Is Twitter/X the right channel to announce a security event like this?
I ask because I don’t see anything posted on their official blog or status page.
I ask because I don’t see anything posted on their official blog or status page.
They announced this exclusively on X.com, which ranks barely above Pinterest in terms of usage. That's below Reddit, Snapchat, WeChat, and Instagram, and requires a user account to view profiles and posts. And that's ignoring all the reasons X is a divisive platform with an extreme political bent.
GitHub chose not to announce this on any other social media either (BlueSky, Facebook, TikTok, YouTube, LinkedIn, or Mastodon, as of this posting, and with no emails sent on the matter.)
I think that's panic mode from some decision maker (i.e. head of marketing or head of security).
Wherever they posted, there’s at this time two articles on the Hacker News front page. Sounds like they have reached their audience.
Github decided not to use email (which every Github customer has), their sites, or their otherwise active BlueSky.
There are plenty of reasons not to use X, but that's not what's in contention. X.com was the _only_ platform they shared this information on.
It bears repeating: Github decided not to use email, which every GitHub customer has, and Github chose not to use their sites, and GitHub chose not to use their otherwise active BlueSky.
It'll frequently display tweets from literal years ago as being the latest.
It's why proxies/mirrors are often linked rather than Twitter itself.
They don't seem to care to fix it, which implies that it's intentional. Seems completely stupid but what do I know?
Most individual permalinks (.com/username/1234...) don't work without logging in, either, and the official client now uses `/i/` in place of usernames for permalinks(bogus usernames always worked; pkey was the timestamp).
This means an organizationally shared Twitter account for announcements is not a viable concept, at least until Twitter is to be transferred again to whoever would be a better keeper of it.
For example: Twitter/X, along with Nitter mirrors like XCancel, are all blocked at the client I'm currently working with so although they can see this discussion, they're excluded from some of the most important details.
(Like many former twitter users, I don't have an X account these days so I'm guessing wouldn't be able to see the full original thread - glad of XCancel, that's for sure.)
Not to mention Twitter is not an open platform anymore! (A) I'm an employee in an organization paying for Github. (B) I don't have a Twitter account. I already have a Github account because of (A). Why should (B) stop/delay me from getting official comms about this?
It's not "spam" if it is relevant to me, such as security incident disclosures.
Also, as tiffanyh pointed out, what's wrong with Github blog or is that exclusively for marketing fluff now? That would've been appropriate enough, without having to spend Sendgrid credits.
Beyond that, Twitter is the de facto default dissemination vehicle, due to its reach. Even if people are not on Twitter, they are likely to see things from people that are on Twitter.