Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies

Re:Ex-Twitter exec blows the whistle, alleging reckless cybe... by bink on Tuesday August 23, 2022 @02:07PM (#32568763)

I agree with everything you said, but I'd like to play devil's advocate here. Mudge has worked:

  * L0pht / @stake: security research, red teaming, and source code auditing, IIRC.
  * BBN: research.
  * NFR: technical advisory board.
  * DARPA: Managing a program that provided grants for new security products and tools.
  * Google ATAP: Google's "invention studio".
  * CyberUL: Testing of security products.

None of these jobs really suggest a background in building a security program. I've worked with some large companies in a similar space to Twitter building their security programs and you can spend the first 6-12 months just trying to justify the new budget. Often that money has to come from another team or teams and he would have to justify that. He was apparently only there roughly a year.

Again, I don't doubt Mudge's bonafides. I don't doubt his security knowledge. But this job was nothing like any he's had in the past.

I also don't doubt his claims. Everything he's stated is almost certainly true. It does take more than a year to fix most of these problems and I wonder if he just got frustrated with the political battles that occur in these situations.

[ Parent | on HN ]

Re:Ex-Twitter exec blows the whistle, alleging reckless cybe... by michaelt on Tuesday August 23, 2022 @05:42PM (#32571957)

Well, you can devils-advocate anyone into an incompetent.

Decades of experience as a rebellious hacker? Well, that's not commercial experience. Founded a security consultancy? Too small, they just don't know how to operate in a large bureaucracy. Worked at a secretive company as an individual contributor? They've been completely silent in public, clearly they haven't achieved anything interesting in years. Working elsewhere as an individual contributor? They just don't know how to build a team. Decades as a senior manager at a huge multinational corporation? Out of touch bullshitter, stale coding skills, doesn't know how we really do things these days.

[ Parent | on HN ]

Re:Ex-Twitter exec blows the whistle, alleging reckless cybe... by mthomasmw on Tuesday August 23, 2022 @03:05PM (#32569701)

You left out that he built the security program at Stripe.

[ Parent | on HN ]

Re:Ex-Twitter exec blows the whistle, alleging reckless cybe... by spudlyo on Tuesday August 23, 2022 @04:25PM (#32570982)

He led the Security team at Stripe for a time, but it was a functioning team before he arrived.

[ Parent | on HN ]