Hacker News Reader

Comment by badwolf | Hacker News Reader

It seems Musk's new legal "department" is wanting developers to self-certify - put their own name on the certification.

https://www.theverge.com/2022/11/10/23451198/twitter-ftc-elo...

Looking at how complex Twitter's internal systems appear to be based on Mudge's report [1], I doubt informed developers would dare certify things they do not fully understand. Depends a bit on what entity (system, service, environment) they have to certify.

> In January 2022, Mudge determined and reported to the executive team that (because of poor engineering architecture decisions that preceded Mudge's employment) Twitter had over 300 corporate systems and upwards of 10,000 services that might still be affected, but Twitter was unable to thoroughly assess its exposure to Log4j and did not have capacity, if pressed in a formal investigation, to show to the FTC that the company had properly remediated the problem.

> Mudge knew that the actual underlying data showed that at the end of 2021, 51 % of the ~ 11 thousand full-time employees had privileged access to Twitter's production systems, a 5% increase from the 46% of total employees in February of 2021 that Mudge had shared in his initial findings delivered to the Board in early 2021

1. https://techpolicy.press/wp-content/uploads/2022/08/whistleb...

To be clear, the FTC is more than happy to pursue criminal charges against individuals when they screw with users.

The (former) CSO of Uber, Joseph Sullivan, is now a felon because of a 2016 hack of Uber and his attempts to cover up the hack.

Joe is looking at a potential of 5 years in a federal prison, where there is no time off for good behavior and the like. In the Fed, you serve the whole sentence (some caveats do apply). He'll also loose the right to vote and hold public office, employment rights, domestic rights, and financial and contractual rights, plus a lot of 'probationary' issues. This will follow him for the rest of his life, likely.

https://www.justice.gov/usao-ndca/pr/former-chief-security-o...

Wow, if that means that the engineer is personally responsible that Twitter follows the FTC rules, then RIP the engineers. I would just stop writing code at that point. No compensation worth that risk.

And it opens up interesting questions. If I decline to implement something then can the company fire me at all? Or do they have to prove first that what has been asked does not goes against FTC rules.

This is just another way to materially change the job position to force people to quit.

I would also be shocked if the FTC accepted a certification from anyone that is not qualified and does not have the appropriate support system in place to certify.

Reply on news.ycombinator.com