skysight-inc/HackerNews huggingface dataset:
Is there any information on whether a single employee or a number of employees were involved? I don't think the attackers could have had someone hired at Twitter Support only to carry out this attack, given how they tried to monetize. Also I suspect no more than one employee was involved, and that "social engineering" was done only to compromise their credentials, instead of asking them nicely to allow them access to multiple (130) popular accounts.
Not really, this document is clearly intended for a general public audience (They define the term "social engineering" after all). I don't think its surprising they didn't go into the details of which algorithms they use on old passwords
Right, but Ross Brawn was hardly alone. He worked well with Jean Todt whom did the negotiation and business handling.

For all the credits to Binotto, he's not a good negotiator.
I don’t understand what you are proposing as an alternative. If the company dies who is going to take care of the employees? Lay off everyone because it would be wrong to only save some? If everyone makes that noble choice all we get to show for it is a depression.
In principle I agree, in practice I'm less sure.

I agree that "well, you drew the short straw in getting a pandemic" is a fair reason to explain an executive's failure socially, but I've never known investors to be this kind and charitable. In my experience investors want to extract value right now, and they're more than happy to chuck executives away if they think someone else could do better no matter what the underlying cause was.

Secondly, while this behavior is galling in the current context, it's hardly new. The 2005 law banning executive bonuses during bankruptcy wouldn't be put in place if it wasn't already a problem. Under the general case you laid out above, investors appear happy to hand out bonuses for executives that crashed the company after rolling a 3.
*damned
I spent a good chunk of my day today fighting a bug that I imagine is going to bite us sooner or later at work, but so far seems limited to my machine.

We use Qt5 and QGraphicsScene with QGLWidget to let us also do custom background painting in OpenGL. We have tried porting to the new QOpenGLWidget before, but we hit a fun issue: If you add a QWebEngineView to a widget in the graphics scene, the entire widget disappears for a frame every time the browser repaints. Which gives you a really great flickering that makes the software unusable.

It used to only happen on my branch with QOpenGLWidget, but I recently recompiled using a newer gcc version and now it happens to me with the old QGLWidget as well.

Qt and OpenGL seem to not get along all that great. There are all sorts of odd rendering artifacts that pop up and never seem to get fixed. The documentation for internal Qt code is also not great, which makes trying to parse through it a real adventure.

Edit: Another fun bug that popped up in the Qt4 to Qt5 transition is that on Linux if you have our app open and then switch to a different virtual workspace and back, the app stops repainting until you resize the window.
You're assuming an uncaptured market which doesn't seem sound. You can definitely find insular peer circles in C-level exec positions.
Wait, didn't Chinese authorities said when this all started that there was a minor outbreak in the BSL4 lab, but it's under control? It's just when the "under control" didn't work, they started to cover things up.
Webtorrent is very nice in web browser. But,i am not convinced why should i use webtorrent outside browser where i can use transmission/aria2/libtorrent based torrent clients.
Uhhhh....

> Attackers were not able to view previous account passwords, as those are not stored in plain text or available through the tools used in the attack.

Does this mean _current passwords ARE stored in plain text_??

IF this is the case, chances are it's because plaintext passwords more straightforward remediation and (statistically significantly) lower support times/costs. The convenience of this cannot be understated. BUT:

- Twitter just leaked that current passwords are stored in plain text

- Twitter just leaked that current passwords can be viewed by support tools used by employees susceptible to social engineering

Again, IF this is true, it's a lesson about the privacy and security risks ever-more-frequently associated with convenience (in this case internal convenience).
Show HN: Cookie Recipe Generator
This was a Covid-19 side project to learn Svelte and Sapper.

Customize exactly how you want your cookies to turn out and it will generate the perfect recipe for your perfect cookie. Would really like everyone's feedback!
Circular dependencies like this are not a good look when the core of your business is networking...
The fact it was world news was probably their first hint.
It also sounds like they may keep old passwords?
> 2FA compromised

This is why sending or generating a OTP, that the user types in, is not secure. The user can be tricked into handing the OTP over the phone. Even the O365 system isn't secure (because the user can be told which number to tap over the phone).

The only secure authentication these days is a non-communicable possession: Yubikey or similar. This reflects *very poorly on Twitter opsec.
He's arguing the support is nonsensical considering the facts. That you disagree is your opinion.
The Alan Blinder problem
https://en.wikipedia.org/wiki/Antifragile#The_Alan_Blinder_p...
Aberration Lab – Participatory Light Drawing
Exactly. In other contexts, however, we'd call that a conspiracy. So why don't we here?
Imagine if Lewandowski was Chinese and going to be bought out by a Chinese tech company...
Who says an expert is an expert?

Catholic priests are all experts in catholicism. They write papers about Catholicism, all peer reviewed by other experts in catholicism.

Most agree the Pope is infallible.

