed into TikTok clones.
- jnwatson 4y ago
  Availability is the A in the CIA triad. DR and resilience in general is part of security.
  - ryan_lane 4y ago
    That's never actually the case in an org chart, though. A CISO may require that a DR plan exists, but they're not the ones in charge of implementing it. Also, if they can handle a primary datacenter outage, they have a working DR plan. If I was working on an infrastructure team and was told I needed to handle multiple, simultaneous datacenter outages, I'd start looking for another job.

maximilianburke 4y ago

I don't think it's petty; availability of data and systems is a core component of security design.

riffic 4y ago

for a company that likes to speak of itself as being a valuable piece of communication infrastructure (it isn't, Twitter's a website), this is pretty concerning and shows a lack of seriousness compared to oh, say, the Bell System. Gov (a term that ranges from your head of state down your county dog-catcher,) needs to get off these services asap. Twitter, TikTok, Instagram, FB are all modern versions of your old AOL Keyword. Today we have ActivityPub, a W3C recommendation, which would be a great alternative.

MuffinFlavored 4y ago

It doesn't help that he's a "disgruntled employee who was fired". I added that "disgruntled" part but... who gets fired for poor performance and doesn't become at least slightly disgruntled?

Sebb767 4y ago
Someone who's happy with his employer is not going to become a whistleblower, so this isn't really an argument against him but more so against whisteleblowers overall. And it's quite save to say that we had a lot of important facts uncovered by whisteleblowers.

cheeselip420 4y ago

Ah yes - the minor outage of several data centers... Next you'll tell me that Twitter would't survive global thermonuclear war.

ryan_lane 4y ago

Quite a few parts of it are petty, and honestly feel like he was at war with most of the leaders. He wasn't responsible for disaster recovery, or reliability, yet he was reporting to the board (going above his reporting chain), telling them that the company wasn't doing enough because it can't handle _multiple_ data center outages at once? Very, very few companies could handle that. If twitter can handle their primary datacenter failing, then they do have a working DR plan. They aren't lying. Is the DR plan to Mudge's liking? Obviously not, but his idea of a DR plan is out of line with what the vast majority of the industry considers a reasonable DR plan. Similarly, mDAU vs user/bot numbers aren't lies. The company switched their reporting metric. They're accurately reporting their growth metric to the board, and to the shareholders. The raw user numbers could actually matter to the board/shareholders, but the board could have required them to report them and didn't. Just because they aren't reporting the metric you'd prefer them to report doesn't mean they're lying to anyone. There are a number of legitimate complaints in the disclosure related to poor security practices, but many of them feel like internal problems that don't rise to the level of crimes. Sadly, he may have had a hard time moving the needle on those issues because he was spending his time fighting everyone. He's a gifted engineer, and may even be a gifted leader, but that doesn't mean he was doing a good job in the culture he was working in. I read the whole document, and the majority feels like someone running headfirst into bad cultural issues and burning out while making enemies.