16 ms·

The Twitter whistleblower story is worse than you think

218 points by nickwritesit 4y ago

wpietri 4y ago
Seems like the real point here is that it's not worse about Twitter, but about industry security in general. Which was my impression when I skimmed the initial whistleblower complaint. It clearly wasn't great, and "Twitter’s leadership was [...] apathetic, ineffectual, or dishonest" certainly resonated with my short stint there. But I've heard worse stories from bigger, more important places than Twitter.
- gopher_space 4y ago
  > I've heard worse stories from bigger, more important places than Twitter I think everyone with experience has, which makes me wonder who the target audience is here.
  - sangnoir 4y ago
    Mudge knows this too, as much as anyone. Which makes the question even more pertinent.
  - ForHackernews 4y ago
    Very obviously Elon Musk who has 44 billion reasons to be eternally grateful to any Twitterati who can help him reneg on his impulse purchase.
- kibwen 4y ago
  What's the inverse? Which companies actually have good internal security practices?
  - wpietri 4y ago
    Great question! And for me there are two kinds of good in partial conflict here: good for security, and good for getting things done. Having done contracts for places where I needed multiple levels of approval to install anything on my developer machine, both are important to me.
  - foobarian 4y ago
    It’s not like twitter has sensitive personal or financial information to lose. I’m sure companies that store SSNs or financial records do a much better job /s
    - threeseed 4y ago
      > I’m sure companies that store SSNs or financial records do a much better job Generally they do. Because during an exposure incident they often have to deal with regulators who punish them much more than the market will.
      - ForHackernews 4y ago
        Name one time that has ever happened. Experian leaked basically every American's SSN and credit history, and they got off with a $22m settlement.
  - threeseed 4y ago
    Banks have excellent security. But often the restrictions are so onerous that productivity suffers. One of the banks I recently worked at flipped the model from heavily restricting what users and systems can do to allowing them to do anything (including admin access for developers) and aggressively monitoring them. In comparison my current bank needed 4 weeks and manager approvals to get a mouse driver installed.
    - ethbr0 4y ago
      From the article "Nevertheless, the presence of Shadow IT in an organization speaks to some larger problems: (1) Lack of effective communication from security and IT teams about security risks (2) Employees who feel they aren’t given the tools they need and with no clear way to ask for them (3) No visibility into endpoints to reveal the presence of unapproved tools" I have yet to work for a company that has IT security and IT management in the same org. Which is insane. Why are companies empowering someone to say "No" (CISO), without requiring that same individual to justify not saying "Yes"? If a user requests a tool, IT sec/management should be leaning in and asking "What can we provide you will that will satisfy this need?" Instead, and I assume my experience generalizes to everyone who's worked in regulated tech, the response is "No, that's not approved" and ends the conversation.
      - DiggyJohnson 4y ago
        My thoughts exactly. I noticed a pattern in my personal behavior of “can I install an unapproved developer tool early in the onboarding process”. Even on enterprise machines in IT departments of firms you’ve certainly heard of, I’ve found that I can get away with my portable install / side loaded browser plug-in every single time. This is just my rambling thoughts, not sure if I have a main point, but realizing this pattern has certainly contributed to my personal sense of disillusionment.
      - PeterisP 4y ago
        For the same reason why companies don't have their internal audit in the same org as their accountants and their financial controllers under business unit managers, inherent conflict of interest. The job that the security org is doing for the board/owners/etc is controlling risk because they don't trust if their IT org says "everything is totally fine", and consider it likely that if the decision about whether to implement some activity or not is left purely to the IT org, then the convenience of implementation will override the level of risk control that the board/owners desire, so they choose to put these controls in a separate organization, empowering someone to say "Not until you do all this unwelcome work to implement it to the standards the company has chosen", preventing all the many mid-managers to save their effort or their costs by cutting corners at the expense of risks to "someone else's" money. Of course, having these functions together is much more efficient in many ways! But the principal-agent problem is very real, especially so in large organizations, so that's why these choices get made this way, designing organizational structures that act as checks and balances on each other, not expecting everyone to magically cooperate for the greater good.
  - Veserv 4y ago
    Depends on how you define good. If by good you mean: the company would have no problems putting in their advertising the number the CISO knows about how much it would cost to completely invalidate their security and their customers and investors would be happy, or at least non-livid, if they were told; then none in the Fortune 500. If by good you mean: somewhere where that number is more than $1M, the smallest unit that appears on their 10-Ks which usually use millions as their smallest unit, then probably none in the Fortune 500. If you raise it to $10M, then without a doubt there are none. If by good you mean: "better" than other companies, but still trapped in a valley with the horde of hungry bears faster than them, then who cares, the bears are still going to eat them soon.
  - fakethenews2022 4y ago
    I worked for a company that had ALL those practices in place PLUS required annual security training PLUS they ran simulated phishing attacks to see if people would report incidents.
- nradov 4y ago
  IT security in the healthcare and financial sectors is now generally pretty good. After a few high profile incidents, everyone is scared and systems are a lot more locked down on average. Although you can still find problems on occasion, mostly in smaller organizations. But why should we even worry about security on social media sites? I really have zero sympathy for people who upload private data to those companies and then complain when it gets hacked. What the hell did they expect? Twitter was never under any legal or contractual requirement to provide good security for user data.
  - worik 4y ago
    > IT security in the healthcare and financial sectors is now generally pretty good Generally? I cannot say. This was around the corner from me, and is an anecdote. https://en.wikipedia.org/wiki/Waikato_District_Health_Board_ransomware_attack https://en.wikipedia.org/wiki/Waikato_District_Health_Board_... IN the news at the time the cause was "somebody clicked on a link they shouldn't have" In reality the cause was comprehensive failure of computer professionals (like us) to do their job, and an unbelievable lack of accountability Compare with this: https://en.wikipedia.org/wiki/CTV_Building https://en.wikipedia.org/wiki/CTV_Building We have nothing like the accountability that civil engineers face. This will hopefully not last so we get a chance to do our jobs properly
  - bawolff 4y ago
    > Twitter was never under any legal...to provide good security for user data. "Good" is ambigious,but there are privacy laws that do apply to twitter (especially but not exclusively in the eu)
  - dotnet00 4y ago
    They shouldn't have to be legally obligated to make them have decent security as a simple business practicality. Private data can be something as simple as DMs between people, which if leaked can cause plenty of trouble (an example that comes to mind is streamers having to deal with a lot of drama from their fanbase because leaks revealed they were acquainted with a streamer of the opposite gender). On top of that with so many government officials and company CEOs on the platform it should be pretty obvious why access to the backend should be carefully controlled. There already was that incident a few years ago where someone got access to the backend via social engineering and tweeted out crypto scams from high profile accounts like Musk, Biden, Bezos, Apple etc.
miduil 4y ago
This "whistleblower" made me finally close one of my private accounts, turns out the official data export is much more complete nowadays - including private messages and an easy to use static HTML page. I'm surprised that such a "zero trust" system isn't established at Twitter yet, considering the size they were operating in.
Overtonwindow 4y ago
What does this mean for the sale of Twitter? I still can't quite figure that out. Does Musk really want it at a lower price, or is he truly walking away from the deal? If he walks away from the deal what happens then? Someone else buys it? I guess the real question is: Can twitter be saved?
- dangets 4y ago
  It is questionable whether he _can_ walk away from the deal. He signed all of the contracts and made legally binding promises to lenders with no clauses around misleading amount of spam bots or security issues. Of course, laws are more bendable when you're that rich and stand to lose billions. If you're really interested in this stuff, it has been an ongoing centerpiece in Matt Levine's newsletter. Articles are free if you subscribe to the email, but reading prior pieces may require a subscription. e.g. https://news.bloomberglaw.com/securities-law/matt-levines-money-stuff-musk-cancels-twitter-deal-some-more https://news.bloomberglaw.com/securities-law/matt-levines-mo...
- wpietri 4y ago
  I suspect it doesn't mean much for the sale. From what I understand, it's mainly down to the agreements signed with Twitter and what the Delaware courts make of them in the trial starting October 17th. Those agreements are very Twitter-friendly, so my personal guess is that Musk is going to lose. As to what he wants, Musk is mercurial enough that I'm not sure that's a meaningful question. Did he want Twitter for a little while? Yes. Did that ever make sense given his other responsibilities? No. Did it make sense to investors? Based on Tesla's stock price slide, definitely not. Is he having buyer's remorse? Clearly. If he got a really good deal on it, might he swing back? Who knows. Is Twitter so badly run that they might do better in somebody else's hands? Yes. Is that person Musk? I doubt it. So if I were betting on Musk being smart, I'd be that Twitter will charge him a few billion dollars to get out of the deal, which would be better for everybody than Musk taking a $14 billion loss the instant the deal closes (which is is $44 billion bid minus the $30 billion that is Twitter's current market cap). But Musk could well be more prideful than smart, so I'm excited to see how all this turns out.
