<story><title>Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies</title><url>https://www.cnn.com/2022/08/23/tech/twitter-whistleblower-peiter-zatko-security/index.html</url></story><parent_chain><item><author>purpleblue</author><text>Millenials and GenZ may have no idea who Mudge is. I, however, almost lost my first job out of college at a bank because I ran l0phtcrack against our Windows NT 4 server to see if it could crack passwords. I showed my boss, and he pulled me aside into another room and tore my head off for irresponsibly running this tool against a production server. He said I could have been fired if this got out, but he covered my ass, sent out an email requesting everyone reset their passwords, and let me continue working. I learned a good lesson because even though my intentions were good, and it did expose security issues, it was a bit immature and should have been done in a more controlled manner along with the proper clearances.&lt;p&gt;Mudge knows the implications of &amp;quot;whistleblowing&amp;quot;. He has been a security consultant and even testified to Congress. He&amp;#x27;s not some noob that doesn&amp;#x27;t understand security or how systems work together to provide services like disclosure to FTC. The idea that Twitter PR can pooh-pooh away his concerns is shockingly stupid.&lt;p&gt;I think Twitter is in real trouble here.</text></item></parent_chain><comment><author>zeruch</author><text>I met Mudge once in my career early on (I was at VA Linux systems circa 1999ish) and I found him intense, an apex intellect, but absolutely affable and self-aware.&lt;p&gt;He never struck me then, or in any interview or write up since, that he&amp;#x27;s impulsive, or prone to taking actions like what he&amp;#x27;s done to Twitter, in a cavalier way.  He saw something bad and thinks something should be done to address it.&lt;p&gt;He likely made that decision because the culture at Twitter is as bolloxed as he states (maybe worse), and that it&amp;#x27;s one thing to fire a guy, but to do so to hide damning truths, and expect that person to just accept their fate AND let you get away with it without a cost is in this day and age, a farcical hope. Your &amp;quot;Mudge knows the implications of &amp;quot;whistleblowing&amp;quot;. He has been a security consultant and even testified to Congress. He&amp;#x27;s not some noob that doesn&amp;#x27;t understand security or how systems work together to provide services like disclosure to FTC. The idea that Twitter PR can pooh-pooh away his concerns is shockingly stupid.&amp;quot;  is spot-on.</text></comment>
<story><title>Ex-Twitter exec blows the whistle, alleging reckless cybersecurity policies</title><url>https://www.cnn.com/2022/08/23/tech/twitter-whistleblower-peiter-zatko-security/index.html</url></story><parent_chain><item><author>purpleblue</author><text>Millenials and GenZ may have no idea who Mudge is. I, however, almost lost my first job out of college at a bank because I ran l0phtcrack against our Windows NT 4 server to see if it could crack passwords. I showed my boss, and he pulled me aside into another room and tore my head off for irresponsibly running this tool against a production server. He said I could have been fired if this got out, but he covered my ass, sent out an email requesting everyone reset their passwords, and let me continue working. I learned a good lesson because even though my intentions were good, and it did expose security issues, it was a bit immature and should have been done in a more controlled manner along with the proper clearances.&lt;p&gt;Mudge knows the implications of &amp;quot;whistleblowing&amp;quot;. He has been a security consultant and even testified to Congress. He&amp;#x27;s not some noob that doesn&amp;#x27;t understand security or how systems work together to provide services like disclosure to FTC. The idea that Twitter PR can pooh-pooh away his concerns is shockingly stupid.&lt;p&gt;I think Twitter is in real trouble here.</text></item></parent_chain><comment><author>shagie</author><text>I think it was &amp;#x27;96?  I was working at Taos Mountain at the time.  At that time, Taos had a reasonably close relation to Randal Schwartz ( &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.oreilly.com&amp;#x2F;library&amp;#x2F;view&amp;#x2F;learning-perl-6th&amp;#x2F;9781449311063&amp;#x2F;pr02.html&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.oreilly.com&amp;#x2F;library&amp;#x2F;view&amp;#x2F;learning-perl-6th&amp;#x2F;97814...&lt;/a&gt; ) and he gave a talk for contractors which was titled &amp;quot;Just Another (convicted) Perl Hacker&amp;quot;.&lt;p&gt;In that talk he told of his time at Intel and running crack on a shiny new sparc and all the problems that caused.&lt;p&gt;The focus of it was a &amp;quot;how not to get into trouble as a contractor&amp;quot;.&lt;p&gt;Somewhere, I&amp;#x27;ve still got my pink camel book with duct taped edges (for durability) with his signature on the inside title page.</text></comment>