5 ms·

Is Twitter/X the right channel to announce a security event like this? I ask because I don’t see anything posted on their official blog or status page. https:

Is Twitter/X the right channel to announce a security event like this? I ask because I don’t see anything posted on their official blog or status page. https://github.blog/ https://github.blog/ https://www.githubstatus.com/ https://www.githubstatus.com/

cebert 5mo ago
It’s a very popular messaging platform for tech enthusiasts.
- yallpendantools 5mo ago
  So? Is this where your corporate paying clients should find out about an issue of this severity? Not to mention Twitter is not an open platform anymore! (A) I'm an employee in an organization paying for Github. (B) I don't have a Twitter account. I already have a Github account because of (A). Why should (B) stop/delay me from getting official comms about this?
  - insanitybit 5mo ago
    Isn't it the first stop for the USG at this point? I mean, I wish the world were a different place but here we are.
  - zdragnar 5mo ago
    I can't imagine they'd spam every account with an email address, though an email to organization owners would make more sense.
    - yallpendantools 5mo ago
      > I can't imagine they'd spam every account with an email address It's not "spam" if it is relevant to me, such as security incident disclosures. Also, as tiffanyh pointed out, what's wrong with Github blog or is that exclusively for marketing fluff now? That would've been appropriate enough, without having to spend Sendgrid credits.
    - bulbar 5mo ago
      Mailing every (potentially) affected entity is common and good practice for major incidents.
- ignu 5mo ago
  also a very popular messaging platform for [redacted] enthusiasts
  - deleted 5mo ago
    [deleted]
  - sph 5mo ago
    The only metric that matters when choosing a platform to broadcast announcements is ‘very popular’.
niyikiza 5mo ago
Probably the best option after sending a mass email when customers need to take action. The status page is for reliability issues impacting end users & the blog is for in-depth analysis.
lynndotpy 5mo ago
It's certainly not the right platform. It'd be one thing if they had any official communication on the matter anywhere else. Maybe they're ashamed and are trying to limit the visibility while only technically issuing an announcement. They announced this exclusively on X.com, which ranks barely above Pinterest in terms of usage. That's below Reddit, Snapchat, WeChat, and Instagram, and requires a user account to view profiles and posts. And that's ignoring all the reasons X is a divisive platform with an extreme political bent. GitHub chose not to announce this on any other social media either (BlueSky, Facebook, TikTok, YouTube, LinkedIn, or Mastodon, as of this posting, and with no emails sent on the matter.)
- mulakosag 5mo ago
  [dead]
- bulbar 5mo ago
  > Maybe they're ashamed and are trying to limit the visibility while only technically issuing an announcement. I think that's panic mode from some decision maker (i.e. head of marketing or head of security).
  - jurgenburgen 5mo ago
    It’s not like they have a choice as a public company. I wonder if this low visibility post meets SEC requirements though.
- bpodgursky 5mo ago
  [flagged]
  - blm126 5mo ago
    I’m not on X, so it’s good to know I don’t matter in tech. I always suspected. Since I’m a paying GitHub customer, though, I should probably matter to them. The right forum for GitHub to post this is with their status page, their blog, their website, or an email to all their customers. Using any sort of social media for this kind of thing is either incredibly sloppy or very intentionally quiet. Given that my tiny employer has a better incident communication plan than this, my guess is this an attempt to downplay things.
jandrewrogers 5mo ago
They should send messages directly to their customers as a first step in addition to posting an official article on their site. That’s the minimum. If they haven’t done that then it is hard to defend. Beyond that, Twitter is the de facto default dissemination vehicle, due to its reach. Even if people are not on Twitter, they are likely to see things from people that are on Twitter.
apublicfrog 5mo ago
It's been pretty common in the past for tech companies to announce outages and quick updates about them on twitter for decades. I'm sure their status page etc will be updated soon, but it's historically been the fastest way to get things out to the wider audience whilst bypassing the "official mail out" review by marketing etc.
- mcintyre1994 5mo ago
  I think that was a lot more justifiable when Twitter reliably let logged out users read tweets. X seem to tweak it all the time, or maybe it’s just broken a lot, but sometimes I can’t even load a tweet in a browser that isn’t logged in.
  - Chaosvex 5mo ago
    They broke it not too long before Musk bought it when they wanted to boost user numbers. It'll frequently display tweets from literal years ago as being the latest. It's why proxies/mirrors are often linked rather than Twitter itself. They don't seem to care to fix it, which implies that it's intentional. Seems completely stupid but what do I know?
- numpad0 5mo ago
  It doesn't show live profile pages to logged out users since a while ago. You get cached summary pages, an age gate error, or sometimes a straight up 404. Most individual permalinks (.com/username/1234...) don't work without logging in, either, and the official client now uses `/i/` in place of usernames for permalinks(bogus usernames always worked; pkey was the timestamp). This means an organizationally shared Twitter account for announcements is not a viable concept, at least until Twitter is to be transferred again to whoever would be a better keeper of it.
wutwutwat 5mo ago
watch it turn out to be that their twitter account is what was hacked, and github.com is actually fine
- smsm42 5mo ago
  Yes, and github having zero-nines reliability record is because of a hacked twitter account too! (sigh...)
fulafel 5mo ago
Even if it's a wingnut dense place, there's good arguments for using a channel independent of your infra in a case like this. You (or Github themselves) don't know if their status page is pwned.
hansmayer 5mo ago
I mean if you are going to use AI which was trained on code of statistically mediocre average at the best, have outages and major incidents every few days, why not go wild and start publishing incidents to twitter too? It checks out with the rest of the stuff.
bartread 5mo ago
I don't mind them using it as a channel per se (although the userbase isn't what it once was) but it certainly shouldn't be the only channel. For example: Twitter/X, along with Nitter mirrors like XCancel, are all blocked at the client I'm currently working with so although they can see this discussion, they're excluded from some of the most important details. (Like many former twitter users, I don't have an X account these days so I'm guessing wouldn't be able to see the full original thread - glad of XCancel, that's for sure.)