29athrowaway 4y ago
Mudge is for real. https://www.youtube.com/watch?v=VVJldn_MmMY https://www.youtube.com/watch?v=VVJldn_MmMY
- bumbledraven 4y ago
  Epic video. Broadcast live on CSPAN in 1998. Transcript: https://nsarchive.gwu.edu/sites/default/files/documents/5680645/Document-01-Senate-Committee-on-Governmental.pdf https://nsarchive.gwu.edu/sites/default/files/documents/5680... Fred Thompson (R, TN), Chairman, Committee on Governmental Affairs: …If you gentlemen would come forward… We’re joined today by the seven members of the L0pht, Hacker think Tank in Cambridge Massachusetts. Due to the sensitivity of the work done at the L0pht, they’ll be using their hacker names of Mudge, Weld, Brian Oblivion, Kingpin, Space Rogue, Tan, and Stefan. … Sen. Thompson: I am informed that, you think that within 30 minutes the seven of you could make the internet unusable for the entire nation, is that correct? Mudge: That’s correct. Actually one of us with just a few packets.
  - 29athrowaway 4y ago
    Likely they referred to creating a routing black hole in BGP networks. Announcing you have the fastest route to other nodes, and then not routing the traffic you receive.
purpleblue 4y ago
Very clickbait-y title but a good article. I read through the actual whistleblower complaint and to be honest I was shocked as well. If true, the security on their laptops was extremely lax or nonexistent. My current and previous companies will not let me install what I want on my laptop. Even something as innocuous as Signal is not allowed and I'm too scared to push the issue. I basically assume that everything I do is being watched and keylogged which actually makes life a lot easier for me. The idea that Twitter would allow anything to be installed is kind of shocking to be honest. It sounds like they're not taking their place of prestige in the Internet hierarchy very seriously. The fact that Mudge couldn't lock things down after Jan 6 or that there wasn't adequate logging etc is also extremely shocking. I would love to hear Twitter's side of it and the reason why it wasn't a priority. Was it because Jack Dorsey had taken his eye off the ball and was a missing leader that lead to this? Or was it Parag Agrawal's poor leadership as CTO and CEO? It certainly sounds like he was an obstacle in the way of Mudge, which doesn't sit well with me at all.
- awsthrowaway445 4y ago
  > The idea that Twitter would allow anything to be installed is kind of shocking to be honest. For what it’s worth, AWS has the same somewhat lax policies about installing software on company laptops. That’s not a diss to AWS security mind you, I’m sure it’s top of the line.
  - nindalf 4y ago
    Meta security also allows any software to be installed. But they also keep a track of laptop state through the osquery daemon that's always running. GP was talking like this alone was gross negligence, implying that this is different from the rest of the industry. That doesn't seem to be the case.
    - rogerkirkness 4y ago
      We do this as a 60 person company.
    - 4y ago
neverrroot 4y ago
- SketchySeaBeast 4y ago
  > The amount of censorship and methods involved is unlike any other platform. That seems a funny claim. Would we be at all surprised to find out that facebook sucks in the same ways?
  - neverrroot 4y ago
    +1 for bringing up FB as a comparison. They also do it, but in my experience not as much as Twitter. Been monitoring both Twitter and FB and Twitter is just incredible biased towards left.
    - wpietri 4y ago
      What's your data here? And what does "biased towards left" even mean? In one sense, it's trivial to prove, in that Twitter bans a lot of hate and abuse, and these days targeted hate is a popular tool of the right across the globe. (See, e.g., anti-gay and anti-trans panics going on all over. Or specific ethnic hate depending on region.) So if cracking down on that is being biased toward the left, then yes, Twitter definitely is. But presumably you're saying something else?
      - plushpuffin 4y ago
        As you noted, the greater prevalence of right-wing violence, hate speech, and disinformation/misinformation causes the appearance of a moderation bias against conservatives. However, there has been an actual measured bias in favor of conservative voices (circa late 2021, the home timeline algorithm may have changed since then). In other words, conservatives do more stuff to run afoul of the terms of service, and they also receive better treatment. GP is wrong/misinformed. https://www.techdirt.com/2022/04/18/fascinating-new-study-suggests-again-that-twitter-moderation-is-biased-against-misinformation-not-conservatives/ https://www.techdirt.com/2022/04/18/fascinating-new-study-su... https://www.theguardian.com/technology/2021/oct/22/twitter-admits-bias-in-algorithm-for-rightwing-politicians-and-news-outlets https://www.theguardian.com/technology/2021/oct/22/twitter-a...
bmismyname 4y ago
You can tell Twitter (and the other techies) don't care about "security" when they force you to use SMS for 2FA when we all know they're doing that to harvest phone numbers because they're a pretty o.k. way to link identities.
- deleted 4y ago
  [deleted]
- zimpenfish 4y ago
  > they force you to use SMS for 2FA It's not exclusive, though; you can switch to an authenticator like Authy or even a hardware device like Yubikey.
  - bmismyname 4y ago
    I think the scheme they used was to require a phone number to set it up the first time, and after that you could switch to TOTP or whatever. Authy also harvests phone numbers.
howmayiannoyyou 4y ago
Solution: Statutory damages for companies who release software with grossly negligent or malicious disregard for best security practices. This form of civil liability has given us safer cars, home products, machinery, and professional services. Its most often preemptively enforced, not by our court system, but by insurance carriers who insure against the liability.
- avg_dev 4y ago
  I believe this is a good idea. I don't know a whole lot about law-making, but I know that a lot of ransomware cases could have been prevented by enforcing updates to various packages and operating systems. Please note that I am not claiming that updates are a silver bullet. I am sure if someone managed to obtain credentials that allowed them to release an update for MS Windows, say, and that update installed a keylogger, it would be bad news. But regular updates at the source code dependency, OS, firmware, networking hardware, device layers, mandatory code review, hardware FIDO/U2F tokens, training on best practices for handling data and for writing and reviewing secure code, use of modern encryption algorithms, encryption of sensitive data at rest, requirements to not store PII without a proven need, requirements to change default passwords (or even better yet - laws mandating non-default passwords at ship time), ongoing anti-phishing training, and the like will all help us stay safer. There are bad actors out there. We all make mistakes. Our industry is maturing at an altogether unacceptably slow rate, IMO - a lot of these techniques are well known in the industry, but they cost money and time to implement, and nobody seems to want to expend that effort until it's too damn late. I am not a security expert. Just a developer who tries my best to pay attention.
- pattisapu 4y ago
  Makes sense. Reallocate the cost to the cheapest cost avoider.
  - howmayiannoyyou 4y ago
    No. When there is a claim the insurance company will look for every reason not to cover and stick the insured with the defense and judgement bills. If the insured fails to meet the carrier's requirements they are screwed.
jmyeet 4y ago
Here's something you should know about whistleblowers in the US. If a whistleblower makes disclosures to the SEC that result in a judgement if the SEC successfully sues the subject of that disclosure. This can be worth tens of millions of dollars. That doesn't mean their claims are false. But you should always be skeptical. The second issue is the trial resulting from Elon Musk walking away from the Twitter acquisition. That acquisition agreement calls for "specific performance", which means Elon pretty much agreed to buy the company no matter what (he waived due diligence). He is expected to have to pay a fortune if not actually buy the company in his trial next month. So it's at least worth noting that this disclosure happens right at a time when it might help Elon. Maybe unrelated but it's also a hell of a coincidence. Employees that are fired (or are heading in that direction) can make all sorts of claims to deflect away from the fact that they were or soon would be fired, possibly with cause, possibly not. The specific claims seem to be a little vauge like not giving employees tools to combat bots. Like what does that even mean? Twitter may have crappy infra for this but does it rise to the level of negligence or even malfeasance? That's not a slam dunk from what I've seen. Keep an open mind but remain skeptical.
- dogecoinbase 4y ago
  Additionally, incentives exist for him to report things he himself did while at Twitter, for example: https://twitter.com/igb/status/1562072030010191880 https://twitter.com/igb/status/1562072030010191880 > [Mudge and Sethi] deprioritized Twitter's kernel & OS upgrade and encryption at rest initiatives. (from Ian Brown, who deserves his good reputation as much as anyone I've met)
- skrtskrt 4y ago
  there's rewards for whistleblowers because often doing so will destroy your career and result in massive legal bills from much more powerful entities suing you. Mudge was already an officer of the company, he had much more guaranteed money to gain from just shutting up and staying there.
  - pclmulqdq 4y ago
    That's a very short-sighted view of a career. In the short term, it is bad for your career, but being a whistleblower who is right can raise your profile significantly and make you much wealthier than if you stay at a company quietly (even if your salary is $X million). In Mudge's case, he didn't need the money, but the publicity probably helped. Think about some of the past whistleblowers from these companies: Frances Haugen, Timnit Gebru, etc. These are all people for whom whistleblowing was a good career move.
