6 ms·

Very clickbait-y title but a good article. I read through the actual whistleblower complaint and to be honest I was shocked as well. If true, the security on t

Very clickbait-y title but a good article. I read through the actual whistleblower complaint and to be honest I was shocked as well. If true, the security on their laptops was extremely lax or nonexistent. My current and previous companies will not let me install what I want on my laptop. Even something as innocuous as Signal is not allowed and I'm too scared to push the issue. I basically assume that everything I do is being watched and keylogged which actually makes life a lot easier for me. The idea that Twitter would allow anything to be installed is kind of shocking to be honest. It sounds like they're not taking their place of prestige in the Internet hierarchy very seriously. The fact that Mudge couldn't lock things down after Jan 6 or that there wasn't adequate logging etc is also extremely shocking. I would love to hear Twitter's side of it and the reason why it wasn't a priority. Was it because Jack Dorsey had taken his eye off the ball and was a missing leader that lead to this? Or was it Parag Agrawal's poor leadership as CTO and CEO? It certainly sounds like he was an obstacle in the way of Mudge, which doesn't sit well with me at all.

awsthrowaway445 4y ago
> The idea that Twitter would allow anything to be installed is kind of shocking to be honest. For what it’s worth, AWS has the same somewhat lax policies about installing software on company laptops. That’s not a diss to AWS security mind you, I’m sure it’s top of the line.
- nindalf 4y ago
  Meta security also allows any software to be installed. But they also keep a track of laptop state through the osquery daemon that's always running. GP was talking like this alone was gross negligence, implying that this is different from the rest of the industry. That doesn't seem to be the case.
  - rogerkirkness 4y ago
    We do this as a 60 person company.
  - devnulll 4y ago
    MSFT also allows arbitrary installation of software and development systems. They do force updates, scanning, and other common security best practices. On the machines people use for Livesite support ("Secure Access Workstations") it's a different story. Those bad-boys are locked down from the supply chain through day-to-day use.
- colechristensen 4y ago
  >That’s not a diss to AWS security mind you, I’m sure it’s top of the line. Top of the line security looks like door locks with daily changing codes and number pads with lcds on them that scramble the order of the digits. It looks like regular searches of your effects as you leave the building, badged and guarded entrances that operate like airlocks, security that roams the building and leaves your manager a nasty note if the wrong documents are left in the open on your desk along with a computer and network that actually won’t let you install software. This was my first job and it felt normal.
  - mardifoufs 4y ago
    Defense industry?
    - colechristensen 4y ago
      Indeed
  - bawolff 4y ago
    There is a place for that level of security, but twitter is not it. Good risk management means knowing when to accept a risk. Twitter was too lax, but the opposite millitary approach would also be the wrong choice for something like twitter.
    - colechristensen 4y ago
      Oh, absolutely, know your threat model. But top of the line security anywhere is not "meh, install whatever you want on the company laptop". And any company handing private communication and responsible for making social network decisions does need fairly good security to protect against compromised employees and compromised company hardware. That looks like solid policies for installing software, centralized management of hardware, and written policies that are well thought out, audited, and followed. Finance, medicine, defense, ecommerce, etc. all have industry or government regulations for these kinds of security polices and compliance, it seems like social media companies are the wild west and clear signs of problems and abuse have come up repeatedly. No, they probably don't need to go through your bags with random checks to see if you're exfiltrating classified materials or warn you about wearing your company badge visibly when you go out to lunch to avoid spies.
- worik 4y ago
  > That’s not a diss to AWS security mind you, I’m sure it’s top of the line. You are sure. Whew! Terrified am I
dwighttk 4y ago
>The fact that Mudge couldn't lock things down after Jan 6 or that there wasn't adequate logging etc is also extremely shocking. Remember when Twitter got real big because of the Arab Spring? Free Speech is good? How is “Twitter” supposed to know what to “lock down” and what to allow for good?
- aliqot 4y ago
  Ban the things your datacenter's country of operation says are illegal, and ignore the rest
- tylermenezes 4y ago
  This is referring to locking down employee access to modify data in production
mgfist 4y ago
I've only had 1 employer (a DB company) so I can't speak to industry norms, but I've never had restrictions on things I could do or download on my computer. Hard for me to imagine working at a place where I need permission to download a tool or library when writing software. Seems like a huge burden.
- 0000011111 4y ago