cebert 5mo ago

It’s a very popular messaging platform for tech enthusiasts.

yallpendantools 5mo ago
So? Is this where your corporate paying clients should find out about an issue of this severity? Not to mention Twitter is not an open platform anymore! (A) I'm an employee in an organization paying for Github. (B) I don't have a Twitter account. I already have a Github account because of (A). Why should (B) stop/delay me from getting official comms about this?
- insanitybit 5mo ago
  Isn't it the first stop for the USG at this point? I mean, I wish the world were a different place but here we are.
- zdragnar 5mo ago
  I can't imagine they'd spam every account with an email address, though an email to organization owners would make more sense.
  - yallpendantools 5mo ago
    > I can't imagine they'd spam every account with an email address It's not "spam" if it is relevant to me, such as security incident disclosures. Also, as tiffanyh pointed out, what's wrong with Github blog or is that exclusively for marketing fluff now? That would've been appropriate enough, without having to spend Sendgrid credits.
  - bulbar 5mo ago
    Mailing every (potentially) affected entity is common and good practice for major incidents.
ignu 5mo ago
also a very popular messaging platform for [redacted] enthusiasts
- deleted 5mo ago
  [deleted]
- sph 5mo ago
  The only metric that matters when choosing a platform to broadcast announcements is ‘very popular’.

niyikiza 5mo ago

Probably the best option after sending a mass email when customers need to take action. The status page is for reliability issues impacting end users & the blog is for in-depth analysis.