1vuio0pswjnm7 4y ago
The best "security" is not to give data to "tech" companies. It is never too late to stop doing something stupid. It is unfortunate that governments will not help citizens in this regard by adequately regulating collection of data by "tech" companies. Laws limit data collection by governments from their citizens, for good reason. Meanwhile "tech" companies are under no such restrictions, which is beyond reason.
- tqi 4y ago
  > It is never too late to stop doing something stupid This attitude, combined with a pathological inability to state what the practical harms/risks are, is why "privacy advocates" never get anywhere.
- 1vuio0pswjnm7 4y ago
  What are the practical harms/risks of not sending data to "tech" companies. There are none.
fakethenews2022 4y ago
I wonder when the security practices mudge pushed for got put into place at various companies? The company I worked for put those into place between 5-7 years ago: limiting who had access to production, logging access, MDM, security scans on computers, security training, etc... Was twitter behind the curve?
durpkingOP 4y ago
This seems like a rehashed article and "worse than you think" doesn't apply.
mupuff1234 4y ago
So why isn't Twitter hacked every other day? I'm sure there's security issues at Twitter, but I don't see a reason to believe it's so much worse than other companies.
- avg_dev 4y ago
  From the article I found this link: https://firewalltimes.com/twitter-data-breach-timeline/ https://firewalltimes.com/twitter-data-breach-timeline/ I would argue that it really doesn't matter if Twitter is worse than most other companies, the problem is that none of these companies should be operating with such poor (non-existent) standards. Especially when they have as much data as Twitter. I personally "protect" my tweets so that others, like my employer, cannot see them. There are many more people with so much more sensitive information that are trusting in this system.
  - enos_feedler 4y ago
    Quantity of data is not quality of data.
    - avg_dev 4y ago
      https://www.theguardian.com/business/2013/apr/23/ap-tweet-hack-wall-street-freefall https://www.theguardian.com/business/2013/apr/23/ap-tweet-ha...
gwittel 4y ago
In reading Mudges' complaint, it really paints the Twitter leadership (esp. Agrawal) as simply not caring about security enough to do anything about it. Instead you had an org with massive amounts of technical and operational debt, and leadership not willing to invest in it. There are always tradeoffs between fixing technical debt and building new features. Twitter leadership chose to ignore (and to some extent, hide) the problem rather than invest. They certainly aren't unique in having a security plan that is built around hope. Engineers having full control over their dev machines up to and including preventing system updates is not ideal; but not out of the norm for tech. Poor data access controls, and out of date server fleets (where I'd expect updates to be pretty automated) are far more worrying to me.
- googlryas 4y ago
  I wonder if Mudge was fired for, basically, being too good at his job. He didn't toe the CEO's line, and was pointing out how the house was on fire, which is not what Agrawal wanted to hear(maybe Dorsey wanted to hear it when he hired Mudge, but Agrawal had different ideas). I suspect that most people who make it ultra high level as "Head of X", are hired more for their organizational/social talents, which oftentimes involves capitulating to those more powerful/higher on the food chain, rather than being actually talented at X. Mudge actually has the bona fides for the role, which is why he got fired (I'm guessing).
  - ImPostingOnHN 4y ago
    It's worth noting that being good at IT Security is in huge part a function of your soft skills, since you should be able to sell security to the org, since your job is to make the work happen, not to identify it and complain that it needs to be done any amateur can run some automated scanners and issue security diktats to the rest of the organization
    - googlryas 4y ago
      I mean...Twitter hired him as head of security. They ostensibly already cared about security. Or, at least Dorsey did, maybe Agrawal didn't. I suspect he wanted a yes man to offer some minor changes and say "Yup, everything's secure here". Before this, Mudge was facilitating the NSC in ultra high level briefings to provide accurate reports to POTUS. I suspect you don't end up in that position without some strong soft skills. But, as strong as they are, you can't convince someone who doesn't want convincing.
CSDude 4y ago
> But putting that aside, employees installing “whatever software they want” is already a significant eyebrow-raiser. How do you ensure you are not a gatekeeper but also keeping company secure? Vetting software installations would be killer for any productivity at that scale I guess. Does it include npm install too which can run scripts or just desktop apps, chrome extensions?
- ryandrake 4y ago
  I agree with this. Allowing people to install software is not necessarily a security risk, but it can be if your company's overall security is vulnerable to hostile software on employee computers. In software development, you need to install software in order to do your job. I've worked at two "big tech" companies, and both of them had a policy of allowing employees (at least in engineering) to have root on their devices and install what they need to do their work. 1. We're intelligent adults and trusted to not fuck everything up, and 2. Internal systems are properly secured against fuck-ups, so a rogue compromised laptop on an internal network should not be able to screw anything up anyway. Then again, I've worked at smaller companies that thought their perimeter firewall and VPN for employees was adequate security. Once one got onto the internal network, there was no defense in depth. A compromised laptop (not to mention a disgruntled insider) that managed to get onto the internal network could literally wipe everything out.
soheil 4y ago
> And most importantly, the software on these endpoint computers was reporting dire problems. Over 30% of the more than 10,000 employee computers were lacking the most basic security settings, such as enabling software updates. Who are these people writing articles like this? Not enable [automatic?] software updates is equivalent to dire problems?
- groby_b 4y ago
  Presumably, they are people with at least a modicum of understanding of security. Enabling auto-updates (or, better, controlled pushes of updates via your IT folks) is absolute bare-bones minimum-you-can-do security. Otherwise, those laptops are all collections of well-known security holes.
closeparen 4y ago
>and all engineers had some form of critical access to the production environment Not to excuse the lack of monitoring or fine-grained control, but most engineers having some kind of prod access is what happens at companies where you are oncall for your own services / dev and ops are not separate roles.
ssklash 4y ago
> “…according to expert quantification and analysis in January 2022, over half of Twitter’s 8,000-person staff was authorized to access the live production environment and sensitive user data. Twitter lacked the ability to know who accessed systems or data or what they did with it in much of their environment.” Half of any company having access to prod is insane, but half of a giant like Twitter is unimaginable to me. It really explains how compromising single employees seems so effective there.
- rmatt2000 4y ago
  In the political Twitter neighborhoods that I inhabit, there have been many cases over the years of people having their accounts yanked, with the only message being "You have been banned for violating the Twitter rules. This decision is final and cannot be appealed." When these bannings get publicized, however, the bad publicity often leads to the "permanent ban" being reversed, with Twitter simply explaining that the original ban "was a mistake". How does this sort of thing happen so often, unless random employees have access to powerful tools that they are not authorized or trained to use?
  - SilverBirch 4y ago
    Here's the obvious counter - social media companies are by nature trying to chase super-linear cost:return ratios. So they can't actualy accept that N users mean N/x moderators. So instead, you hire Y moderators, and any time anyone points out you've shit the bed you wave your hands in the air and whisper "AI" when really what's happening is Y < N/x so you have a shit moderation team.
    - rmatt2000 4y ago
      If there aren't enough moderators, wouldn't the likely result be fewer rule-breaking accounts banned rather than more non-rule-breaking accounts banned? Maybe, instead of hiring N skilled moderators for $D, they could be hiring N * \delta unskilled moderators for the same price.
enos_feedler 4y ago
But it’s not horrifying either. Twitter transacts mostly junk messages. Any serious journalist I’ve seen on twitter says to DM on signal.
toss1 4y ago
>>Twitter employees were repeatedly found to be intentionally installing spyware on their work computers at the request of external organizations.” That right there is a forking nuclear showstopper . . . and nevermind the moire broad >>employees could install “whatever software they want” Effectively, twitter has zero security. For journalists, or anyone working in an environment that has kinetic consequences (opposition to authoritarian regimes, etc.), it is right up there in the frightening scale...
sudden_dystopia 4y ago
Has the author not see. The collective shrug from society when it comes to security? Why are they surprised? People still flock to Facebook and google in droves. And now Tik tok. Clearly people do not give any f’s about privacy and security.
- pvarangot 4y ago
  People shift there because the content creators they like are there. A huge portion of the Facebook and Twitter user base is into news and they can shrug about security but if the journalists don't then they won't get their fix.
- turtleman1338 4y ago
  There is a big difference between privacy and security.
whoisstan 4y ago
How does google handle all those mentioned problems? Would be great to contrast that to twitter, especially how easy it is to read Twitter DMs vs gmail messages.
- saagarjha 4y ago