Groupthink is still Groupthink and belief is still belief. Hence why we have debacles like the lipid hypothesis.
I used to write Qt in like 2006 but I've given up. I've been rolling my own thing in Rust. GPU first, ECS (https://en.wikipedia.org/wiki/Entity_component_system) based. It's surprisingly pleasant.
Reactive Forms Benefits: Nested Form Groups
Speaking of .Org and ICANN. If any one in the industry knows what happened to .Web?

I think Verisign won the action and then the other two bidder decided to sue ICANN. But that was 2017/8.
John Lewis, Towering Figure of Civil Rights Era, Dies at 80
Almost all internet companies have internal tools to disable 2FA. People destroy/break/etc their phones constantly and need it reset.

2FA is meant to protect against someone impersonating you. It is not designed to protect against malicious insider at the org you are trying to prove your identity to
I believe you're referring to Switzerland. It isn't legal, but addicts can get free heroin (or methadone) administered by doctors. It cuts the bottom out of the dealer's markets, prevents petty crime by desperate addicts, avoids OD deaths, and makes sure the government has tabs on how bad the problem is. In 20 years Zürich has gone from 'having a heroin problem' to just a few old-timers who occasionally relapse, with almost no new addicts.
If Bill Gates has been born black in my Maryland county, he’d have gone to segregated schools until high school.
Is this an open source effort?
Doesn't that count basically include the acquihire that google did for his company?
Eh, you're not getting just how deep in the shit we were.

Sometimes you can't give everyone a pony.

There simply wasn't any money. That's the essence of running in financial distress. No banks, no loans, insurance support payments got swiped by other people we owed money to... You're running on the cash in the till.

We started with 500 jobs, most of which were union gigs with benefits. About 50 were still with us a week later, when this brutal end game went into full effect.

The cost of failure for this nasty little endgame for the 50 survivors, the quest for a sustainable business? We were an older union workforce, operating in an area with young non-union shops with sketchy labor policies. Our local employees were getting offers for $12 / hour with no benefits. Or a 40%+ drop in compensation for office staff due to age discrimination.

That's the difference between retiring for a nice middle class lifestyle and eating cat food for your golden years. Fifty lives fucked up, for loyal company soldiers.

So yeah, I wanted to keep the company alive to save jobs.

I'm a high end mercenary; I had an offer within a week of formally rolling off the program and plenty of consulting work to tide me over. My only prize here was moral satisfaction.
They could've just said "...as this is not possible" or something like that. I wasn't suggesting they need to drop in acronyms like PBKDF2 or whatever. They go out of their way to say "through the tools used in the attack" which might as well imply there are other tools through which the passwords are available...
"Statutes" have no power when nobody wants to enforce them. I think the generic uniform trick is a way to hire random folks to deal with protests. DHS probably doesn't want to risk its own personnel, so they hire "disposable" folks from the streets and give them generic uniform to hide what they are doing.
Why would he even give that up to go to Uber (let alone risk criminal charges)? Was he somehow under the impression that he would hit 10 figures at Uber? Why does any single person even need that much money to begin with? Give me 9 figures (or even 7), and I will call it a day. I'm really trying to understand his individual rationalization here.
Neat fact: entropy and expected algorithmic information are asymptotically equivalent. Two quite different approaches to information theory converge.
I didn't align with the man politically, but I admire how much of his life he spent working to improve this country for others. A life well lived.
It’s interesting that the Your Data tool only started including DMs after GDPR stuff went into effect. For many years, DMs weren’t part of the archive. When the feature was added in late 2018 or early 2019, it became clear that Twitter actually maintained an archive of all DMs, whether you had previously deleted them or not.

I’m glad this was only 8 accounts — but it’s a good reminder that DMs aren’t encrypted or secure and shouldn’t be used that way.
> hinders skilled individuals from switching between companies and spreading innovation

This is gross misrepresentation of what happened. It’s not some smart, lone engineer leaving for competition and bringing some good ideas from previous employees with him.

It’s an executive (with a technical background, but still), paid insane amount of money, deciding to steal majority of trade secrets for an unreleased product, developed by thousands of people, just so he can sell it to a competitor for an obscene amount of money.

It’s not a little guy vs big corp. It’s a greedy and ruthless executive vs corporation.
If I had to guess, likely textbook spear phishing. If they were able to get past 2FA, then either it was weak 2FA or they stole auth tokens, not passwords. In general that approach is unreasonably effective
- at least single-digit percentage points of effectiveness.

Between that and just bribing support people (or they were in on it to begin with), you have the two of the most common attacks on user/customer data.
> As mentioned above, we are deliberately limiting the detail we share on our remediation steps at this time to protect their effectiveness and will provide more technical details, where possible, in the future.

With all due respect, I have no confidence in measures that aren’t transparent and open. They can share a lot of details without risking security, but by being vague about remediations, they’re being obscure, not secure.

