6 ms·

Mudge is a cyber activist, not a business executive

54 points by williamsmj 4y ago

apstats 4y ago
It seems very obvious that he is an engineer taking advantage of a situation. I don’t blame him I’m sure security is lapsing in the eyes of a life kong security researchers. But as to a lawyer everything is a legal problem and a carpenter a carpentry problem, this is a security issue only to someone in infosec.
enviclash 4y ago
IMHO this read like PR written against Mudge, I am not saying it is, I mean that the presentation of arguments and the logic is too visibly organised and does not feel balanced.
- tptacek 4y ago
  it's Robert Graham. He's not a rando.
  - enviclash 4y ago
    Non-rando people indeed can choose to have communication strategies, still I am not saying this is the case.
br0wnr1c3 4y ago
I don't think it's unreasonable for an executive in the CISO position to advocate for better cybersecurity practices such as up-to-date software. If every executive exclusively worried about ROI, we'd have a bunch of CFOs running security teams.
debacle 4y ago
The argument falls flat by paragraph 7 of this long rambling piece. > But there’s no objective evidence of this, only the subjective opinion of Mudge that Twitter wasn’t doing enough for cybersecurity. ... > specifically that they lied to investors and failed to live up to a 2014 FTC agreement to secure “private” data. So is it subjective, or objective? Is the 2014 FTC agreement subjective? And then he just starts pissing into the wind. "He said servers were out of date, but Ret Hat 7 is 8 years old but it's still receiving security patches but I'll just hand wave that away." > Part of his complaint is that the now-CEO Parag Agrawal pressured him into lying to the board, to claim to the risk committee of the board that security is better than it really was. ...this is against the law. "Of course Agrawal did. He’s supposed to do that." This whole article is just rife with logical fallacies, incongruencies, and silliness. > In contrast, Mudge’s complaint is full of the assertions that he’s objectively right, and Agrawal objectively wrong. And since it’s objective that he was wrong, Agrawal must’ve been lying. The argument is that Agrawal intentionally misled shareholders. That's objectively wrong. And, finally: > What I read here in Mudge’s complaint aren’t the words of an executive, but the words of an activist. The complaint was written as a whistleblower not as a CISO.
- quantified 4y ago
  Is lying to a board member really against the law? Lying to a regulator or investor, sure. Lying to your boss or to your employee, no, happens all the time. Might be, I don't know. So I ask.
eganist 4y ago
Something I've noticed pre-pandemic: infosec twitter's other personalities seem to have largely agreed to take Robert Graham's opinions with a grain of salt because they tend to fit the definition of "hot take" pretty closely. Not that impressions from "personalities" are how anyone should gauge the validity of someone's opinions, but my impression is likewise that he's mostly known for trolling. I doubt the claim that it's a PR piece, but I don't doubt the idea that Robert wrote this to troll. It fits pretty closely, so it's probably best to look at it from a practical angle and not get worked up about it. No one even knows if Robert believes half of what he himself writes. -- stated differently: he's the Armond White of InfoSec Twitter. -- tl;dr: he's probably trolling.
chx 4y ago
> In other words, in all likelihood, Twitter is ahead of the norm, ahead of the average, just not up to the same standard set by the leaders in tech. Really? It came out Twitter doesn't have a dev/staging environment. Source: https://twitter.com/lauren_feiner/status/1569695337190944775 https://twitter.com/lauren_feiner/status/1569695337190944775 in the same thread, "Twitter can't assure regulators that it's able to delete all data at a user's request because it's unsure where all that data lives" Earlier we have learned > “Even a temporary but overlapping outage of a small number of datacenters would likely result in the service [Twitter] going offline for weeks, months, or permanently,” according to Zatko’s whistleblower disclosure. (Twitter has criticized Zatko and broadly defended itself against the allegations, saying the disclosure paints a “false narrative” of the company.) Quoted in https://www.cnn.com/2022/09/12/tech/twitter-data-center-california-heat-wave/index.html https://www.cnn.com/2022/09/12/tech/twitter-data-center-cali... just yesterday. All in all, there's a picture here which says Twitter simply doesn't have a handle on its own infra any more, it can't replicate it for dev/staging purposes, it doesn't fully know where the data goes and if it crashed they couldn't rebuild it. You call that ahead of the norm?
- itsdrewmiller 4y ago
  Do either of these allegations pass the smell test? They seem pretty wild.
- pkphilip 4y ago
  Facebook is making very similar claims. Seems like Big Tech has decided the way to deal with data privacy complaints is to pretend that they don't even know what data they are storing and where. https://www.vice.com/en/article/akvmke/facebook-doesnt-know-what-it-does-with-your-data-or-where-it-goes https://www.vice.com/en/article/akvmke/facebook-doesnt-know-... I wonder if ordinary citizens can make that same claim when it comes to their stuff - "No, officer, I don't even know whether there are any drugs in my possession because I don't even know what is in my house and where"
- ralph84 4y ago
  > It came out Twitter doesn't have a dev/staging environment. And? Dev/staging is fine for enterprises that don't have to operate at Internet scale, think having a build script means they have CI/CD, and are doing waterfall development even if they call it agile. For truly Internet-scale services the cost/benefit of trying to build a staging environment that would have any usefulness doesn't pencil out. Canary deploys with well thought-out rollback plans works fine.