  The main difference I’ve observed is that Google uses BeyondCorp rather than a VPN and Santa runs in the background, plus a bunch of scripts that try to log everything you do. Some of these can be disabled with the right exemptions.
SilverBirch 4y ago
I said it on the original story, and I'll say it again here: No one is surprised that security at twitter is a shit show. We all know that it's a disaster zone. It's a tech company that somehow managed to add nothing of value for almost a decade. It's 2013, the company just IPO'd, people are suggesting an edit button. It's 2022, twitter is releasing a limited experimental roll out of the edit button for it's 7 paid subscribers. So yeah, no shit it's dysfunctional, and insecure, and bad in a million different ways. The fear with facebook is that these incredibly smart, motivated, amoral monsters are going to figure out how to drip dopamine into our brains to manipulate us into destroying western democrcacy so they can advertise more sneakers. The fear with Twitter is that someone trips over the wrong cable and the entire site goes down and never comes back.
- Finnucane 4y ago
  >The fear with Twitter is that someone trips over the wrong cable and the entire site goes down and never comes back. I'm not sure 'fear' is the right word there.
  - therouwboat 4y ago
    Does anyone even like twitter? :) This article is like someone telling us that a burning trainwreck is actually not very good thing.
  - ggm 4y ago
    Anticipation is high. relief even.
  - Banana699 4y ago
    Yeah GP just casually described a Utopian ideal.
- bakugo 4y ago
  >people are suggesting an edit button And those people should've been ignored. I feel like I'm the only person who actually used twitter back then and still remembers its original purpose. The restrictive character limit and lack of editing were deliberate features. The reason they're adding an edit button now is the same reason they relaxed other deliberate restrictions before: money.
StreamBright 4y ago
> Lack of Leadership: When Twitter’s leadership was confronted with the above problems, they were apathetic, ineffectual, or dishonest. Is this really a surprise after several high profile cases where Twitter leadership proved to be lacklustre every conceivable way?
- rmatt2000 4y ago
  You mean like when your company faces an existential crises, but the CEO can't be reached because he's on a vision quest?
martin_drapeau 4y ago
Dumb question I'm throwing out there. What "sensitive" information do users keep on Twitter beyond their email and phone number? I mean who really cares? Unless I missed something here...
- detaro 4y ago
  Direct messages. Control over accounts - not "information" directly, but also something depending on platform security.
- bri3d 4y ago
  Twitter direct messages are famously not end-to-end encrypted (unlike almost every other provider at this point) and are almost certain to be absolutely loaded with juicy political and criminal intrigue. Furthermore, many Twitter accounts are pseudonymous or anonymous and disclosure of the true identity of the account owner could be scandalous or even physically hazardous. And, assuming the identity of a famous person on Twitter would also be a powerful tool. Many B2C / consumer-oriented companies have this "who cares" attitude and it is very toxic to the industry as a whole when it comes to security.
  - deleted 4y ago
    [deleted]
- dotnet00 4y ago
  There are DMs and private accounts associated with sub-communities. While not sensitive in the traditional sense (ie not credit card info or SSNs) it can still be sensitive for the purposes of the specific users, like business dealings or personal conversations.
- pearjuice 4y ago
  In some countries, being personally identifiable and liking or interacting with tweets which are against the viewpoints of people in power is "sensitive" as it can get you into forced rehabilitation camps. Twitter DMs are considered private and probably contain sensitive information for a lot of people. Including but not limited to journalists, human rights activists or even simple corporate support accounts.
tptacek 4y ago
I like Kollide just fine, but this is a sales piece.
vel0city 4y ago
> Over 30% of the more than 10,000 employee computers were lacking the most basic security settings, such as enabling software updates. Its always funny to me to see people pointing at companies for not installing updates, and yet there's always so many people complaining about how Windows is forcing them to update their computers all the time. Update your darn machines, people!
- deleted 4y ago
  [deleted]
alecdibble 4y ago
The irony is that I had to help a client with a security audit because they wanted to provide Twitter with services that related to employee data. Judging from this article, Twitter would not have passed their own external service provider security audit.
blantonl 4y ago
Given the amount of money involved in this issue between Twitter and Musk, and the general trend by large organizations and governments to hire PR firms to advance narratives in the court of public opinion, I wonder if this "blog post" is just that - part of a hit piece sanctioned by the Musk team? There isn't anything ground breaking security-wise in this article, and the headline is definitely a lot of Trunped up hyperbole. The blog "take" could be about any tech or Fortune 500 company.
- qaq 4y ago
  Hmm as someone in the industry "The blog "take" could be about any tech or Fortune 500 company" is a bit of a stretch.
- threeseed 4y ago
  No this is just old school content marketing trying to take advantage of a trending topic.
- guywithahat 4y ago
  I don't think they posit that they have new information, they just go through the existing whistle blower complaint and highlight why it's such a big deal. Also there's no reason to think this is a hit piece, and there's certainly no evidence for it.
- austenallred 4y ago
  Generally speaking PR firms try to get stuff published in big publications, not on random blogs
  - bawolff 4y ago
    PR firms try to shape the narrative by whatever means possible. Big publications are often better for that, but its not like they are above blog posts.
  - adolph 4y ago
    Once you seo=ed the PR in enough blogs the news just needs a little tip to run the PR as an emerging trend piece. Once you get the trend pub then the PR can get into Wikipedia and becomes disagreement settling science.
unixbane 4y ago
these are all unavoidable issues that all corpos have. also, that "endpoint security" thing is straight up gimmick to make the boss feel like he's in control. unfortunately, with unsound operating systems that not even pros can use in a correct way, there is no chance your company will do better. also this article is annoying because all the good boys that agree with it will do straight up stupid shit like accepting unknown SSH keys instead of verifying them and believing sudo does anything, and whatever hare brained manifestations they came up with, the latest being "dependency confusion"
- dixie_land 4y ago
  yup, "endpoint security" are simply malware that allows "CISO"s to check a box
marricks 4y ago
What I find most wild about this story is Mudge reported this in January which is right when Musk started buying Twitter shares. And now both of those things are coming to a head at the same time.
indymike 4y ago
Mudge's report seemed to show that Argwal was engaged in a pattern of lying and hiding the state of affairs a Twitter. That was more shocking than the security issues by themselves. The result of the lying is that the shareholders got screwed. Musk's offer was $54.20 per share. Twitter was trading at roughly $39 when Musk made the offer, and it is now trading for $38 and some change.
didgetmaster 4y ago
This is why you should never volunteer any information to any company (online or otherwise) that is not absolutely necessary in order to conduct business. Even if you personally trust them not to use your information in nefarious ways, they may not guard it very well from internal or external prying eyes. A few years ago, I was part of a group buying a commercial building. Each partner needed to co-sign for their portion of the loan. The bank wanted to know all the assets and liabilities of every partner. I listed all my liabilities and also listed enough assets to cover the liabilities. When the loan officer asked if that was all my assets, I honestly replied no and that I did not intent to list everything I owned. When I voiced security concerns as the main reason, he assured me that his bank had a secure system that was fool-proof. I just laughed and refused to give him the information he said he needed but obviously didn't. Luckily, they wanted the loan to go through and it did.
legitster 4y ago
Am I missing something? This is a marketing piece for a security software. The entire argument is that: - The corporate spyware wasn't used enough - Engineers had too much access to code - Employees were allowed to install personal software on their computer That's it? Twitter is guilty of running a chill office? Is there any actual vulnerability?
- xkcd-sucks 4y ago
  > The Twitter Whistleblower Should Sound Alarms for Everyone Drums beating for a war on 'Shadow IT' (and for an even more adversarial relationship between IT and Engineering) sounds pretty alarming for sure
- fakethenews2022 4y ago
  There were multiple proven vulnerabilities. https://www.bbc.com/news/technology-53439585 https://www.bbc.com/news/technology-53439585
- rajeshp1986 4y ago
  Mudge probably wanted things to similar to banks: 1) I don't think having a single mono-repo and everyone having access is a major security concern. 2) Employees should only run corporate approved software. considering he only worked there for 8 months, I doubt how much his information is credible.
  - PeterisP 4y ago
    I'm not reading the report as stating that everyone having access to the whole mono-repo is a security concern, but rather that the majority of people had unrestricted access to production systems. It's one thing to be able to read all of the code, it's entirely another thing to be able to deploy arbitrary changes to production without a review.
- pkrumins 4y ago
  This is probably the perfect example of why you don’t hire people who don’t fit your company’s culture.
can16358p 4y ago
> A company with good intentions. A company who isn't doing anything against huge bot/spam problem that can be easily avoided to a great extent as there are obvious patterns in bot/spam behavior isn't a company with good intentions IMHO.
awill88 4y ago
$20 says Musk paid him, half serious. But who knows..

