Hawaii missile alert standdown delayed by forgotten log-in
bbc.com
bbc.com
Kind of floored that twitter is what the government has to use to put a notification out to it's public to provide critical information.
But then I continued to read and the article goes on to say that twitter and other social media was used by the Governor after the emergency text message was sent out, which means it obviously isn't a primary source of information.
So actually it's just clickbait journalism. Anyone panicking in the area would have almost certainly picked up a text before getting anything over twitter.
What is pretty terrible is that the governor of Hawaii most likely doesn't have 2FA on his twitter account and keeps the password on his phone, probably in a notes app of some kind, and is willing to publicly admit that.
There was a quake here in Jakarta and the resulting hug of death took the governments site offline briefly - but their twitter account was fine. It worked as a great CDN!
Semi-related - when everyone evacuated their office blocks and stood on the road it flooded the cell towers making internet browsing impossible. But whatsapp continued to connect intermittently making it relatively fine to use.
Not saying these types of channels should be used in place of the actual emergency protocols in the phone network. But no harm broadcasting if you can keep them secure.
You can't rely on private companies, especially with foreign investors to provide critical infrastructure.
I'm really doubting any government infrastructure these days.
When vendors can sell crap like weblogic to an org that really only needs an easy to update static site; and the taxpayer ends up on the hook for it.
There are efforts in progress to fix things https://www.usds.gov/ but they are slow and prone to being sabotaged by the aforementioned vendors.
Its a great way to stay out of responsibility as a security consultant or admin. Always trust for the users to poke the biggest hole, so you have something to point to when the water floats the ship.
Twitter has spent billions to deploy a worldwide network that people engage with to communicate short status updates. They also have the content, and scale to have a large percentage of the population actually familiar with how to use their tool.
To get an equivalent reach and scale and level of familiarity with a government run tool would be a $100 billion project doomed to fail.
Should Twitter be the only way that government reaches the population to deliver critical updates? Of course not, but it absolutely must be one of the primary ways, and in many cases because the system design of Twitter is so much better, it will be the channel with the most accurate and up-to-date data.
I mean the best part of that is then Homeland can designate Twitter as “critical national infrastructure” and put their agents in the data centers! </s>
This morning I awoke to a map of my block covered in blue saying a warning had started 20 minutes ago, in a Facebook post from a foodie. I like to think those friendly warning sirens that blare at noon would tell me something, to begin with. Then those loud alerts that go to my phone no matter how many times I disable the setting. Then maybe text blast, granted I don't know all the ones I should be on. I just had a needless bpm added to my heart rate.
All notifications are disabled on my mobile except calls; much as people depend on them I won't let myself. Two days of disaster and everyone's battery is dead, along with ability to search the web for life skills and claim to have invented fire. Tangent, but for the doubters, I inspect routes before I drive and know my way around blind after just a few thousand miles in the city over 4 years (typical commuter is 10k/yr+). And literally nobody of consequence has complained about responding to things a few times per day in batches (around lunch, late afternoon/5).
People think I'm too intense, actually I think they're just addicts with no attention span. So one can see why I don't want to turn on Notifs for an advertising network in case there's something urgent. Oh hey, false alarm, buy some stuff and surrender some power... [just click here :D]
Maybe it's important not to let any career exist that exercises its capabilities so infrequently. For example, firefighters train for massive disasters that rarely occur, but they more regularly fight smaller fires, and even more regularly respond to other problems like traffic accidents. So they are deployed on a very regular basis. Contrast that with the Minuteman missile teams who, I hope, have never ever fulfilled their role in actuality. Does this make them less effective?
Also makes me think about military efficacy. You can either go to war a lot, or find other ways to practice your skills. Which is why disaster response seems like such a natural fit for military.
In the digital sphere we have the same issue. There is a whole heap of data out there, but much of it is under threat of being lost, because it only exists on a hard drive we have lost the technology to read, unless we rebuild it (but we've also forgotten how to do that). If the platters decay without that data being copied, it's lost forever.
Just as the military knows, with its constant drilling, the same is true of human behaviours too. Repetition is the key to everything we know, and everything we do. Knowledge and behaviours that aren't repeated will be lost.
edit: I guess my point is that the word is not getting out about good password practices.
Also, in my experience, you're not allowed to use one at work, so what do you think people do?