If they posted their exact remediations (hiding sensitive parts like precise information needed to take control of an admin account or use it), they would have an entire world of security experts ready to critique their plans. Instead, we have to trust and hope they get it right the second time.
Show HN: Tell me how my browser extension to help browse websites sux
I am pretty tired of working with web apps that are a disaster to tab through (I'm looking at you AWS & Github), so I rage-coded a chrome browser extension to help me piece up the page and get back to kicking asp (jokes though, hate asp). I think it kind of sux, but that's only my opinion (and maybe since i'm the only user...).

Care to share why you think it sux?

Landing Page:
https://shortqut.com/extension

The landing page also sux, please tell me why!

Chrome Store Link:
https://chrome.google.com/webstore/detail/shortqut/pbdnmkolnjmoeooffliebhmogchfmkgf
Ask HN: Can you recommed tools to make online courses?
I'm an educator (and spare time programmer) struggling also with moving courses etc. online, working on my own solution and looking for recommendations and especially good web frameworks to sync video with text and exercises.

Maybe similar to
https://www.manning.com/livevideo-program
or
https://developer.apple.com/tutorials/swiftui/

Not much familiarity with new web development environments (know a bit of Perl, JavaScript, the first versions of Ruby on Rails/Django). Any help and pointers appreciated.

Currently I use screencast + a Zoom H4 for screen /audio recordings. Seems to work quite well.
Yet, I would love to make the videos more interactive.
I think the hackers were going after OG accounts that were single, two-character, or common first name usernames. Many OG accounts aren’t verified.
Did anybody else get a strong emotional reaction to these? I connect them to my BBS years. Reminded me of chat sessions on Terminate, ZMODEM downloads that take just too long to finish (only to discover at least one corrupt zip file part after all that wait!). Mild PTSD memories of my mom chasing me with a telephone bill... :-)
Absolutely. I'll be the first to say that compliance doesn't mean you're actually good at those things (and I actually have said as much here on HN).

However, the point remains that things like change management aren't some nebulous, pie-in-the-sky concept. That they are in compliance frameworks speaks to the fact that they are very fundamental and basic (compliance frameworks are typically the bare minimum of things you should be doing).

A half-assed CM process won't catch all errors by any means. But it will catch the most basic ones. And according to CF's post-mortem, the initial issue that kicked off the chain of events was "backbone congestion", which has got to be one of the most basic things that would be included in an IR playbook (Prince even referred to it as "routine maintenance" in an earlier message). And then the config change that was put in place also seems like a fairly basic change that probably would have been caught with with some basic testing.

That's what catches my eye the most. This incident wasn't some wild, niche, couldn't-have-been-predicted event. It was "backbone congestion", followed by an attempted change of routes on the backbone to alleviate the congestion. For an internet services company to not have a standard, pre-approved and pre-tested solution for resolving something as predictable as backbone congestion is shocking to me.
Not yet and I'm not sure I'll open source it.
This reminds me of chaining indials and outdials back in the POTS modem days. Operation Sundevil was certainly a motivated investigation.
It would be helpful if Twitter supported the deletion of Direct Messages for all parties, as they do with public tweets. Right now, they just sit around in at least one party's inbox and accumulate, creating a valuable cache of private information.

(Twitter's implementation of Direct Messaging aligns more closely with instant messaging than email, therefore I believe a real deletion feature isn't an unreasonable expectation or ask.)
This play is straight outta Vladislav Surkov's book. He's starting to look like Putin's Kissinger. Look up the "little green men" in Ukraine.
I actually don't think it's as important as identifying how and why those employees were able to do things like tweet on behalf of Obama. Proper access controls would have high-profile accounts extremely locked down, ideally such that no single person could independently choose to access this info.
They said "those [passwords] are not stored in plain text or available through the tools used in the attack." - "Or" means both clauses are true.

I think it most likely means, the passwords are hashed, and the hashes aren't available in this tool. There's undoubtedly other tools that allow people to view the hash, (Mysql command line client is a "tool" after all ;) Although I agree the statement is ambiguous enough, that it could mean things that aren't best practise.
Here's my suspicions. I may well be wrong, but this is what it feels like...

I was wondering what kind of thing some actors (possibly state-based) were going to do this election cycle since the 2016 one (hacks of Republican and Democratic emails) worked so darn well. Exfiltrating DMs seems like it's going to accomplish just about as much, if not more.

And there's no big reason to think that the exfiltration of private DMs was limited to the people that had the Bitcoin scam tweeted on their accounts.

I think the Bitcoin scam was also the perfect innocuous cover story - a legitimate motive that nevertheless leaves one with the impression that the operator is a pretty small fry. So many dismissals of it's a silly scamp wanting money but only got 12 BTC, next day's news please.

