Twitter Says Parts of Its Source Code Were Leaked Online | Hacker News Reader

Twitter Says Parts of Its Source Code Were Leaked Online

nytimes.com

104 pointstysone27 comments

I've got to admit I get a kick out of the fact that the GitHub username was "FreeSpeechEnthusiast" https://github.com/github/dmca/blame/master/2023/03/2023-03-...

> One concern is that the code includes security vulnerabilities

I find this kind of funny, because open source is typically viewed as a benefit as far as security is concerned.

Given how few engineers remain at Twitter, they probably ought to open source their code and allow outsiders to find and fix security vulnerabilities, freeing up Twitter engineers to figure out how in the world to generate revenue for the service.

For client code sure. Not server code that protects user data that could be exploited with a 0-day exploit.

Linux is open source. PHP is open source. Mastodon is open source.

Ruby on Rails, WordPress, ssh. I'm sure I'm forgetting a bunch of things too.

Right. Now go work for a f500. Ask if you can post your source code on GitHub to improve security? There isn’t some magic thing that posting your source does, except in the short term make 0 days 10000x easier.

Doesn't seem to stop Microsoft, IBM, Chase, and others.

Please share the Windows or Xbox Live source code.

Or the Chase bank web code.

Or the Chase bank backend processing code.

Or the Chase bank fraud protection code.

Code that's intentionally open source tends to have better security long-term. Proprietary code that was accidentally leaked is pretty bad for security in the short term.

> and allow outsiders to find and fix security vulnerabilities, freeing up Twitter engineers to figure out how

...to boost Musk's tweets.

"It was unclear how long the leaked code had been online, but it appeared to have been public for at least several months."

Interesting. I wonder what the repo was called, I imagine it couldn't have been anything extremely obvious or we would have heard about this earlier.

Yahoo!'s cache still has a cache of the page: https://cc.bingj.com/cache.aspx?q=https%3a%2f%2fgithub.com%2...

It wasn't obliviously named at all. The toplevel folders were:

- adp

- ann

- auth

- aws-dal-reg-svc

The README.md file just said "PublicSpace"

And the breakdown of languages used is odd for twitter: - Scala 56.2%

- Java 27.3%

- Python 7.9%

- Starlark 4.7%

- Shell 2.4%

- Thrift 1.2%

- Other 0.3%

Appears their user account was created on Jan 3, 2023, so unless it was somewhere else too, it's not exactly "several" months

Either the cache entry has expired or (if "bingj.com" is associated with the Bing) I can easily imagine someone in Microsoft "helped" it along

I'll save you the trouble: Wayback only has the DMCA notice since the snapshot was taken today

Isn't the code terrible anyway? Doesn't Musk want to open source stuff anyway?

Is an anonymous user on Github protected from Twitter learning their actual identity?

I would think their identity is as subject to subpoena as any anon user at any social media service.

From the article:

> Twitter also asked the U.S. District Court for the Northern District of California to order GitHub to identify the person who shared the code and any other individuals who downloaded it, according to the filing.

I wonder if GitHub could be compelled to turn over ever IP that did a git clone?

I wonder if twitter can be compelled to show how they manipulated the website to promote elon tweets /s

https://www.theverge.com/2023/2/14/23600358/elon-musk-tweets...

Not in legal discovery.

This certainly could be uncomfortable for Musk.

He'll just use it as more evidence that the people he laid off deserved to be laid off.

Laid off would imply that they could be rehired at some point... let's just call it what it is... mass firings.

These terms have accepted meanings and I looked it up just to be sure.

"Being fired means that the company ended your employment for reasons specific to you. Getting laid off means that the company eliminated your position for strategic or financial reasons and not through any fault of yours."

It's somewhat a generational thing.

"Laid off" didn't really come into common use until the late 80's and early 90's when companies started caring about the PR hit from firing lots of people all at once. Think steel companies and car companies and coal mining companies.

Before that, you got "fired" whether it was your fault, or not. If you were lucky, you company specified you were "fired without cause," but that wasn't always expected.

In the 70's, my mother lost her job when an entire hotel was closed down. She wasn't "laid off." She was "fired." Although she called it "shit-canned."

I recently came across another term for it that they used in the 1940's, before "fired," but I can't remember it right now.

Are you saying that when “laid off” began being used 30-40 years ago it implied you’d be rehired? Because that’s the claim being made above about the current meaning of the term.

Edit: Wikipedia agrees that this is a generational difference and the term laid off used to imply it was temporary. Today I learned…

https://en.m.wikipedia.org/wiki/Layoff

That is correct.

"Laid off" meant you could collect unemployment for a while, and might be called back when conditions changed.

Like how coal miners would be "laid off" when the price of coal went down, but be called back when the price went back up.

That is not what the terms mean. Firing implies let go for cause and laid off implies it wasn’t for cause. Being laid off doesn’t imply you could be rehired, perhaps you are thinking of the term “furloughed”.

Reply on news.ycombinator.com