  It depends on the industry. However, in a good world you would have an internal repo with all the software users need to do their job and users would just download from that.
- slongfield 4y ago
  Libraries have licensing requirements that your company needs to comply with. Being able to download and use them without any oversight is an recipe for violating them.
  - MAGZine 4y ago
    or... read the license and make sure you can comply with it. And if you don't know, or are unsure, ask for help. it's absurd to me that you'd need to put every library through compliance even if it has very straight forward OSS licenses.
    - nuclearnice1 4y ago
      In my experience, it’s impossible to assemble a group of 1000 programmers who are consistently able to read a license and reason correctly about whether the firm can follow it.
    - vel0city 4y ago
      Do you really think everyone hired as a coder has enough intellectual property knowledge to understand all the complexities of all the various open source licenses in every potential usage?
      - 4y ago
codys 4y ago
All of the jobs I've worked have not had any technical restrictions on what software engineers could install on their work laptops. Most (but not all) had some sort of asset management tool and/or antivirus as standard on computers, but nearly all provided exceptions to having that functional/installed. I, and I expect many developers, likely select companies with IT policies that avoid potentially harming individual productivity.
- TedDoesntTalk 4y ago
  If you work in financial services (banks, brokerages, hedge funds, exchanges), heath insurance, or the defense industry… your device will be locked down.
  - pclmulqdq 4y ago
    I worked at a highly regulated financial company and they gave me root in prod and permission to install anything I wanted (on any machine I wanted). However, it was clear that EVERYTHING was being tracked, including SSL MITM attacks and the most invasive OS-level logging you can imagine, for compliance reasons. Abuse of that trust was a fireable offense and someone did get fired for it.
  - gpm 4y ago
    I did an internship at a bank. They locked down developers laptops to the point of being unusable. Except all the developers just got permission to install virtual box, and ran another OS inside virtual box that they could and did do whatever they wanted to. This didn't improve security past not locking down devices, it substantially hurt it, but it was also the only way anything got done.
    - cameronh90 4y ago
      Sadly this is often due to regulations and industry expectations. I work in finance and we get all these audits and questionnaires from regulators, insurers, intermediaries, clients, etc. and many of them are straight out of the 90s. For example, when we replaced the VPN with a zero trust system, we got a ton of pushback. It didn't matter that the ZT implementation provided stronger guarantees than the VPN ever did as well as doing everything the VPN did. What mattered is that it wasn't called a VPN and they were expecting me to write "Cisco VPN" or similar. Unfortunately, developers having admin access on their machines triggers so many red flags in these processes. Doesn't matter if you install a load of auditing and remote attestation stuff, admin access is instant ticket to bureaucratic hell.
charcircuit 4y ago
Most big tech companies allow you to install anything on your laptop as long as you use common sense.
- bombcar 4y ago
  And if they're smart, the systems are setup to reduce the "blast radius" from an infected/compromised machine. Locking down the system and then assuming everything is fine is a recipe for disaster.
desindol 4y ago
I worked with 100s of companies from small to giant conglomerates over my time in advertising and 90% have what HN would consider bad security.
- pclmulqdq 4y ago
  Security engineers have a tendency to see a hole and tell you to fill it, independent of the threat model that is required to exploit it. Security is a business decision. That being said, Twitter's stance on insider risk was a little too lax for my taste: my colleagues at a big tech were often asked by governments for their work passwords at country borders if the border patrols noticed they worked for the company, and had no choice but to comply. Preventing insider access to systems mitigates this risk to your employees.
- prvit 4y ago
  90%? That seems awfully optimistic.
CoastalCoder 4y ago
> My current and previous companies will not let me install what I want on my laptop. I've worked for companies all along that spectrum. I've found that the locked-down companies tend to be heavily bureaucratic in other ways as well, and in general make my life as a developer less satisfying. I gravitate towards the more liberal companies.
sgerenser 4y ago
The 2 different FAANG level tech companies I’ve worked at both allowed me (as a developer) to install what I want on my laptop (despite being MDM controlled). I don’t think that fact alone is an indictment of Twitter’s security.
- worik 4y ago
  It is And an indictment of FAANG's. Why do we think that FAANGs set the standard?
  - toast0 4y ago
    > Why do we think that FAANGs set the standard? Who else would set the standard of security at large internet services? Judgement by a jury of their peers seems fair.

