4 ms·

I'm more worried about cold path logs. Like, what if Twitter just randomly has the past year's worth of geolocation data on so-and-so, and it happens to be expo

I'm more worried about cold path logs. Like, what if Twitter just randomly has the past year's worth of geolocation data on so-and-so, and it happens to be exposed in an SQL query, and that query happens to get run and the results exfiltrated. It depends a lot on what Twitter keeps and for how long, but e.g. consider American soldiers being used to pinpoint nuclear silos, for example. Imagine being able to map where every journalist is in the world. Now imagine being able to do that for every minute of every day for the past decade. Objectively, this is an enormous geopolitical risk at just the wrong time, but I have no interest in panicking so aside from mentioning it here, I'm letting it be somebody else's problem

1attice 4y ago
Before anyone asks: the cold path is long-term logging and storage, as opposed to the hot path, i.e. real-time telemetry. (Or at least that's what we called them at the last CloudCo I worked at). Generally, you try to keep PII (personally identifiable information) and other stuff out of the cold path, but the data still has to be somewhere, right? So there's the hot path. The overall effect is that stuff that is only logged 'on the hot path' gets effectively forgotten after a while, so you don't have to worry about the management and stewardship of that data. But you could, for example, force a compromised system to log PII (incl GPS coordinates, radiotelemetry, accelerometer) to the cold path and then come back and get it later. For bonus points, do stego so it looks innocent. That is one of the scenarios I'm worried is playing out over there. One of many worries, to be honest, but this one just seems like the kind of breach we'd find out about years later, if at all, under the new regime. Meanwhile, people in this or that far-off place just... disappear.
rglover 4y ago
"Only the paranoid survive." - Andy Grove Though I'd like to think this was all unlikely, I appreciate the heads up and explanation of why you're concerned. Mensch.
krisoft 4y ago
> consider American soldiers being used to pinpoint nuclear silos, for example. The location of nuclear silos is known. Known to us and known to our adversaries. You should work more on your techno thriller. :) > Imagine being able to map where every journalist is in the world. https://xkcd.com/1138/ https://xkcd.com/1138/
- mrguyorama 4y ago
  The parent isn't talking about aggregate overview of journalists. They are talking about targeted tracking. We already know the saudis were doing their damndest to have access to twitter for basically that exact purpose, and they keep telling me to ignore the hacksaws they brought.

1attice 4y ago

Before anyone asks: the cold path is long-term logging and storage, as opposed to the hot path, i.e. real-time telemetry. (Or at least that's what we called them at the last CloudCo I worked at). Generally, you try to keep PII (personally identifiable information) and other stuff out of the cold path, but the data still has to be somewhere, right? So there's the hot path. The overall effect is that stuff that is only logged 'on the hot path' gets effectively forgotten after a while, so you don't have to worry about the management and stewardship of that data. But you could, for example, force a compromised system to log PII (incl GPS coordinates, radiotelemetry, accelerometer) to the cold path and then come back and get it later. For bonus points, do stego so it looks innocent. That is one of the scenarios I'm worried is playing out over there. One of many worries, to be honest, but this one just seems like the kind of breach we'd find out about years later, if at all, under the new regime. Meanwhile, people in this or that far-off place just... disappear.

rglover 4y ago

"Only the paranoid survive." - Andy Grove Though I'd like to think this was all unlikely, I appreciate the heads up and explanation of why you're concerned. Mensch.

krisoft 4y ago

> consider American soldiers being used to pinpoint nuclear silos, for example. The location of nuclear silos is known. Known to us and known to our adversaries. You should work more on your techno thriller. :) > Imagine being able to map where every journalist is in the world. https://xkcd.com/1138/ https://xkcd.com/1138/

mrguyorama 4y ago
The parent isn't talking about aggregate overview of journalists. They are talking about targeted tracking. We already know the saudis were doing their damndest to have access to twitter for basically that exact purpose, and they keep telling me to ignore the hacksaws they brought.