> "It's not far fetched to say an employee inside the company could take over the accounts of all the Senators in this room," @dotMudge with a warning here on Captiol Hill. #Twitter
perhaps a valid reason?
We've had that at places I've worked. Where you'd be able to impersonate a user in order to see what was going on with their specific set of user data to corroborate their report and find a fix.
The question is... are the permissions locked down, is access audited and immutable, etc I think.
You don't really own a Twitter (or Facebook, or ycombinator) account. Those services have an account on you. You update their account on you when you use their service to post (and they keep other information useful to their business on your account that you have no access to).
This is just the way social media works.
Most companies the size of Twitter would have a lot more controls than that on random employees' write access to production.
If I want to assume a user's identity in my employer's production system I have to fill out a form justifying it, get my manager's approval for each account accessed, and my activity is subject to logging.
...on the other hand, https://en.wikipedia.org/wiki/2020_Twitter_account_hijacking
First it was "inadvertently deactivated due to human error by a Twitter employee." Then "Through our investigation we have learned that this was done by a Twitter customer support employee who did this on the employee’s last day."
It was kinda funny but you would expect that they would learn and improve from it.
Edit: Thank you siblings for showing that it has continued to happen. Obviously not lesson not learnt.
That's why I specifically said "from a naive standpoint." I'm not arguing against valid reasons, I'm pointing out how absurd the situation is.
From my comment:
> I understand that there are consequences of Mudge's information
It's not far fetched to say a the line cook at a Senator's restaurant could poison their food.
It's not far fetched to say that a Senator's financial advisor could run off with their money.
It's not far fetched to say the teachers who instruct a Senator's kids could fill their heads with lies.
Humans have all sorts of ways to wreak destruction on one another but it mostly doesn't happen, and when it does, we have many, many systems in place to detect and punish. And we tend to scale the weight of these systems to the size of the perceived threat - that's why doctors and pilots are more burdened than bankers who are more burdened than cooks.
How likely is someone to actually take over these accounts (what's to gain)? How much damage would it do (not too much, people get hacked on Twitter all the time and that's baked in to the credulity of each tweet)? How likely is that employee to get caught (high), and how much punishment would they face (huge fines, possible jail time, unemployable in many industries for the rest of their lives).
Technical safeguards are not our only safeguards, especially for insider threats, which long predate the Internet. External hackers do dramatically change the calculus here (unlikely to get caught or punished) but that's not what's being alleged.
Technical safeguards against insider threats protect your insiders. They give your insiders cover in situations where they might be coerced to do things.
When I was at G, I likely could have read some data from cloud customers with some social engineering and the permissions I had. It would have taken hours to get the first byte, and I would have been fired within 10 minutes if I did without a good reason. The fact that it would have taken hours and some social engineering would let me plausibly tell the police (or the Chinese government or the mob or anyone else), "no, I don't have access to that data." Twitter's engineers didn't have that cover.
I'd slightly disagree that technical safeguards don't provide any protection against insider attacks. But yes, the deterrent effect of having a high chance of being caught is very effective.
High-growth companies prefer to prioritize features and kick the access control can down the lane until they absolutely have to. Without looking at revenue and employee numbers, I suspect 2010 Google and 2016-ish Uber are comparable to current Twitter, IMO.
Edit: the Googler story is far worse that I remembered: he had unfettered access to underaged victims' mailboxes, chat logs, contacts and Voice accounts and used that information to taunt one victim, and unblocked himself from another victim who had blocked him on Gchat - Google only became aware of it when it was reported externally.
1. https://www.businessinsider.com/google-engineer-stalked-teen...
Aviation has the state imposing licensing requirements, the state certifying which vehicles can take passengers, the state imposing technical requirements like transponders, the state investigating accidents, the state telling pilots when they can take off and land, the state searching passengers' luggage and sending them shuffling through scanners without their shoes, the state establishing no-fly lists, and the state wading into the industry and choosing winners and losers whenever it's geopolically convenient.
If you tell the senate you'd like the tech industry to be regulated no more heavily than the aviation industry we'd be in for a lot more regulation.
We kind of have answers to these questions already:
- A rogue employee/contractor deactivated Trump's account back in 2017 https://www.theguardian.com/technology/2017/nov/03/experts-w...
- "130 high-profile Twitter accounts [including Apple, Barack Obama, Joe Biden, and Bill Gates] were compromised by outside parties to promote a bitcoin scam" using internal Twitter admin tools. https://en.wikipedia.org/wiki/2020_Twitter_account_hijacking
The impact of both of these was basically zero.
Nobody's account is safe. Doesn't matter what 2FA methods you use, whether you're verified or not, how many followers you have, all it takes is a couple grand for someone else to take it over.
> The impact of both of these was basically zero.
Per the Wikipedia article you linked, the attackers got $110k in Bitcoin, which is not "basically zero" (even if the price of BTC has fallen since then).
[0]: https://www.web3isgoinggreat.com/?id=researcher-zachxbt-alle...
Just as I tuned in, Mudge was talking about how Twitter repeatedly mismanaged peoples emails, citing that if they didn't sell emails, their competitors would get an unfair advantage.
The same is true of Facebook and Google.
Foreign agents still running amok after an FBI warning: WTF?!
Just people huh? Not the Presidents, politicians, richest business men and high profile journalists right? To say nothing of all the other niche communities like finance and tech.