lynndotpy 5mo ago

It's certainly not the right platform. It'd be one thing if they had any official communication on the matter anywhere else. Maybe they're ashamed and are trying to limit the visibility while only technically issuing an announcement. They announced this exclusively on X.com, which ranks barely above Pinterest in terms of usage. That's below Reddit, Snapchat, WeChat, and Instagram, and requires a user account to view profiles and posts. And that's ignoring all the reasons X is a divisive platform with an extreme political bent. GitHub chose not to announce this on any other social media either (BlueSky, Facebook, TikTok, YouTube, LinkedIn, or Mastodon, as of this posting, and with no emails sent on the matter.)

mulakosag 5mo ago
[dead]
bulbar 5mo ago
> Maybe they're ashamed and are trying to limit the visibility while only technically issuing an announcement. I think that's panic mode from some decision maker (i.e. head of marketing or head of security).
- jurgenburgen 5mo ago
  It’s not like they have a choice as a public company. I wonder if this low visibility post meets SEC requirements though.
bpodgursky 5mo ago
[flagged]
- blm126 5mo ago
  I’m not on X, so it’s good to know I don’t matter in tech. I always suspected. Since I’m a paying GitHub customer, though, I should probably matter to them. The right forum for GitHub to post this is with their status page, their blog, their website, or an email to all their customers. Using any sort of social media for this kind of thing is either incredibly sloppy or very intentionally quiet. Given that my tiny employer has a better incident communication plan than this, my guess is this an attempt to downplay things.

jandrewrogers 5mo ago

They should send messages directly to their customers as a first step in addition to posting an official article on their site. That’s the minimum. If they haven’t done that then it is hard to defend. Beyond that, Twitter is the de facto default dissemination vehicle, due to its reach. Even if people are not on Twitter, they are likely to see things from people that are on Twitter.

apublicfrog 5mo ago

It's been pretty common in the past for tech companies to announce outages and quick updates about them on twitter for decades. I'm sure their status page etc will be updated soon, but it's historically been the fastest way to get things out to the wider audience whilst bypassing the "official mail out" review by marketing etc.

mcintyre1994 5mo ago
I think that was a lot more justifiable when Twitter reliably let logged out users read tweets. X seem to tweak it all the time, or maybe it’s just broken a lot, but sometimes I can’t even load a tweet in a browser that isn’t logged in.
- Chaosvex 5mo ago
  They broke it not too long before Musk bought it when they wanted to boost user numbers. It'll frequently display tweets from literal years ago as being the latest. It's why proxies/mirrors are often linked rather than Twitter itself. They don't seem to care to fix it, which implies that it's intentional. Seems completely stupid but what do I know?
numpad0 5mo ago
It doesn't show live profile pages to logged out users since a while ago. You get cached summary pages, an age gate error, or sometimes a straight up 404. Most individual permalinks (.com/username/1234...) don't work without logging in, either, and the official client now uses `/i/` in place of usernames for permalinks(bogus usernames always worked; pkey was the timestamp). This means an organizationally shared Twitter account for announcements is not a viable concept, at least until Twitter is to be transferred again to whoever would be a better keeper of it.

wutwutwat 5mo ago

watch it turn out to be that their twitter account is what was hacked, and github.com is actually fine

smsm42 5mo ago
Yes, and github having zero-nines reliability record is because of a hacked twitter account too! (sigh...)

fulafel 5mo ago

Even if it's a wingnut dense place, there's good arguments for using a channel independent of your infra in a case like this. You (or Github themselves) don't know if their status page is pwned.

hansmayer 5mo ago

I mean if you are going to use AI which was trained on code of statistically mediocre average at the best, have outages and major incidents every few days, why not go wild and start publishing incidents to twitter too? It checks out with the rest of the stuff.

bartread 5mo ago

I don't mind them using it as a channel per se (although the userbase isn't what it once was) but it certainly shouldn't be the only channel. For example: Twitter/X, along with Nitter mirrors like XCancel, are all blocked at the client I'm currently working with so although they can see this discussion, they're excluded from some of the most important details. (Like many former twitter users, I don't have an X account these days so I'm guessing wouldn't be able to see the full original thread - glad of XCancel, that's for sure.)