But it did put it out there so that the public (and the public needs to know to establish the credibility of the compromised data instantly, immediately, with no room for doubt) is aware a broad hack occurred, without even exposing who was targeted specifically and the BTC didn't matter one iota. Now they can trickle-feed what they actually got all the way until the election. Also, they don't care who'll win, just like the email hackers didn't in 2016. They just want to sow discord. Tweeting the same unrelated thing on so many accounts also sends the message that they're not on anyone's side.

The only reason I think Trump didn't have anything tweeted isn't because they particularly like him, but because it gives of the image of graver national security consequences.
They mean "previous" as in before the hackers did the password resets. (So all your passwords, except the one the hackers set.)

I don't think this implies a problem with "your current password" security, just that you don't care if the hackers have the password that they set themselves (and clearly already know then).
I've also been working on a ui lib. Rather different, though: gpu completely optional (though well supported); not ecs; c.

I think there's a fundamental complexity that pervades popular ui libs (incl, qt, gtk, etc.), that doesn't need to be there.
If you can't keep everyone on in the first place it's pretty ugly to give the people at the top bonuses, they have less to lose from losing their job in the first place.
I just showed this to a friend of mine who is a biochemist and he sent me this —

https://fullfact.org/health/richard-dearlove-coronavirus-cla...
There's always a lot of initiative to get rid of unsafe manual network config changes right after a major outage, but the difficulty of automating such changes is surprisingly high, and the rate at which the initiative decays is also surprisingly high.
Attitudes like this are the reason that we don't have better practice industry wide. Seeing quality control as the enemy of success doesn't create good software, it creates technical debt and discourages prospective ops engineers.

The teams I've seen be the most comfortable with these knowably bad processes have been the strongest advocates against guardrails. The cost to your reputation and bottom line when something does go wrong is opaque to many engineers, but these kinds of ridiculous errors do lose customers.

Edit: A common saying where I work is that there are no stupid mistakes only bad processes. The first step to rooting them out is admitting that they're process level issues.
Thats overstating it a little. or even a lot.

Nobody has been in those places for more than a month, its 2 weeks.

The 'escapees' so far have been an alcoholic (went to the nearest bottle store) and a couple of people with mental issues.

The REASON those people escaped is because the places aren't prisons, or even close. They were hotels, high quality hotels in some places...with no police presence at all...

There was a bunch of fuss made by the public because it was eventually realised that people were being allowed out without testing to attend funerals under a compassionate exemption.

Your description makes it sound like something very different to the reality.

Its toughening up a little now, because everyone in NZ wanted them to toughen up, but for a long while the reality was that all you had to do to leave was decide that you wanted to leave.

Most people didn't, of course, because most people aren't dicks.
Is there a particular peertube platform thats currently popular?
Bacteria That Turns to Stone
> and use short-TTL weighted CNAMEs, defaulting to say, 99% Cloudflare, 1% your internal load balancer. The minute Cloudflare seems problematic, make it 0% 100% to bypass Cloudflare’s infrastructure completely.

Except if you're using CF for DNS service, this wouldn't have worked, as both CF's website & DNS servers were impacted by the outage.
Some of the people involved were interviewed by the New York Times [0] and indicated that the person who was offering access claimed they managed to get into the Twitter Slack account and saw credentials being shared. I don’t know if that is true or not, but all the external reporting doesn’t indicate that a Twitter employee was actively involved. It’s always possible someone was, but given the small amount of money made and the goal of the hackers themselves (OG accounts), it strikes me as unlikely. I would assume that any engineer with access to those types of systems would want to sell out for more than a tiny amount of crypto to some script kiddies on Discord, but you never know.

[0]: https://www.nytimes.com/2020/07/17/technology/twitter-hacker...
Do FAANGs burn down your office and break your legs?
If Windows is the dominant desktop computing platform, is it the only one the matters?
>Sometimes you can't give everyone a pony.

I'm not suggesting you can, I'm suggesting it's bad to give some people the boot and others a pony in the hope of saving an abstraction. The company doesn't exist outside of the people whose livelihoods it sustains.
> we didn't follow through with the lockdown nationally to actually stomp the virus

Do you think an enforced national lockdown is feasible in the US?

Given the size of the country, the culture of independence, the relatively loose union of 50 states and other factors, my answer is no.
The kind of people who will work with you to rip off others are also the kind of people who will rip you off. Who knew?
very poorly is a bit much. Yes yubikey would be much better, but its not exactly standard across the industry yet.

For something to reflect very poorly on twitter opsec, I would expect it to be something that is below what the average tech company was doing. e.g. There was some news article claiming [Without a whole lot of evidence] that the compromised tool used a shared password that was posted as the topic of a slack channel. Now if that was actually true, I think that would fit the description of "very poor" opsec.
Addition: CF just sent an email out to customers about the incident.