Perhaps a less dismissive characterization of Twitter would help make it less bizarre?
It's a platform used by many leading public figures, including US presidents, to share information and the 280 character limit is a format that often leads to less filtered communication than you'd get in other mediums.
Social media has become extremely important to the free and open exchange of ideas between people.
Then what is the threshold wherein the natural inability to avoid bias becomes propaganda? Why is Twitter propaganda but not HN or my blog? When does it cross the line?
You're trying to come up with hard distinctions and categories, when trying to do so is totally uninteresting and without any utility. I notice it's extremely common here on HN[2], perhaps because the job of an engineer involves working with categories, and something that's linguistically fuzzy is uncomfortable to them. I write more about this cognitive failing in the second half of my post here[3].
In short, there is no objective threshold wherein the natural inability to avoid bias becomes propaganda. And nor should we waste time on that point. Such a discussion is merely semantics around the definition of the word "propaganda". We should leave that to the people who compile dictionaries.
Such clouded thinking has created a blind spot here in this very thread, e.g. that someone can say something so ridiculous as "How is that different than literally every other website or publication on earth?" and not get downvoted, as if the practical difference between a social media platform with access to hundreds of millions of eyeballs on the one hand, and a small blog on the other, is not self-evident. Such an obvious difference can only not be self-evident to someone who is incapable of understanding that things can vary by degree instead of by category.
[1] https://www.psychologicalscience.org/news/releases/binary-bi...
I'm sorry, but I'm asking how and why the number of people suddenly flips the switch to propaganda and all I'm seeing is a flippant dismissal from you.
It's my stance that it is not the number of people who see it that dictates that it's propaganda, and that the definition supplied fails to meet any real criteria for propaganda.
This isn't a binary bias, I'm not asking "is it or is it not?" I'm asking someone _why_ they think it's propaganda.
I find your response reductionist, and the appeal for downvotes snarky. I'll let citations of your own comments stand on its own merit.
It is a matter of degree, but you keep insisting it's a matter of category.
If the CCP uses networks of bots to amplify pro-CCP stories and viewpoints on Twitter, then that's "different" (to answer your original question) in an extremely important way to if someone pushed those views on their own small blog. It's different because the scale and impact is different.
Also, both of those things belong, to some extent, to the category of "propaganda network capable of controlling the narrative". But one belongs to it more, and one is more of an issue, because the world isn't binary.
No, you added the second part. That could indeed bolster the argument, but it wasn't made in the initial claim.
If scope is the tipping point - which appears to be your argument here with regard to degree - recall my initial question was about the threshold. Which is conveniently what you're saying we should ignore because it's unimportant. So which is it?
I contend that one of the core tenets of "propaganda" is that there needs to be a deliberate and centralized. It's easy to call something propaganda but it's much harder to defend that claim.
Also, when we say degree, we don't mean the degree to which the definition fits. That's a boring discussion. We simply mean the degree to which it's a problem.
Twitter, to the extent that it's being used as a propaganda network by CCP bots, which it is, is a big problem for us.
A small blog being used for propaganda... not such a big problem.
That's the difference that you're missing. The scale and scope is different. Therefore the extent to which they're important is different.
Quite the opposite. I've asked about degree the entire time. "Opinion" does not mean the same thing as "Propaganda," but the scale of the former could transform it into the latter.
What's the degree here? That's what I'm asking.
> That's a boring discussion.
This is dismissive. If you want to discuss things in good faith, please avoid language like this. You're refusing to engage with an aspect of my reply - and that's fine - but don't pretend my thought are meaningless or boring as a response.
I'm ending this convo here. It's become a tedious debate about semantics and nothing productive is being achieved.
You could use a multi-prong test like they do for determining whether an entity constitutes a monopoly.
Or you could use the old Justice Stewart's test for obscenity..."I know it when I see it."
But given what we've learned of late about the government influencing social media sites to censor citizens on their platforms, I don't think there's a legitimate argument that certain social media sites are not different from the general internet.
None of Twitter/FB/Youtube has that kind of correlation
Most of the "real time" aspect of Twitter is a reaction to something, often publications themselves.
I can't think of a better word. Suggestions?
And then you stop and realize that the user numbers on Twitter are DWARFED by Facebook (and Instagram and TikTok), and you realize just how screwed we really are.
And all for the sake of making some people insanely rich, by flooding every aspect of our lives with advertising.
We've accepted emotional, mental, spiritual, and physical (to some extent) abstractions of ourselves as our true selves. And exchanged social cues for algorithms to manipulate our behaviors.
In the moments when you can break out of that abstraction the parody becomes so clear, and also terrifying. Like what are we actually building towards?
If you instead say “international information system responsible for sending 500m messages daily including by senior govt/business officials has poor stewardship” I think it doesn’t seem so rediculous that senior government officials are so concerned. They all use Twitter, why wouldn’t they be concerned? You could easily cause militarily significant damage to a country with a good hack against twitter.
There was a very politically significant insurrection organized on twitter, this system has already been used to direct an angry mob in the general direction of these high level government officials who proceeded to attempt to break down barricades and assault them.
Shedding light on an (unfortunately very) influential company is good for the public.
Musk shouldn't get out of his deal, but whatever he does to reveal malpractice at Twitter is good for all of us.