218 points by nickwritesit 4y ago

Seems like the real point here is that it's not worse about Twitter, but about industry security in general. Which was my impression when I skimmed the initial whistleblower complaint. It clearly wasn't great, and "Twitter’s leadership was [...] apathetic, ineffectual, or dishonest" certainly resonated with my short stint there. But I've heard worse stories from bigger, more important places than Twitter.

gopher_space 4y ago
> I've heard worse stories from bigger, more important places than Twitter I think everyone with experience has, which makes me wonder who the target audience is here.
- sangnoir 4y ago
  Mudge knows this too, as much as anyone. Which makes the question even more pertinent.
- ForHackernews 4y ago
  Very obviously Elon Musk who has 44 billion reasons to be eternally grateful to any Twitterati who can help him reneg on his impulse purchase.
kibwen 4y ago
What's the inverse? Which companies actually have good internal security practices?
- wpietri 4y ago
  Great question! And for me there are two kinds of good in partial conflict here: good for security, and good for getting things done. Having done contracts for places where I needed multiple levels of approval to install anything on my developer machine, both are important to me.
- foobarian 4y ago
  It’s not like twitter has sensitive personal or financial information to lose. I’m sure companies that store SSNs or financial records do a much better job /s
  - threeseed 4y ago
    > I’m sure companies that store SSNs or financial records do a much better job Generally they do. Because during an exposure incident they often have to deal with regulators who punish them much more than the market will.
    - ForHackernews 4y ago
      Name one time that has ever happened. Experian leaked basically every American's SSN and credit history, and they got off with a $22m settlement.
- threeseed 4y ago
  Banks have excellent security. But often the restrictions are so onerous that productivity suffers. One of the banks I recently worked at flipped the model from heavily restricting what users and systems can do to allowing them to do anything (including admin access for developers) and aggressively monitoring them. In comparison my current bank needed 4 weeks and manager approvals to get a mouse driver installed.
  - ethbr0 4y ago
    From the article "Nevertheless, the presence of Shadow IT in an organization speaks to some larger problems: (1) Lack of effective communication from security and IT teams about security risks (2) Employees who feel they aren’t given the tools they need and with no clear way to ask for them (3) No visibility into endpoints to reveal the presence of unapproved tools" I have yet to work for a company that has IT security and IT management in the same org. Which is insane. Why are companies empowering someone to say "No" (CISO), without requiring that same individual to justify not saying "Yes"? If a user requests a tool, IT sec/management should be leaning in and asking "What can we provide you will that will satisfy this need?" Instead, and I assume my experience generalizes to everyone who's worked in regulated tech, the response is "No, that's not approved" and ends the conversation.
    - DiggyJohnson 4y ago
      My thoughts exactly. I noticed a pattern in my personal behavior of “can I install an unapproved developer tool early in the onboarding process”. Even on enterprise machines in IT departments of firms you’ve certainly heard of, I’ve found that I can get away with my portable install / side loaded browser plug-in every single time. This is just my rambling thoughts, not sure if I have a main point, but realizing this pattern has certainly contributed to my personal sense of disillusionment.
    - PeterisP 4y ago
      For the same reason why companies don't have their internal audit in the same org as their accountants and their financial controllers under business unit managers, inherent conflict of interest. The job that the security org is doing for the board/owners/etc is controlling risk because they don't trust if their IT org says "everything is totally fine", and consider it likely that if the decision about whether to implement some activity or not is left purely to the IT org, then the convenience of implementation will override the level of risk control that the board/owners desire, so they choose to put these controls in a separate organization, empowering someone to say "Not until you do all this unwelcome work to implement it to the standards the company has chosen", preventing all the many mid-managers to save their effort or their costs by cutting corners at the expense of risks to "someone else's" money. Of course, having these functions together is much more efficient in many ways! But the principal-agent problem is very real, especially so in large organizations, so that's why these choices get made this way, designing organizational structures that act as checks and balances on each other, not expecting everyone to magically cooperate for the greater good.
- Veserv 4y ago
  Depends on how you define good. If by good you mean: the company would have no problems putting in their advertising the number the CISO knows about how much it would cost to completely invalidate their security and their customers and investors would be happy, or at least non-livid, if they were told; then none in the Fortune 500. If by good you mean: somewhere where that number is more than $1M, the smallest unit that appears on their 10-Ks which usually use millions as their smallest unit, then probably none in the Fortune 500. If you raise it to $10M, then without a doubt there are none. If by good you mean: "better" than other companies, but still trapped in a valley with the horde of hungry bears faster than them, then who cares, the bears are still going to eat them soon.
- fakethenews2022 4y ago
  I worked for a company that had ALL those practices in place PLUS required annual security training PLUS they ran simulated phishing attacks to see if people would report incidents.
nradov 4y ago
IT security in the healthcare and financial sectors is now generally pretty good. After a few high profile incidents, everyone is scared and systems are a lot more locked down on average. Although you can still find problems on occasion, mostly in smaller organizations. But why should we even worry about security on social media sites? I really have zero sympathy for people who upload private data to those companies and then complain when it gets hacked. What the hell did they expect? Twitter was never under any legal or contractual requirement to provide good security for user data.
- worik 4y ago
  > IT security in the healthcare and financial sectors is now generally pretty good Generally? I cannot say. This was around the corner from me, and is an anecdote. https://en.wikipedia.org/wiki/Waikato_District_Health_Board_ransomware_attack https://en.wikipedia.org/wiki/Waikato_District_Health_Board_... IN the news at the time the cause was "somebody clicked on a link they shouldn't have" In reality the cause was comprehensive failure of computer professionals (like us) to do their job, and an unbelievable lack of accountability Compare with this: https://en.wikipedia.org/wiki/CTV_Building https://en.wikipedia.org/wiki/CTV_Building We have nothing like the accountability that civil engineers face. This will hopefully not last so we get a chance to do our jobs properly
- bawolff 4y ago
  > Twitter was never under any legal...to provide good security for user data. "Good" is ambigious,but there are privacy laws that do apply to twitter (especially but not exclusively in the eu)
- dotnet00 4y ago
  They shouldn't have to be legally obligated to make them have decent security as a simple business practicality. Private data can be something as simple as DMs between people, which if leaked can cause plenty of trouble (an example that comes to mind is streamers having to deal with a lot of drama from their fanbase because leaks revealed they were acquainted with a streamer of the opposite gender). On top of that with so many government officials and company CEOs on the platform it should be pretty obvious why access to the backend should be carefully controlled. There already was that incident a few years ago where someone got access to the backend via social engineering and tweeted out crypto scams from high profile accounts like Musk, Biden, Bezos, Apple etc.

miduil 4y ago

This "whistleblower" made me finally close one of my private accounts, turns out the official data export is much more complete nowadays - including private messages and an easy to use static HTML page. I'm surprised that such a "zero trust" system isn't established at Twitter yet, considering the size they were operating in.

Overtonwindow 4y ago

What does this mean for the sale of Twitter? I still can't quite figure that out. Does Musk really want it at a lower price, or is he truly walking away from the deal? If he walks away from the deal what happens then? Someone else buys it? I guess the real question is: Can twitter be saved?

dangets 4y ago
It is questionable whether he _can_ walk away from the deal. He signed all of the contracts and made legally binding promises to lenders with no clauses around misleading amount of spam bots or security issues. Of course, laws are more bendable when you're that rich and stand to lose billions. If you're really interested in this stuff, it has been an ongoing centerpiece in Matt Levine's newsletter. Articles are free if you subscribe to the email, but reading prior pieces may require a subscription. e.g. https://news.bloomberglaw.com/securities-law/matt-levines-money-stuff-musk-cancels-twitter-deal-some-more https://news.bloomberglaw.com/securities-law/matt-levines-mo...
wpietri 4y ago
I suspect it doesn't mean much for the sale. From what I understand, it's mainly down to the agreements signed with Twitter and what the Delaware courts make of them in the trial starting October 17th. Those agreements are very Twitter-friendly, so my personal guess is that Musk is going to lose. As to what he wants, Musk is mercurial enough that I'm not sure that's a meaningful question. Did he want Twitter for a little while? Yes. Did that ever make sense given his other responsibilities? No. Did it make sense to investors? Based on Tesla's stock price slide, definitely not. Is he having buyer's remorse? Clearly. If he got a really good deal on it, might he swing back? Who knows. Is Twitter so badly run that they might do better in somebody else's hands? Yes. Is that person Musk? I doubt it. So if I were betting on Musk being smart, I'd be that Twitter will charge him a few billion dollars to get out of the deal, which would be better for everybody than Musk taking a $14 billion loss the instant the deal closes (which is is $44 billion bid minus the $30 billion that is Twitter's current market cap). But Musk could well be more prideful than smart, so I'm excited to see how all this turns out.