bink 4y ago
Some very good points made in this article but also so many cringey takes. The author is an engineer but compares the user to server ratio at Twitter to Netflix. Those services are so very different and have such vastly different hardware, software, and network requirements I don't even know where to begin. They dismiss Mudge's comments on lack of disk encryption by saying that anything less than end-to-end encryption is pointless anyways. Again, I don't even really know where to begin. Those features address completely different risks. Not every service can reasonably implement end-to-end encryption while still providing the functionality and support their users want. That doesn't mean they should just ignore encryption altogether. There are other threats out there that are mitigated by encryption at rest. And I think the core of Mudge's complaint here is that too many people have access to private DMs. There are all kinds of security controls to mitigate that threat that it sounds like Twitter isn't using. > Cybersecurity has the wrong belief that “security” is their highest ethical duty, to the point where they thing it’s good to lie to people for their own good, as long as doing so achieves better security. Wait, what? I've worked in the industry as long as Mudge has and I've never come to this conclusion. There are many, many security engineers, managers, and execs out there that work hard to earn a great reputation in their field by measuring security against business needs and finding a welcome compromise. I say this as someone who pointed out when this story first broke that Mudge's background really didn't appear to be well suited to managing security at a huge tech company. I also share the concerns about how equipped he was to deal with executives and board members. But yikes.
- akira2501 4y ago
  > There are all kinds of security controls to mitigate that threat that it sounds like Twitter isn't using. I mean.. they created a "God mode" for their service. It pretty much tells you where their entire approach to security of user data sits.
  - TedDoesntTalk 4y ago
    God mode, if compared to something like sudo or root access, is not a problem. It’s only a problem of the wrong people have access to it.
jpgvm 4y ago
This whole thing is becoming rather unbecoming of most of the commentators. At this stage it would be best to just wait until things are settled before drawing conclusions.
- xbar 4y ago
  Perhaps they are not merely commentators.
largepeepee 4y ago
So the writer is mad that mudge takes his job seriously and isn't an obvious corpo shill trying to bend all rules for profit? Based on what? According to the writer, mudge's long experience of growing up before everyone became money obsessed apparently. Flip it the other way round the writer demands all execs to be short term profit driven cucks or not worthy of a seat. Can't tell if the writer is just an idiot or a gigabrain mudge supporter.
deleted 4y ago
[deleted]
spoonjim 4y ago
What happened was that Twitter hired a famous name to run their security for the clout, then it turns out that was a big misfire
- j0hnyl 4y ago
  Because he actually took the job seriously.
infinityplus1 4y ago
So Twitter hires someone famous for a job. He tries to do the job well. But execs don't let him do it. If anything wrong happens, then he'll be blamed for it. What is he supposed to do while the ticking time bomb explodes which it will? Just sit and wait for their reputation to be tarnished for being bad at their job? Or take some action to pin accountability to the ones responsible?
TedDoesntTalk 4y ago
> The cybersecurity industry is dominated by activists who believe it’s a Holy Crusade, a Cause, a Moral duty, an end in of itself Very well said
MattPalmer1086 4y ago
I do not agree with most of the points made in this article. I didn't watch the entire testimony, but what I heard I found worrying. For example, half the company had prod access to user accounts. And there was no way to find out who accessed what. This is not normal, it's a huge red flag. The article claims that it should be perfectly expected that an executive should order someone to lie to the board about the risk the company is exposed to. Apparently this is Mudge's fault for not pushing back hard enough. And then there's the rant against the "cyber security crusader", for whom nothing but perfect security is enough. Sounds like a perfectly annoying character, along with the architecture astronauts I guess. I've never met any of these stereotypes in the real world, although people do disagree on what is enough. So it's either trolling us, or just not very good. Or both.
- caeril 4y ago
  > And there was no way to find out who accessed what. This is not normal, it's a huge red flag One can argue that it shouldn't be normal, but I assure you that it is extremely normal in most companies. Shared root credentials, no audit logs, or audit logs that you have to grep on individual hosts - these are VERY VERY normal across business.
  - MattPalmer1086 4y ago
    They certainly exist, and I've worked at a few. They were all smaller organisations. I've seen medium sized companies wrestle with it a bit. No large organisation I've worked for had rampant prod access. Which I guess is why it surprises me that Twitter still operates like that.
  - toomuchtodo 4y ago
    Normal is probably the wrong word. It’s expected for smaller or less resourced orgs to have immature security and data/access governance programs. But a public company such as Twitter (who has to adhere to Sarbanes Oxley and other regulatory frameworks that drive access control and RBAC)? Not so much.
  - jagrsw 4y ago

