Ex-Twitter engineer tells FTC security violations persist after Musk

[highplainsdem]

Source: Washington Post

A new Twitter whistleblower has emerged, supporting last year’s surprising testimony about the dismal state of the company’s privacy protections and saying the company continues to violate its legal obligations under new owner Elon Musk.

The former employee has told members of Congress and staff at the Federal Trade Commission that any Twitter engineer can activate an internal program until recently called “GodMode” and tweet from any account today, three months after Musk’s takeover.

The allegation was also made in a complaint filed in October by the nonprofit law firm Whistleblower Aid with the FTC, which is continuing to interview former employees. A congressional staffer shared the complaint with The Washington Post.

The company’s current head of trust and safety, Ella Irwin, did not respond to an email seeking comment on the new claims. Parag Agrawal, the chief executive for a year before Musk fired him in October, did not respond to a Twitter message seeking comment.

-snip-

Read more: https://www.washingtonpost.com/technology/2023/01/24/whistleblower-twtter-ftc-settlement/

[FredGarvin]

1. His manipulations are OK

Because he's rich

[crickets]

2. No paywall link:

https://archive.ph/Yl7s8

The whistleblower has come forward because of last year's testimony by Peiter Zatko, former Twitter security head.

Former security chief claims Twitter buried ‘egregious deficiencies’
https://www.washingtonpost.com/technology/interactive/2022/twitter-whistleblower-sec-spam/
https://archive.ph/oP6Kz

[rickford66]

3. Most S/W has some form of God Mode

Left over from development and testing. It may be disabled at some point but some code could be left for one reason or another.

[zipplewrath]

4. Joshua? (nt)

[NullTuples]

5. The question is, why has it not been disabled?

(the answer is likely, "the people who knew how where to do so have long since been fired&quot

[rickford66]

6. Probably left in for debugging

With a large s/w program, having almost infinite combinations of inputs, I'm sure there are almost daily fixes needed.

[NullTuples]

7. Or as I understand of the code base, many s/w systems, any one of which could have the debug code

in question, tucked away in some not-fully-documented corner? Just the list of languages Twitter cobbled together is impressive, even after subtracting the ones that I assume are used for infra. I sometimes wonder if this is the downfall (for corporations) of user-driven change management (think: git) vs old school centralized, which acted sort of like HR really does, to protect the company's interests.

[rickford66]

8. Also, different versions of these are probably on every server.

[NullTuples]

9. Oh, now that's just nasty.