29athrowaway 4y ago

Mudge is for real. https://www.youtube.com/watch?v=VVJldn_MmMY https://www.youtube.com/watch?v=VVJldn_MmMY

bumbledraven 4y ago
Epic video. Broadcast live on CSPAN in 1998. Transcript: https://nsarchive.gwu.edu/sites/default/files/documents/5680645/Document-01-Senate-Committee-on-Governmental.pdf https://nsarchive.gwu.edu/sites/default/files/documents/5680... Fred Thompson (R, TN), Chairman, Committee on Governmental Affairs: …If you gentlemen would come forward… We’re joined today by the seven members of the L0pht, Hacker think Tank in Cambridge Massachusetts. Due to the sensitivity of the work done at the L0pht, they’ll be using their hacker names of Mudge, Weld, Brian Oblivion, Kingpin, Space Rogue, Tan, and Stefan. … Sen. Thompson: I am informed that, you think that within 30 minutes the seven of you could make the internet unusable for the entire nation, is that correct? Mudge: That’s correct. Actually one of us with just a few packets.
- 29athrowaway 4y ago
  Likely they referred to creating a routing black hole in BGP networks. Announcing you have the fastest route to other nodes, and then not routing the traffic you receive.

purpleblue 4y ago

Very clickbait-y title but a good article. I read through the actual whistleblower complaint and to be honest I was shocked as well. If true, the security on their laptops was extremely lax or nonexistent. My current and previous companies will not let me install what I want on my laptop. Even something as innocuous as Signal is not allowed and I'm too scared to push the issue. I basically assume that everything I do is being watched and keylogged which actually makes life a lot easier for me. The idea that Twitter would allow anything to be installed is kind of shocking to be honest. It sounds like they're not taking their place of prestige in the Internet hierarchy very seriously. The fact that Mudge couldn't lock things down after Jan 6 or that there wasn't adequate logging etc is also extremely shocking. I would love to hear Twitter's side of it and the reason why it wasn't a priority. Was it because Jack Dorsey had taken his eye off the ball and was a missing leader that lead to this? Or was it Parag Agrawal's poor leadership as CTO and CEO? It certainly sounds like he was an obstacle in the way of Mudge, which doesn't sit well with me at all.

awsthrowaway445 4y ago
> The idea that Twitter would allow anything to be installed is kind of shocking to be honest. For what it’s worth, AWS has the same somewhat lax policies about installing software on company laptops. That’s not a diss to AWS security mind you, I’m sure it’s top of the line.
- nindalf 4y ago
  Meta security also allows any software to be installed. But they also keep a track of laptop state through the osquery daemon that's always running. GP was talking like this alone was gross negligence, implying that this is different from the rest of the industry. That doesn't seem to be the case.
  - rogerkirkness 4y ago
    We do this as a 60 person company.
  - 4y ago

neverrroot 4y ago

SketchySeaBeast 4y ago
> The amount of censorship and methods involved is unlike any other platform. That seems a funny claim. Would we be at all surprised to find out that facebook sucks in the same ways?
- neverrroot 4y ago
  +1 for bringing up FB as a comparison. They also do it, but in my experience not as much as Twitter. Been monitoring both Twitter and FB and Twitter is just incredible biased towards left.
  - wpietri 4y ago
    What's your data here? And what does "biased towards left" even mean? In one sense, it's trivial to prove, in that Twitter bans a lot of hate and abuse, and these days targeted hate is a popular tool of the right across the globe. (See, e.g., anti-gay and anti-trans panics going on all over. Or specific ethnic hate depending on region.) So if cracking down on that is being biased toward the left, then yes, Twitter definitely is. But presumably you're saying something else?
    - plushpuffin 4y ago
      As you noted, the greater prevalence of right-wing violence, hate speech, and disinformation/misinformation causes the appearance of a moderation bias against conservatives. However, there has been an actual measured bias in favor of conservative voices (circa late 2021, the home timeline algorithm may have changed since then). In other words, conservatives do more stuff to run afoul of the terms of service, and they also receive better treatment. GP is wrong/misinformed. https://www.techdirt.com/2022/04/18/fascinating-new-study-suggests-again-that-twitter-moderation-is-biased-against-misinformation-not-conservatives/ https://www.techdirt.com/2022/04/18/fascinating-new-study-su... https://www.theguardian.com/technology/2021/oct/22/twitter-admits-bias-in-algorithm-for-rightwing-politicians-and-news-outlets https://www.theguardian.com/technology/2021/oct/22/twitter-a...

bmismyname 4y ago

You can tell Twitter (and the other techies) don't care about "security" when they force you to use SMS for 2FA when we all know they're doing that to harvest phone numbers because they're a pretty o.k. way to link identities.

deleted 4y ago
[deleted]
zimpenfish 4y ago
> they force you to use SMS for 2FA It's not exclusive, though; you can switch to an authenticator like Authy or even a hardware device like Yubikey.
- bmismyname 4y ago
  I think the scheme they used was to require a phone number to set it up the first time, and after that you could switch to TOTP or whatever. Authy also harvests phone numbers.

howmayiannoyyou 4y ago

Solution: Statutory damages for companies who release software with grossly negligent or malicious disregard for best security practices. This form of civil liability has given us safer cars, home products, machinery, and professional services. Its most often preemptively enforced, not by our court system, but by insurance carriers who insure against the liability.

avg_dev 4y ago
I believe this is a good idea. I don't know a whole lot about law-making, but I know that a lot of ransomware cases could have been prevented by enforcing updates to various packages and operating systems. Please note that I am not claiming that updates are a silver bullet. I am sure if someone managed to obtain credentials that allowed them to release an update for MS Windows, say, and that update installed a keylogger, it would be bad news. But regular updates at the source code dependency, OS, firmware, networking hardware, device layers, mandatory code review, hardware FIDO/U2F tokens, training on best practices for handling data and for writing and reviewing secure code, use of modern encryption algorithms, encryption of sensitive data at rest, requirements to not store PII without a proven need, requirements to change default passwords (or even better yet - laws mandating non-default passwords at ship time), ongoing anti-phishing training, and the like will all help us stay safer. There are bad actors out there. We all make mistakes. Our industry is maturing at an altogether unacceptably slow rate, IMO - a lot of these techniques are well known in the industry, but they cost money and time to implement, and nobody seems to want to expend that effort until it's too damn late. I am not a security expert. Just a developer who tries my best to pay attention.
pattisapu 4y ago
Makes sense. Reallocate the cost to the cheapest cost avoider.
- howmayiannoyyou 4y ago
  No. When there is a claim the insurance company will look for every reason not to cover and stick the insured with the defense and judgement bills. If the insured fails to meet the carrier's requirements they are screwed.

jmyeet 4y ago

Here's something you should know about whistleblowers in the US. If a whistleblower makes disclosures to the SEC that result in a judgement if the SEC successfully sues the subject of that disclosure. This can be worth tens of millions of dollars. That doesn't mean their claims are false. But you should always be skeptical. The second issue is the trial resulting from Elon Musk walking away from the Twitter acquisition. That acquisition agreement calls for "specific performance", which means Elon pretty much agreed to buy the company no matter what (he waived due diligence). He is expected to have to pay a fortune if not actually buy the company in his trial next month. So it's at least worth noting that this disclosure happens right at a time when it might help Elon. Maybe unrelated but it's also a hell of a coincidence. Employees that are fired (or are heading in that direction) can make all sorts of claims to deflect away from the fact that they were or soon would be fired, possibly with cause, possibly not. The specific claims seem to be a little vauge like not giving employees tools to combat bots. Like what does that even mean? Twitter may have crappy infra for this but does it rise to the level of negligence or even malfeasance? That's not a slam dunk from what I've seen. Keep an open mind but remain skeptical.

dogecoinbase 4y ago
Additionally, incentives exist for him to report things he himself did while at Twitter, for example: https://twitter.com/igb/status/1562072030010191880 https://twitter.com/igb/status/1562072030010191880 > [Mudge and Sethi] deprioritized Twitter's kernel & OS upgrade and encryption at rest initiatives. (from Ian Brown, who deserves his good reputation as much as anyone I've met)
skrtskrt 4y ago
there's rewards for whistleblowers because often doing so will destroy your career and result in massive legal bills from much more powerful entities suing you. Mudge was already an officer of the company, he had much more guaranteed money to gain from just shutting up and staying there.
- pclmulqdq 4y ago
  That's a very short-sighted view of a career. In the short term, it is bad for your career, but being a whistleblower who is right can raise your profile significantly and make you much wealthier than if you stay at a company quietly (even if your salary is $X million). In Mudge's case, he didn't need the money, but the publicity probably helped. Think about some of the past whistleblowers from these companies: Frances Haugen, Timnit Gebru, etc. These are all people for whom whistleblowing was a good career move.

