3 ms·

> The company also lacks sufficient redundancies and procedures to restart or recover from data center crashes, Zatko's disclosure says, meaning that even minor

> The company also lacks sufficient redundancies and procedures to restart or recover from data center crashes, Zatko's disclosure says, meaning that even minor outages of several data centers at the same time could knock the entire Twitter service offline, perhaps for good. I mean if it were true that seems pretty negligent. If that were the entire extent of the whistleblower complaint (not sure if complaint is the right term?), I would agree, but it seems as though there are some significant issue raised in the rest of the report.

kyrofa 4y ago
I dunno, pointing out that something has a poor architecture and pointing out that something has severe, known, and ignored security issues feels different.
- mzs 4y ago
  Knocking-out twitter (used by journalists and govs) during a crisis IS a security concern.
  - yupper32 4y ago
    A security concern for the governments, not twitter. It's not twitter's fault that governments are using it as a primary form of communication, nor should it be their responsibility to have amazing uptime just because governments are using their platform.
    - Willish42 4y ago
      It's a national security concern (and international?) if Twitter can be compromised by nefarious actors and/or brought down via said compromised access. The idea that this isn't worthy of whistleblowing because Twitter is a corporation is insane. There are countless examples in the last year of Twitter being used for communication during a crisis.
      - yupper32 4y ago
        That's ridiculous. If I created a service and the government happened to start using it, my service being taken down should not be labeled a national security issue against me. The national security issue would be the government deciding to rely on my service.
        shapefrog 4y ago
        For all the first amendment protectors out there - the government forcing a private company to comply with some mythical security / uptime standard so it can propagandise its population - that is an actual violation.
      - jasonm23 4y ago
        Ludicrous, but this is the situation... holy cow, imagine a future where TikTok likes, determine the outcome of an election. You can watch it live in 2024, when all of social media has morphed into TikTok clones.
- jnwatson 4y ago
  Availability is the A in the CIA triad. DR and resilience in general is part of security.
  - ryan_lane 4y ago
    That's never actually the case in an org chart, though. A CISO may require that a DR plan exists, but they're not the ones in charge of implementing it. Also, if they can handle a primary datacenter outage, they have a working DR plan. If I was working on an infrastructure team and was told I needed to handle multiple, simultaneous datacenter outages, I'd start looking for another job.

kyrofa 4y ago

I dunno, pointing out that something has a poor architecture and pointing out that something has severe, known, and ignored security issues feels different.

mzs 4y ago
Knocking-out twitter (used by journalists and govs) during a crisis IS a security concern.
- yupper32 4y ago
  A security concern for the governments, not twitter. It's not twitter's fault that governments are using it as a primary form of communication, nor should it be their responsibility to have amazing uptime just because governments are using their platform.
  - Willish42 4y ago
    It's a national security concern (and international?) if Twitter can be compromised by nefarious actors and/or brought down via said compromised access. The idea that this isn't worthy of whistleblowing because Twitter is a corporation is insane. There are countless examples in the last year of Twitter being used for communication during a crisis.
    - yupper32 4y ago
      That's ridiculous. If I created a service and the government happened to start using it, my service being taken down should not be labeled a national security issue against me. The national security issue would be the government deciding to rely on my service.
      - shapefrog 4y ago
        For all the first amendment protectors out there - the government forcing a private company to comply with some mythical security / uptime standard so it can propagandise its population - that is an actual violation.
    - jasonm23 4y ago
      Ludicrous, but this is the situation... holy cow, imagine a future where TikTok likes, determine the outcome of an election. You can watch it live in 2024, when all of social media has morphed into TikTok clones.
jnwatson 4y ago
Availability is the A in the CIA triad. DR and resilience in general is part of security.
- ryan_lane 4y ago
  That's never actually the case in an org chart, though. A CISO may require that a DR plan exists, but they're not the ones in charge of implementing it. Also, if they can handle a primary datacenter outage, they have a working DR plan. If I was working on an infrastructure team and was told I needed to handle multiple, simultaneous datacenter outages, I'd start looking for another job.