4 ms·

So not only are they going to find a vulnerability on twitter’s backend that allows them to remotely execute code on the Twitter servers, but then they’re also

So not only are they going to find a vulnerability on twitter’s backend that allows them to remotely execute code on the Twitter servers, but then they’re also going to find some vulnerability in the app that is accessible from the previous vulnerability on the backend that allows them to execute arbitrary code on my phone, without pushing any sort of app update to the Apple store, and then they’re going to use that vulnerability in the app to deploy some 0day that gets around all the protections in iOS? I’m terrified!

1attice 4y ago
I'm more worried about cold path logs. Like, what if Twitter just randomly has the past year's worth of geolocation data on so-and-so, and it happens to be exposed in an SQL query, and that query happens to get run and the results exfiltrated. It depends a lot on what Twitter keeps and for how long, but e.g. consider American soldiers being used to pinpoint nuclear silos, for example. Imagine being able to map where every journalist is in the world. Now imagine being able to do that for every minute of every day for the past decade. Objectively, this is an enormous geopolitical risk at just the wrong time, but I have no interest in panicking so aside from mentioning it here, I'm letting it be somebody else's problem
- 1attice 4y ago
  Before anyone asks: the cold path is long-term logging and storage, as opposed to the hot path, i.e. real-time telemetry. (Or at least that's what we called them at the last CloudCo I worked at). Generally, you try to keep PII (personally identifiable information) and other stuff out of the cold path, but the data still has to be somewhere, right? So there's the hot path. The overall effect is that stuff that is only logged 'on the hot path' gets effectively forgotten after a while, so you don't have to worry about the management and stewardship of that data. But you could, for example, force a compromised system to log PII (incl GPS coordinates, radiotelemetry, accelerometer) to the cold path and then come back and get it later. For bonus points, do stego so it looks innocent. That is one of the scenarios I'm worried is playing out over there. One of many worries, to be honest, but this one just seems like the kind of breach we'd find out about years later, if at all, under the new regime. Meanwhile, people in this or that far-off place just... disappear.
- rglover 4y ago
  "Only the paranoid survive." - Andy Grove Though I'd like to think this was all unlikely, I appreciate the heads up and explanation of why you're concerned. Mensch.
- krisoft 4y ago
  > consider American soldiers being used to pinpoint nuclear silos, for example. The location of nuclear silos is known. Known to us and known to our adversaries. You should work more on your techno thriller. :) > Imagine being able to map where every journalist is in the world. https://xkcd.com/1138/ https://xkcd.com/1138/
  - mrguyorama 4y ago
    The parent isn't talking about aggregate overview of journalists. They are talking about targeted tracking. We already know the saudis were doing their damndest to have access to twitter for basically that exact purpose, and they keep telling me to ignore the hacksaws they brought.
mlindner 4y ago
I think people are missing the obvious sarcasm in this post.
AnonymousPlanet 4y ago
You can use Twitter with a third party app. In this regard Twitter stands out from the likes of Facebook, Instagram, Tiktok etc. and is the reason I use it and none of the others.
- Thlom 4y ago
  Haha. Yeah. I still only see the reverse chronological timeline. No advertisements and no algorithm screwing up my timeline. Thanks Tweetbot.
- KptMarchewa 4y ago
  Reddit is another positive standout here.

1attice 4y ago

I'm more worried about cold path logs. Like, what if Twitter just randomly has the past year's worth of geolocation data on so-and-so, and it happens to be exposed in an SQL query, and that query happens to get run and the results exfiltrated. It depends a lot on what Twitter keeps and for how long, but e.g. consider American soldiers being used to pinpoint nuclear silos, for example. Imagine being able to map where every journalist is in the world. Now imagine being able to do that for every minute of every day for the past decade. Objectively, this is an enormous geopolitical risk at just the wrong time, but I have no interest in panicking so aside from mentioning it here, I'm letting it be somebody else's problem

1attice 4y ago
Before anyone asks: the cold path is long-term logging and storage, as opposed to the hot path, i.e. real-time telemetry. (Or at least that's what we called them at the last CloudCo I worked at). Generally, you try to keep PII (personally identifiable information) and other stuff out of the cold path, but the data still has to be somewhere, right? So there's the hot path. The overall effect is that stuff that is only logged 'on the hot path' gets effectively forgotten after a while, so you don't have to worry about the management and stewardship of that data. But you could, for example, force a compromised system to log PII (incl GPS coordinates, radiotelemetry, accelerometer) to the cold path and then come back and get it later. For bonus points, do stego so it looks innocent. That is one of the scenarios I'm worried is playing out over there. One of many worries, to be honest, but this one just seems like the kind of breach we'd find out about years later, if at all, under the new regime. Meanwhile, people in this or that far-off place just... disappear.
rglover 4y ago
"Only the paranoid survive." - Andy Grove Though I'd like to think this was all unlikely, I appreciate the heads up and explanation of why you're concerned. Mensch.
krisoft 4y ago
> consider American soldiers being used to pinpoint nuclear silos, for example. The location of nuclear silos is known. Known to us and known to our adversaries. You should work more on your techno thriller. :) > Imagine being able to map where every journalist is in the world. https://xkcd.com/1138/ https://xkcd.com/1138/
- mrguyorama 4y ago
  The parent isn't talking about aggregate overview of journalists. They are talking about targeted tracking. We already know the saudis were doing their damndest to have access to twitter for basically that exact purpose, and they keep telling me to ignore the hacksaws they brought.

mlindner 4y ago

I think people are missing the obvious sarcasm in this post.

AnonymousPlanet 4y ago

You can use Twitter with a third party app. In this regard Twitter stands out from the likes of Facebook, Instagram, Tiktok etc. and is the reason I use it and none of the others.

Thlom 4y ago
Haha. Yeah. I still only see the reverse chronological timeline. No advertisements and no algorithm screwing up my timeline. Thanks Tweetbot.
KptMarchewa 4y ago
Reddit is another positive standout here.