1vuio0pswjnm7 4y ago

The best "security" is not to give data to "tech" companies. It is never too late to stop doing something stupid. It is unfortunate that governments will not help citizens in this regard by adequately regulating collection of data by "tech" companies. Laws limit data collection by governments from their citizens, for good reason. Meanwhile "tech" companies are under no such restrictions, which is beyond reason.

tqi 4y ago
> It is never too late to stop doing something stupid This attitude, combined with a pathological inability to state what the practical harms/risks are, is why "privacy advocates" never get anywhere.
1vuio0pswjnm7 4y ago
What are the practical harms/risks of not sending data to "tech" companies. There are none.

fakethenews2022 4y ago

I wonder when the security practices mudge pushed for got put into place at various companies? The company I worked for put those into place between 5-7 years ago: limiting who had access to production, logging access, MDM, security scans on computers, security training, etc... Was twitter behind the curve?

durpkingOP 4y ago

This seems like a rehashed article and "worse than you think" doesn't apply.

mupuff1234 4y ago

So why isn't Twitter hacked every other day? I'm sure there's security issues at Twitter, but I don't see a reason to believe it's so much worse than other companies.

avg_dev 4y ago
From the article I found this link: https://firewalltimes.com/twitter-data-breach-timeline/ https://firewalltimes.com/twitter-data-breach-timeline/ I would argue that it really doesn't matter if Twitter is worse than most other companies, the problem is that none of these companies should be operating with such poor (non-existent) standards. Especially when they have as much data as Twitter. I personally "protect" my tweets so that others, like my employer, cannot see them. There are many more people with so much more sensitive information that are trusting in this system.
- enos_feedler 4y ago
  Quantity of data is not quality of data.
  - avg_dev 4y ago
    https://www.theguardian.com/business/2013/apr/23/ap-tweet-hack-wall-street-freefall https://www.theguardian.com/business/2013/apr/23/ap-tweet-ha...

gwittel 4y ago

In reading Mudges' complaint, it really paints the Twitter leadership (esp. Agrawal) as simply not caring about security enough to do anything about it. Instead you had an org with massive amounts of technical and operational debt, and leadership not willing to invest in it. There are always tradeoffs between fixing technical debt and building new features. Twitter leadership chose to ignore (and to some extent, hide) the problem rather than invest. They certainly aren't unique in having a security plan that is built around hope. Engineers having full control over their dev machines up to and including preventing system updates is not ideal; but not out of the norm for tech. Poor data access controls, and out of date server fleets (where I'd expect updates to be pretty automated) are far more worrying to me.

googlryas 4y ago
I wonder if Mudge was fired for, basically, being too good at his job. He didn't toe the CEO's line, and was pointing out how the house was on fire, which is not what Agrawal wanted to hear(maybe Dorsey wanted to hear it when he hired Mudge, but Agrawal had different ideas). I suspect that most people who make it ultra high level as "Head of X", are hired more for their organizational/social talents, which oftentimes involves capitulating to those more powerful/higher on the food chain, rather than being actually talented at X. Mudge actually has the bona fides for the role, which is why he got fired (I'm guessing).
- ImPostingOnHN 4y ago
  It's worth noting that being good at IT Security is in huge part a function of your soft skills, since you should be able to sell security to the org, since your job is to make the work happen, not to identify it and complain that it needs to be done any amateur can run some automated scanners and issue security diktats to the rest of the organization
  - googlryas 4y ago
    I mean...Twitter hired him as head of security. They ostensibly already cared about security. Or, at least Dorsey did, maybe Agrawal didn't. I suspect he wanted a yes man to offer some minor changes and say "Yup, everything's secure here". Before this, Mudge was facilitating the NSC in ultra high level briefings to provide accurate reports to POTUS. I suspect you don't end up in that position without some strong soft skills. But, as strong as they are, you can't convince someone who doesn't want convincing.

CSDude 4y ago

> But putting that aside, employees installing “whatever software they want” is already a significant eyebrow-raiser. How do you ensure you are not a gatekeeper but also keeping company secure? Vetting software installations would be killer for any productivity at that scale I guess. Does it include npm install too which can run scripts or just desktop apps, chrome extensions?

ryandrake 4y ago
I agree with this. Allowing people to install software is not necessarily a security risk, but it can be if your company's overall security is vulnerable to hostile software on employee computers. In software development, you need to install software in order to do your job. I've worked at two "big tech" companies, and both of them had a policy of allowing employees (at least in engineering) to have root on their devices and install what they need to do their work. 1. We're intelligent adults and trusted to not fuck everything up, and 2. Internal systems are properly secured against fuck-ups, so a rogue compromised laptop on an internal network should not be able to screw anything up anyway. Then again, I've worked at smaller companies that thought their perimeter firewall and VPN for employees was adequate security. Once one got onto the internal network, there was no defense in depth. A compromised laptop (not to mention a disgruntled insider) that managed to get onto the internal network could literally wipe everything out.

soheil 4y ago

> And most importantly, the software on these endpoint computers was reporting dire problems. Over 30% of the more than 10,000 employee computers were lacking the most basic security settings, such as enabling software updates. Who are these people writing articles like this? Not enable [automatic?] software updates is equivalent to dire problems?

groby_b 4y ago
Presumably, they are people with at least a modicum of understanding of security. Enabling auto-updates (or, better, controlled pushes of updates via your IT folks) is absolute bare-bones minimum-you-can-do security. Otherwise, those laptops are all collections of well-known security holes.

closeparen 4y ago

>and all engineers had some form of critical access to the production environment Not to excuse the lack of monitoring or fine-grained control, but most engineers having some kind of prod access is what happens at companies where you are oncall for your own services / dev and ops are not separate roles.

ssklash 4y ago

> “…according to expert quantification and analysis in January 2022, over half of Twitter’s 8,000-person staff was authorized to access the live production environment and sensitive user data. Twitter lacked the ability to know who accessed systems or data or what they did with it in much of their environment.” Half of any company having access to prod is insane, but half of a giant like Twitter is unimaginable to me. It really explains how compromising single employees seems so effective there.

rmatt2000 4y ago
In the political Twitter neighborhoods that I inhabit, there have been many cases over the years of people having their accounts yanked, with the only message being "You have been banned for violating the Twitter rules. This decision is final and cannot be appealed." When these bannings get publicized, however, the bad publicity often leads to the "permanent ban" being reversed, with Twitter simply explaining that the original ban "was a mistake". How does this sort of thing happen so often, unless random employees have access to powerful tools that they are not authorized or trained to use?
- SilverBirch 4y ago
  Here's the obvious counter - social media companies are by nature trying to chase super-linear cost:return ratios. So they can't actualy accept that N users mean N/x moderators. So instead, you hire Y moderators, and any time anyone points out you've shit the bed you wave your hands in the air and whisper "AI" when really what's happening is Y < N/x so you have a shit moderation team.
  - rmatt2000 4y ago
    If there aren't enough moderators, wouldn't the likely result be fewer rule-breaking accounts banned rather than more non-rule-breaking accounts banned? Maybe, instead of hiring N skilled moderators for $D, they could be hiring N * \delta unskilled moderators for the same price.

enos_feedler 4y ago

But it’s not horrifying either. Twitter transacts mostly junk messages. Any serious journalist I’ve seen on twitter says to DM on signal.

toss1 4y ago

>>Twitter employees were repeatedly found to be intentionally installing spyware on their work computers at the request of external organizations.” That right there is a forking nuclear showstopper . . . and nevermind the moire broad >>employees could install “whatever software they want” Effectively, twitter has zero security. For journalists, or anyone working in an environment that has kinetic consequences (opposition to authoritarian regimes, etc.), it is right up there in the frightening scale...

sudden_dystopia 4y ago

Has the author not see. The collective shrug from society when it comes to security? Why are they surprised? People still flock to Facebook and google in droves. And now Tik tok. Clearly people do not give any f’s about privacy and security.

pvarangot 4y ago
People shift there because the content creators they like are there. A huge portion of the Facebook and Twitter user base is into news and they can shrug about security but if the journalists don't then they won't get their fix.
turtleman1338 4y ago
There is a big difference between privacy and security.

whoisstan 4y ago

How does google handle all those mentioned problems? Would be great to contrast that to twitter, especially how easy it is to read Twitter DMs vs gmail messages.

saagarjha 4y ago
The main difference I’ve observed is that Google uses BeyondCorp rather than a VPN and Santa runs in the background, plus a bunch of scripts that try to log everything you do. Some of these can be disabled with the right exemptions.

