<story><title>Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies</title><url>https://www.cnn.com/2022/08/23/tech/twitter-whistleblower-peiter-zatko-security/index.html</url></story><parent_chain><item><author>purpleblue</author><text>Millenials and GenZ may have no idea who Mudge is. I, however, almost lost my first job out of college at a bank because I ran l0phtcrack against our Windows NT 4 server to see if it could crack passwords. I showed my boss, and he pulled me aside into another room and tore my head off for irresponsibly running this tool against a production server. He said I could have been fired if this got out, but he covered my ass, sent out an email requesting everyone reset their passwords, and let me continue working. I learned a good lesson because even though my intentions were good, and it did expose security issues, it was a bit immature and should have been done in a more controlled manner along with the proper clearances.&lt;p&gt;Mudge knows the implications of &amp;quot;whistleblowing&amp;quot;. He has been a security consultant and even testified to Congress. He&amp;#x27;s not some noob that doesn&amp;#x27;t understand security or how systems work together to provide services like disclosure to FTC. The idea that Twitter PR can pooh-pooh away his concerns is shockingly stupid.&lt;p&gt;I think Twitter is in real trouble here.</text></item></parent_chain><comment><author>zeruch</author><text>I met Mudge once in my career early on (I was at VA Linux systems circa 1999ish) and I found him intense, an apex intellect, but absolutely affable and self-aware.&lt;p&gt;He never struck me then, or in any interview or write up since, that he&amp;#x27;s impulsive, or prone to taking actions like what he&amp;#x27;s done to Twitter, in a cavalier way.  He saw something bad and thinks something should be done to address it.&lt;p&gt;He likely made that decision because the culture at Twitter is as bolloxed as he states (maybe worse), and that it&amp;#x27;s one thing to fire a guy, but to do so to hide damning truths, and expect that person to just accept their fate AND let you get away with it without a cost is in this day and age, a farcical hope. Your &amp;quot;Mudge knows the implications of &amp;quot;whistleblowing&amp;quot;. He has been a security consultant and even testified to Congress. He&amp;#x27;s not some noob that doesn&amp;#x27;t understand security or how systems work together to provide services like disclosure to FTC. The idea that Twitter PR can pooh-pooh away his concerns is shockingly stupid.&amp;quot;  is spot-on.</text></comment>
<story><title>Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies</title><url>https://www.cnn.com/2022/08/23/tech/twitter-whistleblower-peiter-zatko-security/index.html</url></story><parent_chain><item><author>purpleblue</author><text>Millenials and GenZ may have no idea who Mudge is. I, however, almost lost my first job out of college at a bank because I ran l0phtcrack against our Windows NT 4 server to see if it could crack passwords. I showed my boss, and he pulled me aside into another room and tore my head off for irresponsibly running this tool against a production server. He said I could have been fired if this got out, but he covered my ass, sent out an email requesting everyone reset their passwords, and let me continue working. I learned a good lesson because even though my intentions were good, and it did expose security issues, it was a bit immature and should have been done in a more controlled manner along with the proper clearances.&lt;p&gt;Mudge knows the implications of &amp;quot;whistleblowing&amp;quot;. He has been a security consultant and even testified to Congress. He&amp;#x27;s not some noob that doesn&amp;#x27;t understand security or how systems work together to provide services like disclosure to FTC. The idea that Twitter PR can pooh-pooh away his concerns is shockingly stupid.&lt;p&gt;I think Twitter is in real trouble here.</text></item></parent_chain><comment><author>dogman144</author><text>I agree.  I grant It’s possible Mudge is&lt;p&gt;A) an old hand and doesn’t know how to run a security program with the tech today&lt;p&gt;B) a strong tech hire who can’t lead a program.&lt;p&gt;But Mudge is still… Mudge, and he’s also proven his ability to collaborate so if he was a bull in a china shop a twitter, that would be surprising.&lt;p&gt;There’s also a broader trend here of well known security leads that originate from that time working at social media and leaving quickly, like Alex Stamos, who also u-turned out of Facebook.&lt;p&gt;So are the odds higher that Mudge did a bad job, or this set of companies are not great internally and old guard security leads are pointing it out? The twitter CEO letter framing him as a bad employee doesn’t address this context.</text></comment>