54 points by williamsmj 4y ago

It seems very obvious that he is an engineer taking advantage of a situation. I don’t blame him I’m sure security is lapsing in the eyes of a life kong security researchers. But as to a lawyer everything is a legal problem and a carpenter a carpentry problem, this is a security issue only to someone in infosec.

enviclash 4y ago

IMHO this read like PR written against Mudge, I am not saying it is, I mean that the presentation of arguments and the logic is too visibly organised and does not feel balanced.

tptacek 4y ago
it's Robert Graham. He's not a rando.
- enviclash 4y ago
  Non-rando people indeed can choose to have communication strategies, still I am not saying this is the case.

br0wnr1c3 4y ago

I don't think it's unreasonable for an executive in the CISO position to advocate for better cybersecurity practices such as up-to-date software. If every executive exclusively worried about ROI, we'd have a bunch of CFOs running security teams.

debacle 4y ago

The argument falls flat by paragraph 7 of this long rambling piece. > But there’s no objective evidence of this, only the subjective opinion of Mudge that Twitter wasn’t doing enough for cybersecurity. ... > specifically that they lied to investors and failed to live up to a 2014 FTC agreement to secure “private” data. So is it subjective, or objective? Is the 2014 FTC agreement subjective? And then he just starts pissing into the wind. "He said servers were out of date, but Ret Hat 7 is 8 years old but it's still receiving security patches but I'll just hand wave that away." > Part of his complaint is that the now-CEO Parag Agrawal pressured him into lying to the board, to claim to the risk committee of the board that security is better than it really was. ...this is against the law. "Of course Agrawal did. He’s supposed to do that." This whole article is just rife with logical fallacies, incongruencies, and silliness. > In contrast, Mudge’s complaint is full of the assertions that he’s objectively right, and Agrawal objectively wrong. And since it’s objective that he was wrong, Agrawal must’ve been lying. The argument is that Agrawal intentionally misled shareholders. That's objectively wrong. And, finally: > What I read here in Mudge’s complaint aren’t the words of an executive, but the words of an activist. The complaint was written as a whistleblower not as a CISO.

