38 ms·
Not to defend the Twitter situation, which is foolhardy by almost any measure, but it's extremely uncommon for any company's main landing page to relate in any
by bri3d 4y ago
Not to defend the Twitter situation, which is foolhardy by almost any measure, but it's extremely uncommon for any company's main landing page to relate in any way to their software engineering team.
Usually these marketing sites are running a CMS (this one looks like Drupal) which is owned and operated by either an internal team who report to the CIO / IT department (vs the Product/Engineering group) or a totally external third-party marketing firm.
As long as the "real" product uses different subdomains, certificates, proper HSTS, cross-origin protection, and secure cookies (a tall order, yes, but something that would be an issue no matter what the marketing site is doing), security issues in the "marketing" site aren't as bad. Of course a marketing site takeover is still worrying, as it's a prime entry point for spearphishing and horizontal movement through social engineering, but these usually aren't the same engineers or security team at all.
- cmeacham98 4y agoNobody (sane) is saying this is a security vulnerability or the like (especially as it seems to be a default Drupal gitignore). It's just a funny mistake from a "software first" company.
- mlindner 4y agoThere's several people in the comments saying exactly that kind of thing in this thread including people asking if it leads to vehicle code exploits.
- cmeacham98 4y agoI never claimed everybody on HN was sane /shrug
- shudza 4y agoSo what is gonna be your opinion when it gets fixed?
- cmeacham98 4y ago"It used to be a funny mistake by Tesla but now it's fixed"? What are you expecting here?
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- SnowingXIV 4y ago100%. Tacking on to this, the last few places I've been the public facing site was usually managed by the marketing or design team, and often was used as a project to get them to touch _some_ code. Engineering rarely ever got involved with this if ever. If not them; probably a third-party firm.