Hacker News Reader

Comment by caeril | Hacker News Reader

> And there was no way to find out who accessed what. This is not normal, it's a huge red flag

One can argue that it shouldn't be normal, but I assure you that it is extremely normal in most companies. Shared root credentials, no audit logs, or audit logs that you have to grep on individual hosts - these are VERY VERY normal across business.

View on HN

It most likely shouldn't be normal in a company which is used for serious (as in, related to countries' relations or even wars in extreme cases) politics, no matter whether its founders wanted it or not.

It wouldn't be probably an exaggeration to say that ability to post a tweet in someone's name, or ability to see private DMs can have financial effects (scams, frauds of big proportions), or in extreme, yet not unthinkable, circumstances lead to loss of health or life (war, terrorism).

Normal is probably the wrong word. It’s expected for smaller or less resourced orgs to have immature security and data/access governance programs. But a public company such as Twitter (who has to adhere to Sarbanes Oxley and other regulatory frameworks that drive access control and RBAC)? Not so much.

They certainly exist, and I've worked at a few. They were all smaller organisations. I've seen medium sized companies wrestle with it a bit. No large organisation I've worked for had rampant prod access.

Which I guess is why it surprises me that Twitter still operates like that.

Reply on news.ycombinator.com