awsthrowaway445 4y ago

> The idea that Twitter would allow anything to be installed is kind of shocking to be honest. For what it’s worth, AWS has the same somewhat lax policies about installing software on company laptops. That’s not a diss to AWS security mind you, I’m sure it’s top of the line.

nindalf 4y ago
Meta security also allows any software to be installed. But they also keep a track of laptop state through the osquery daemon that's always running. GP was talking like this alone was gross negligence, implying that this is different from the rest of the industry. That doesn't seem to be the case.
- rogerkirkness 4y ago
  We do this as a 60 person company.
- devnulll 4y ago
  MSFT also allows arbitrary installation of software and development systems. They do force updates, scanning, and other common security best practices. On the machines people use for Livesite support ("Secure Access Workstations") it's a different story. Those bad-boys are locked down from the supply chain through day-to-day use.
colechristensen 4y ago
>That’s not a diss to AWS security mind you, I’m sure it’s top of the line. Top of the line security looks like door locks with daily changing codes and number pads with lcds on them that scramble the order of the digits. It looks like regular searches of your effects as you leave the building, badged and guarded entrances that operate like airlocks, security that roams the building and leaves your manager a nasty note if the wrong documents are left in the open on your desk along with a computer and network that actually won’t let you install software. This was my first job and it felt normal.
- mardifoufs 4y ago
  Defense industry?
  - colechristensen 4y ago
    Indeed
- bawolff 4y ago
  There is a place for that level of security, but twitter is not it. Good risk management means knowing when to accept a risk. Twitter was too lax, but the opposite millitary approach would also be the wrong choice for something like twitter.
  - colechristensen 4y ago
    Oh, absolutely, know your threat model. But top of the line security anywhere is not "meh, install whatever you want on the company laptop". And any company handing private communication and responsible for making social network decisions does need fairly good security to protect against compromised employees and compromised company hardware. That looks like solid policies for installing software, centralized management of hardware, and written policies that are well thought out, audited, and followed. Finance, medicine, defense, ecommerce, etc. all have industry or government regulations for these kinds of security polices and compliance, it seems like social media companies are the wild west and clear signs of problems and abuse have come up repeatedly. No, they probably don't need to go through your bags with random checks to see if you're exfiltrating classified materials or warn you about wearing your company badge visibly when you go out to lunch to avoid spies.
worik 4y ago
> That’s not a diss to AWS security mind you, I’m sure it’s top of the line. You are sure. Whew! Terrified am I

dwighttk 4y ago

>The fact that Mudge couldn't lock things down after Jan 6 or that there wasn't adequate logging etc is also extremely shocking. Remember when Twitter got real big because of the Arab Spring? Free Speech is good? How is “Twitter” supposed to know what to “lock down” and what to allow for good?

aliqot 4y ago
Ban the things your datacenter's country of operation says are illegal, and ignore the rest
tylermenezes 4y ago
This is referring to locking down employee access to modify data in production

mgfist 4y ago

I've only had 1 employer (a DB company) so I can't speak to industry norms, but I've never had restrictions on things I could do or download on my computer. Hard for me to imagine working at a place where I need permission to download a tool or library when writing software. Seems like a huge burden.