quantified 4y ago
Is lying to a board member really against the law? Lying to a regulator or investor, sure. Lying to your boss or to your employee, no, happens all the time. Might be, I don't know. So I ask.

eganist 4y ago

Something I've noticed pre-pandemic: infosec twitter's other personalities seem to have largely agreed to take Robert Graham's opinions with a grain of salt because they tend to fit the definition of "hot take" pretty closely. Not that impressions from "personalities" are how anyone should gauge the validity of someone's opinions, but my impression is likewise that he's mostly known for trolling. I doubt the claim that it's a PR piece, but I don't doubt the idea that Robert wrote this to troll. It fits pretty closely, so it's probably best to look at it from a practical angle and not get worked up about it. No one even knows if Robert believes half of what he himself writes. -- stated differently: he's the Armond White of InfoSec Twitter. -- tl;dr: he's probably trolling.

chx 4y ago

> In other words, in all likelihood, Twitter is ahead of the norm, ahead of the average, just not up to the same standard set by the leaders in tech. Really? It came out Twitter doesn't have a dev/staging environment. Source: https://twitter.com/lauren_feiner/status/1569695337190944775 https://twitter.com/lauren_feiner/status/1569695337190944775 in the same thread, "Twitter can't assure regulators that it's able to delete all data at a user's request because it's unsure where all that data lives" Earlier we have learned > “Even a temporary but overlapping outage of a small number of datacenters would likely result in the service [Twitter] going offline for weeks, months, or permanently,” according to Zatko’s whistleblower disclosure. (Twitter has criticized Zatko and broadly defended itself against the allegations, saying the disclosure paints a “false narrative” of the company.) Quoted in https://www.cnn.com/2022/09/12/tech/twitter-data-center-california-heat-wave/index.html https://www.cnn.com/2022/09/12/tech/twitter-data-center-cali... just yesterday. All in all, there's a picture here which says Twitter simply doesn't have a handle on its own infra any more, it can't replicate it for dev/staging purposes, it doesn't fully know where the data goes and if it crashed they couldn't rebuild it. You call that ahead of the norm?

itsdrewmiller 4y ago
Do either of these allegations pass the smell test? They seem pretty wild.
pkphilip 4y ago
Facebook is making very similar claims. Seems like Big Tech has decided the way to deal with data privacy complaints is to pretend that they don't even know what data they are storing and where. https://www.vice.com/en/article/akvmke/facebook-doesnt-know-what-it-does-with-your-data-or-where-it-goes https://www.vice.com/en/article/akvmke/facebook-doesnt-know-... I wonder if ordinary citizens can make that same claim when it comes to their stuff - "No, officer, I don't even know whether there are any drugs in my possession because I don't even know what is in my house and where"
ralph84 4y ago
> It came out Twitter doesn't have a dev/staging environment. And? Dev/staging is fine for enterprises that don't have to operate at Internet scale, think having a build script means they have CI/CD, and are doing waterfall development even if they call it agile. For truly Internet-scale services the cost/benefit of trying to build a staging environment that would have any usefulness doesn't pencil out. Canary deploys with well thought-out rollback plans works fine.

