3 ms·

> The idea that Twitter would allow anything to be installed is kind of shocking to be honest. For what it’s worth, AWS has the same somewhat lax policies abou

> The idea that Twitter would allow anything to be installed is kind of shocking to be honest. For what it’s worth, AWS has the same somewhat lax policies about installing software on company laptops. That’s not a diss to AWS security mind you, I’m sure it’s top of the line.

nindalf 4y ago
Meta security also allows any software to be installed. But they also keep a track of laptop state through the osquery daemon that's always running. GP was talking like this alone was gross negligence, implying that this is different from the rest of the industry. That doesn't seem to be the case.
- rogerkirkness 4y ago
  We do this as a 60 person company.
- devnulll 4y ago
  MSFT also allows arbitrary installation of software and development systems. They do force updates, scanning, and other common security best practices. On the machines people use for Livesite support ("Secure Access Workstations") it's a different story. Those bad-boys are locked down from the supply chain through day-to-day use.
colechristensen 4y ago
>That’s not a diss to AWS security mind you, I’m sure it’s top of the line. Top of the line security looks like door locks with daily changing codes and number pads with lcds on them that scramble the order of the digits. It looks like regular searches of your effects as you leave the building, badged and guarded entrances that operate like airlocks, security that roams the building and leaves your manager a nasty note if the wrong documents are left in the open on your desk along with a computer and network that actually won’t let you install software. This was my first job and it felt normal.
- mardifoufs 4y ago
  Defense industry?
  - colechristensen 4y ago
    Indeed
- bawolff 4y ago
  There is a place for that level of security, but twitter is not it. Good risk management means knowing when to accept a risk. Twitter was too lax, but the opposite millitary approach would also be the wrong choice for something like twitter.
  - colechristensen 4y ago
    Oh, absolutely, know your threat model. But top of the line security anywhere is not "meh, install whatever you want on the company laptop". And any company handing private communication and responsible for making social network decisions does need fairly good security to protect against compromised employees and compromised company hardware. That looks like solid policies for installing software, centralized management of hardware, and written policies that are well thought out, audited, and followed. Finance, medicine, defense, ecommerce, etc. all have industry or government regulations for these kinds of security polices and compliance, it seems like social media companies are the wild west and clear signs of problems and abuse have come up repeatedly. No, they probably don't need to go through your bags with random checks to see if you're exfiltrating classified materials or warn you about wearing your company badge visibly when you go out to lunch to avoid spies.
worik 4y ago
> That’s not a diss to AWS security mind you, I’m sure it’s top of the line. You are sure. Whew! Terrified am I

nindalf 4y ago

Meta security also allows any software to be installed. But they also keep a track of laptop state through the osquery daemon that's always running. GP was talking like this alone was gross negligence, implying that this is different from the rest of the industry. That doesn't seem to be the case.

rogerkirkness 4y ago
We do this as a 60 person company.
devnulll 4y ago
MSFT also allows arbitrary installation of software and development systems. They do force updates, scanning, and other common security best practices. On the machines people use for Livesite support ("Secure Access Workstations") it's a different story. Those bad-boys are locked down from the supply chain through day-to-day use.

colechristensen 4y ago

>That’s not a diss to AWS security mind you, I’m sure it’s top of the line. Top of the line security looks like door locks with daily changing codes and number pads with lcds on them that scramble the order of the digits. It looks like regular searches of your effects as you leave the building, badged and guarded entrances that operate like airlocks, security that roams the building and leaves your manager a nasty note if the wrong documents are left in the open on your desk along with a computer and network that actually won’t let you install software. This was my first job and it felt normal.

mardifoufs 4y ago
Defense industry?
- colechristensen 4y ago
  Indeed
bawolff 4y ago
There is a place for that level of security, but twitter is not it. Good risk management means knowing when to accept a risk. Twitter was too lax, but the opposite millitary approach would also be the wrong choice for something like twitter.
- colechristensen 4y ago
  Oh, absolutely, know your threat model. But top of the line security anywhere is not "meh, install whatever you want on the company laptop". And any company handing private communication and responsible for making social network decisions does need fairly good security to protect against compromised employees and compromised company hardware. That looks like solid policies for installing software, centralized management of hardware, and written policies that are well thought out, audited, and followed. Finance, medicine, defense, ecommerce, etc. all have industry or government regulations for these kinds of security polices and compliance, it seems like social media companies are the wild west and clear signs of problems and abuse have come up repeatedly. No, they probably don't need to go through your bags with random checks to see if you're exfiltrating classified materials or warn you about wearing your company badge visibly when you go out to lunch to avoid spies.

worik 4y ago

> That’s not a diss to AWS security mind you, I’m sure it’s top of the line. You are sure. Whew! Terrified am I