0000011111 4y ago
It depends on the industry. However, in a good world you would have an internal repo with all the software users need to do their job and users would just download from that.
slongfield 4y ago
Libraries have licensing requirements that your company needs to comply with. Being able to download and use them without any oversight is an recipe for violating them.
- MAGZine 4y ago
  or... read the license and make sure you can comply with it. And if you don't know, or are unsure, ask for help. it's absurd to me that you'd need to put every library through compliance even if it has very straight forward OSS licenses.
  - nuclearnice1 4y ago
    In my experience, it’s impossible to assemble a group of 1000 programmers who are consistently able to read a license and reason correctly about whether the firm can follow it.
  - vel0city 4y ago
    Do you really think everyone hired as a coder has enough intellectual property knowledge to understand all the complexities of all the various open source licenses in every potential usage?
    - 4y ago

codys 4y ago

All of the jobs I've worked have not had any technical restrictions on what software engineers could install on their work laptops. Most (but not all) had some sort of asset management tool and/or antivirus as standard on computers, but nearly all provided exceptions to having that functional/installed. I, and I expect many developers, likely select companies with IT policies that avoid potentially harming individual productivity.

TedDoesntTalk 4y ago
If you work in financial services (banks, brokerages, hedge funds, exchanges), heath insurance, or the defense industry… your device will be locked down.
- pclmulqdq 4y ago
  I worked at a highly regulated financial company and they gave me root in prod and permission to install anything I wanted (on any machine I wanted). However, it was clear that EVERYTHING was being tracked, including SSL MITM attacks and the most invasive OS-level logging you can imagine, for compliance reasons. Abuse of that trust was a fireable offense and someone did get fired for it.
- gpm 4y ago
  I did an internship at a bank. They locked down developers laptops to the point of being unusable. Except all the developers just got permission to install virtual box, and ran another OS inside virtual box that they could and did do whatever they wanted to. This didn't improve security past not locking down devices, it substantially hurt it, but it was also the only way anything got done.
  - cameronh90 4y ago
    Sadly this is often due to regulations and industry expectations. I work in finance and we get all these audits and questionnaires from regulators, insurers, intermediaries, clients, etc. and many of them are straight out of the 90s. For example, when we replaced the VPN with a zero trust system, we got a ton of pushback. It didn't matter that the ZT implementation provided stronger guarantees than the VPN ever did as well as doing everything the VPN did. What mattered is that it wasn't called a VPN and they were expecting me to write "Cisco VPN" or similar. Unfortunately, developers having admin access on their machines triggers so many red flags in these processes. Doesn't matter if you install a load of auditing and remote attestation stuff, admin access is instant ticket to bureaucratic hell.

charcircuit 4y ago

Most big tech companies allow you to install anything on your laptop as long as you use common sense.

bombcar 4y ago
And if they're smart, the systems are setup to reduce the "blast radius" from an infected/compromised machine. Locking down the system and then assuming everything is fine is a recipe for disaster.

desindol 4y ago

I worked with 100s of companies from small to giant conglomerates over my time in advertising and 90% have what HN would consider bad security.

pclmulqdq 4y ago
Security engineers have a tendency to see a hole and tell you to fill it, independent of the threat model that is required to exploit it. Security is a business decision. That being said, Twitter's stance on insider risk was a little too lax for my taste: my colleagues at a big tech were often asked by governments for their work passwords at country borders if the border patrols noticed they worked for the company, and had no choice but to comply. Preventing insider access to systems mitigates this risk to your employees.
prvit 4y ago
90%? That seems awfully optimistic.

CoastalCoder 4y ago

> My current and previous companies will not let me install what I want on my laptop. I've worked for companies all along that spectrum. I've found that the locked-down companies tend to be heavily bureaucratic in other ways as well, and in general make my life as a developer less satisfying. I gravitate towards the more liberal companies.

sgerenser 4y ago

The 2 different FAANG level tech companies I’ve worked at both allowed me (as a developer) to install what I want on my laptop (despite being MDM controlled). I don’t think that fact alone is an indictment of Twitter’s security.

worik 4y ago
It is And an indictment of FAANG's. Why do we think that FAANGs set the standard?
- toast0 4y ago
  > Why do we think that FAANGs set the standard? Who else would set the standard of security at large internet services? Judgement by a jury of their peers seems fair.