SilverBirch 4y ago

I said it on the original story, and I'll say it again here: No one is surprised that security at twitter is a shit show. We all know that it's a disaster zone. It's a tech company that somehow managed to add nothing of value for almost a decade. It's 2013, the company just IPO'd, people are suggesting an edit button. It's 2022, twitter is releasing a limited experimental roll out of the edit button for it's 7 paid subscribers. So yeah, no shit it's dysfunctional, and insecure, and bad in a million different ways. The fear with facebook is that these incredibly smart, motivated, amoral monsters are going to figure out how to drip dopamine into our brains to manipulate us into destroying western democrcacy so they can advertise more sneakers. The fear with Twitter is that someone trips over the wrong cable and the entire site goes down and never comes back.

Finnucane 4y ago
>The fear with Twitter is that someone trips over the wrong cable and the entire site goes down and never comes back. I'm not sure 'fear' is the right word there.
- therouwboat 4y ago
  Does anyone even like twitter? :) This article is like someone telling us that a burning trainwreck is actually not very good thing.
- ggm 4y ago
  Anticipation is high. relief even.
- Banana699 4y ago
  Yeah GP just casually described a Utopian ideal.
bakugo 4y ago
>people are suggesting an edit button And those people should've been ignored. I feel like I'm the only person who actually used twitter back then and still remembers its original purpose. The restrictive character limit and lack of editing were deliberate features. The reason they're adding an edit button now is the same reason they relaxed other deliberate restrictions before: money.

StreamBright 4y ago

> Lack of Leadership: When Twitter’s leadership was confronted with the above problems, they were apathetic, ineffectual, or dishonest. Is this really a surprise after several high profile cases where Twitter leadership proved to be lacklustre every conceivable way?

rmatt2000 4y ago
You mean like when your company faces an existential crises, but the CEO can't be reached because he's on a vision quest?

martin_drapeau 4y ago

Dumb question I'm throwing out there. What "sensitive" information do users keep on Twitter beyond their email and phone number? I mean who really cares? Unless I missed something here...

detaro 4y ago
Direct messages. Control over accounts - not "information" directly, but also something depending on platform security.
bri3d 4y ago
Twitter direct messages are famously not end-to-end encrypted (unlike almost every other provider at this point) and are almost certain to be absolutely loaded with juicy political and criminal intrigue. Furthermore, many Twitter accounts are pseudonymous or anonymous and disclosure of the true identity of the account owner could be scandalous or even physically hazardous. And, assuming the identity of a famous person on Twitter would also be a powerful tool. Many B2C / consumer-oriented companies have this "who cares" attitude and it is very toxic to the industry as a whole when it comes to security.
- deleted 4y ago
  [deleted]
dotnet00 4y ago
There are DMs and private accounts associated with sub-communities. While not sensitive in the traditional sense (ie not credit card info or SSNs) it can still be sensitive for the purposes of the specific users, like business dealings or personal conversations.
pearjuice 4y ago
In some countries, being personally identifiable and liking or interacting with tweets which are against the viewpoints of people in power is "sensitive" as it can get you into forced rehabilitation camps. Twitter DMs are considered private and probably contain sensitive information for a lot of people. Including but not limited to journalists, human rights activists or even simple corporate support accounts.

tptacek 4y ago

I like Kollide just fine, but this is a sales piece.

vel0city 4y ago

> Over 30% of the more than 10,000 employee computers were lacking the most basic security settings, such as enabling software updates. Its always funny to me to see people pointing at companies for not installing updates, and yet there's always so many people complaining about how Windows is forcing them to update their computers all the time. Update your darn machines, people!

deleted 4y ago
[deleted]

alecdibble 4y ago

The irony is that I had to help a client with a security audit because they wanted to provide Twitter with services that related to employee data. Judging from this article, Twitter would not have passed their own external service provider security audit.

blantonl 4y ago

Given the amount of money involved in this issue between Twitter and Musk, and the general trend by large organizations and governments to hire PR firms to advance narratives in the court of public opinion, I wonder if this "blog post" is just that - part of a hit piece sanctioned by the Musk team? There isn't anything ground breaking security-wise in this article, and the headline is definitely a lot of Trunped up hyperbole. The blog "take" could be about any tech or Fortune 500 company.

qaq 4y ago
Hmm as someone in the industry "The blog "take" could be about any tech or Fortune 500 company" is a bit of a stretch.
threeseed 4y ago
No this is just old school content marketing trying to take advantage of a trending topic.
guywithahat 4y ago
I don't think they posit that they have new information, they just go through the existing whistle blower complaint and highlight why it's such a big deal. Also there's no reason to think this is a hit piece, and there's certainly no evidence for it.
austenallred 4y ago
Generally speaking PR firms try to get stuff published in big publications, not on random blogs
- bawolff 4y ago
  PR firms try to shape the narrative by whatever means possible. Big publications are often better for that, but its not like they are above blog posts.
- adolph 4y ago
  Once you seo=ed the PR in enough blogs the news just needs a little tip to run the PR as an emerging trend piece. Once you get the trend pub then the PR can get into Wikipedia and becomes disagreement settling science.

unixbane 4y ago

these are all unavoidable issues that all corpos have. also, that "endpoint security" thing is straight up gimmick to make the boss feel like he's in control. unfortunately, with unsound operating systems that not even pros can use in a correct way, there is no chance your company will do better. also this article is annoying because all the good boys that agree with it will do straight up stupid shit like accepting unknown SSH keys instead of verifying them and believing sudo does anything, and whatever hare brained manifestations they came up with, the latest being "dependency confusion"

dixie_land 4y ago
yup, "endpoint security" are simply malware that allows "CISO"s to check a box

marricks 4y ago

What I find most wild about this story is Mudge reported this in January which is right when Musk started buying Twitter shares. And now both of those things are coming to a head at the same time.

indymike 4y ago

Mudge's report seemed to show that Argwal was engaged in a pattern of lying and hiding the state of affairs a Twitter. That was more shocking than the security issues by themselves. The result of the lying is that the shareholders got screwed. Musk's offer was $54.20 per share. Twitter was trading at roughly $39 when Musk made the offer, and it is now trading for $38 and some change.

didgetmaster 4y ago

This is why you should never volunteer any information to any company (online or otherwise) that is not absolutely necessary in order to conduct business. Even if you personally trust them not to use your information in nefarious ways, they may not guard it very well from internal or external prying eyes. A few years ago, I was part of a group buying a commercial building. Each partner needed to co-sign for their portion of the loan. The bank wanted to know all the assets and liabilities of every partner. I listed all my liabilities and also listed enough assets to cover the liabilities. When the loan officer asked if that was all my assets, I honestly replied no and that I did not intent to list everything I owned. When I voiced security concerns as the main reason, he assured me that his bank had a secure system that was fool-proof. I just laughed and refused to give him the information he said he needed but obviously didn't. Luckily, they wanted the loan to go through and it did.

legitster 4y ago

Am I missing something? This is a marketing piece for a security software. The entire argument is that: - The corporate spyware wasn't used enough - Engineers had too much access to code - Employees were allowed to install personal software on their computer That's it? Twitter is guilty of running a chill office? Is there any actual vulnerability?

xkcd-sucks 4y ago
> The Twitter Whistleblower Should Sound Alarms for Everyone Drums beating for a war on 'Shadow IT' (and for an even more adversarial relationship between IT and Engineering) sounds pretty alarming for sure
fakethenews2022 4y ago
There were multiple proven vulnerabilities. https://www.bbc.com/news/technology-53439585 https://www.bbc.com/news/technology-53439585
rajeshp1986 4y ago
Mudge probably wanted things to similar to banks: 1) I don't think having a single mono-repo and everyone having access is a major security concern. 2) Employees should only run corporate approved software. considering he only worked there for 8 months, I doubt how much his information is credible.
- PeterisP 4y ago
  I'm not reading the report as stating that everyone having access to the whole mono-repo is a security concern, but rather that the majority of people had unrestricted access to production systems. It's one thing to be able to read all of the code, it's entirely another thing to be able to deploy arbitrary changes to production without a review.
pkrumins 4y ago
This is probably the perfect example of why you don’t hire people who don’t fit your company’s culture.

can16358p 4y ago

> A company with good intentions. A company who isn't doing anything against huge bot/spam problem that can be easily avoided to a great extent as there are obvious patterns in bot/spam behavior isn't a company with good intentions IMHO.

awill88 4y ago

$20 says Musk paid him, half serious. But who knows..