bink 4y ago

Some very good points made in this article but also so many cringey takes. The author is an engineer but compares the user to server ratio at Twitter to Netflix. Those services are so very different and have such vastly different hardware, software, and network requirements I don't even know where to begin. They dismiss Mudge's comments on lack of disk encryption by saying that anything less than end-to-end encryption is pointless anyways. Again, I don't even really know where to begin. Those features address completely different risks. Not every service can reasonably implement end-to-end encryption while still providing the functionality and support their users want. That doesn't mean they should just ignore encryption altogether. There are other threats out there that are mitigated by encryption at rest. And I think the core of Mudge's complaint here is that too many people have access to private DMs. There are all kinds of security controls to mitigate that threat that it sounds like Twitter isn't using. > Cybersecurity has the wrong belief that “security” is their highest ethical duty, to the point where they thing it’s good to lie to people for their own good, as long as doing so achieves better security. Wait, what? I've worked in the industry as long as Mudge has and I've never come to this conclusion. There are many, many security engineers, managers, and execs out there that work hard to earn a great reputation in their field by measuring security against business needs and finding a welcome compromise. I say this as someone who pointed out when this story first broke that Mudge's background really didn't appear to be well suited to managing security at a huge tech company. I also share the concerns about how equipped he was to deal with executives and board members. But yikes.

akira2501 4y ago
> There are all kinds of security controls to mitigate that threat that it sounds like Twitter isn't using. I mean.. they created a "God mode" for their service. It pretty much tells you where their entire approach to security of user data sits.
- TedDoesntTalk 4y ago
  God mode, if compared to something like sudo or root access, is not a problem. It’s only a problem of the wrong people have access to it.

jpgvm 4y ago

This whole thing is becoming rather unbecoming of most of the commentators. At this stage it would be best to just wait until things are settled before drawing conclusions.

xbar 4y ago
Perhaps they are not merely commentators.

largepeepee 4y ago

So the writer is mad that mudge takes his job seriously and isn't an obvious corpo shill trying to bend all rules for profit? Based on what? According to the writer, mudge's long experience of growing up before everyone became money obsessed apparently. Flip it the other way round the writer demands all execs to be short term profit driven cucks or not worthy of a seat. Can't tell if the writer is just an idiot or a gigabrain mudge supporter.

deleted 4y ago

[deleted]

spoonjim 4y ago

What happened was that Twitter hired a famous name to run their security for the clout, then it turns out that was a big misfire

j0hnyl 4y ago
Because he actually took the job seriously.

infinityplus1 4y ago

So Twitter hires someone famous for a job. He tries to do the job well. But execs don't let him do it. If anything wrong happens, then he'll be blamed for it. What is he supposed to do while the ticking time bomb explodes which it will? Just sit and wait for their reputation to be tarnished for being bad at their job? Or take some action to pin accountability to the ones responsible?

TedDoesntTalk 4y ago

> The cybersecurity industry is dominated by activists who believe it’s a Holy Crusade, a Cause, a Moral duty, an end in of itself Very well said

MattPalmer1086 4y ago

I do not agree with most of the points made in this article. I didn't watch the entire testimony, but what I heard I found worrying. For example, half the company had prod access to user accounts. And there was no way to find out who accessed what. This is not normal, it's a huge red flag. The article claims that it should be perfectly expected that an executive should order someone to lie to the board about the risk the company is exposed to. Apparently this is Mudge's fault for not pushing back hard enough. And then there's the rant against the "cyber security crusader", for whom nothing but perfect security is enough. Sounds like a perfectly annoying character, along with the architecture astronauts I guess. I've never met any of these stereotypes in the real world, although people do disagree on what is enough. So it's either trolling us, or just not very good. Or both.

caeril 4y ago
> And there was no way to find out who accessed what. This is not normal, it's a huge red flag One can argue that it shouldn't be normal, but I assure you that it is extremely normal in most companies. Shared root credentials, no audit logs, or audit logs that you have to grep on individual hosts - these are VERY VERY normal across business.
- MattPalmer1086 4y ago
  They certainly exist, and I've worked at a few. They were all smaller organisations. I've seen medium sized companies wrestle with it a bit. No large organisation I've worked for had rampant prod access. Which I guess is why it surprises me that Twitter still operates like that.
- toomuchtodo 4y ago
  Normal is probably the wrong word. It’s expected for smaller or less resourced orgs to have immature security and data/access governance programs. But a public company such as Twitter (who has to adhere to Sarbanes Oxley and other regulatory frameworks that drive access control and RBAC)? Not so much.
- jagrsw 4y ago