Hacker News Reader

> He could also alter the twitter code to display anything he wanted to twitter users.

Maybe, maybe not, depending on the web server's permissions. Also it seems to be a subdomain which may not have the main twitter code.

It's still pretty bad and embarrassing.

> Maybe, maybe not, depending on the web server's permissions. Also it seems to be a subdomain which may not have the main twitter code.

Subdomains can run on the same server. Also, the code is uninteresting, data usually is.

Also, higher permissions are just one OS exploit away. As with many exploits, it's a stepping stone, but a big one. The combination matters.