Hacker News Reader

Comment by chipgap98 | Hacker News Reader

> The company also lacks sufficient redundancies and procedures to restart or recover from data center crashes, Zatko's disclosure says, meaning that even minor outages of several data centers at the same time could knock the entire Twitter service offline, perhaps for good.

I mean if it were true that seems pretty negligent. If that were the entire extent of the whistleblower complaint (not sure if complaint is the right term?), I would agree, but it seems as though there are some significant issue raised in the rest of the report.

View on HN

I dunno, pointing out that something has a poor architecture and pointing out that something has severe, known, and ignored security issues feels different.

Knocking-out twitter (used by journalists and govs) during a crisis IS a security concern.

A security concern for the governments, not twitter. It's not twitter's fault that governments are using it as a primary form of communication, nor should it be their responsibility to have amazing uptime just because governments are using their platform.

It's a national security concern (and international?) if Twitter can be compromised by nefarious actors and/or brought down via said compromised access. The idea that this isn't worthy of whistleblowing because Twitter is a corporation is insane. There are countless examples in the last year of Twitter being used for communication during a crisis.

That's ridiculous. If I created a service and the government happened to start using it, my service being taken down should not be labeled a national security issue against me. The national security issue would be the government deciding to rely on my service.

For all the first amendment protectors out there - the government forcing a private company to comply with some mythical security / uptime standard so it can propagandise its population - that is an actual violation.

Ludicrous, but this is the situation... holy cow, imagine a future where TikTok likes, determine the outcome of an election.

You can watch it live in 2024, when all of social media has morphed into TikTok clones.

Availability is the A in the CIA triad. DR and resilience in general is part of security.

That's never actually the case in an org chart, though. A CISO may require that a DR plan exists, but they're not the ones in charge of implementing it.

Also, if they can handle a primary datacenter outage, they have a working DR plan. If I was working on an infrastructure team and was told I needed to handle multiple, simultaneous datacenter outages, I'd start looking for another job.

Reply on news.ycombinator.com