A reader pointed me towards a Platformer story that really shows you what’s going on inside Twitter and how Twitter is being destroyed from the inside. I strongly encourage you to read the story which you can find here. But let me cover two things that made my jaw hit the ground.
#1 – Elon Musk fired engineers at Twitter because engagement counts are dropping:
On Tuesday, Musk gathered a group of engineers and advisors into a room at Twitter’s headquarters looking for answers. Why are his engagement numbers tanking?
“This is ridiculous,” he said, according to multiple sources with direct knowledge of the meeting. “I have more than 100 million followers, and I’m only getting tens of thousands of impressions.”
One of the company’s two remaining principal engineers offered a possible explanation for Musk’s declining reach: just under a year after the Tesla CEO made his surprise offer to buy Twitter for $44 billion, public interest in his antics is waning.
Employees showed Musk internal data regarding engagement with his account, along with a Google Trends chart. Last April, they told him, Musk was at “peak” popularity in search rankings, indicated by a score of “100.” Today, he’s at a score of nine. Engineers had previously investigated whether Musk’s reach had somehow been artificially restricted, but found no evidence that the algorithm was biased against him.
Musk did not take the news well.
“You’re fired, you’re fired,” Musk told the engineer. (Platformer is withholding the engineer’s name in light of the harassment Musk has directed at former Twitter employees.)
That’s a sure sign that Elon’s ego rather than his head is running Twitter at the moment. No to be clear, I am not shocked by that. What I am shocked about his behaviour when he doesn’t get the answer that fits his world view. Or when someone speaks truth to power. That’s just abysmal leadership.
#2 -Twitter’s outage from earlier this week is part of a larger problem.
An even more obvious reason for the decline in engagement is Twitter’s increasingly glitchy product, which has baffled users with its disappearing mentions, shifting algorithmic priorities, and tweets inserted seemingly at random from accounts they don’t follow. On Wednesday, the company suffered one of its first major outages since Musk took over, with users being told, inexplicably, “You are over the daily limit for sending tweets.”
It turns out that an employee had inadvertently deleted data for an internal service that sets rate limits for using Twitter. The team that worked on that service left the company in November.
“As the adage goes, ‘you ship your org chart,’” said one current employee. “It’s chaos here right now, so we’re shipping chaos.”
Interviews with current Twitter employees paint a picture of a deeply troubled workplace, where Musk’s whim-based approach to product management leaves workers scrambling to implement new features even as the core service falls apart. The disarray makes it less likely that Musk will ever recoup the $44 billion he spent to buy Twitter, and may hasten its decline into insolvency.
“We haven’t seen much in the way of longer term, cogent strategy,” one employee said. “Most of our time is dedicated to three main areas: putting out fires (mostly caused by firing the wrong people and trying to recover from that), performing impossible tasks, and ‘improving efficiency’ without clear guidelines of what the expected end results are. We mostly move from dumpster fire to dumpster fire, from my perspective.”
That further explains this email from Elon trying to focus the team on making the platform stable ahead of the Super Bowl. And it highlights that the stability of Twitter is heading downhill fast. And part of this is driven by Elon’s rush to ship new features at any cost to drive revenue. Which of course has not worked. What surprises me is that not even in my wildest dreams did I think that the situation was as bad as it’s being described here.
Now you’re likely wondering why I am highlighting this report. The team at Platformer has been 100% accurate about what has been going on inside of Twitter since Elon took over. So it is beyond a safe bet that everything that you read in this article is fact. Which means that if you still have a Twitter account, you might want to make plans to be someplace else on social media as it’s crystal clear that Twitter with Elon Musk at the helm is living on borrowed time.
Reddit Pwned…. You May Want Change Your Password And Enable Two Factor Authentication
Posted in Commentary with tags Hacked, Reddit on February 10, 2023 by itnerdLast night via the official r/reddit community, Reddit disclosed that they were pwned:
On late (PST) February 5, 2023, we became aware of a sophisticated phishing campaign that targeted Reddit employees. As in most phishing campaigns, the attacker sent out plausible-sounding prompts pointing employees to a website that cloned the behavior of our intranet gateway, in an attempt to steal credentials and second-factor tokens.
After successfully obtaining a single employee’s credentials, the attacker gained access to some internal docs, code, as well as some internal dashboards and business systems. We show no indications of breach of our primary production systems (the parts of our stack that run Reddit and store the majority of our data).
Exposure included limited contact information for (currently hundreds of) company contacts and employees (current and former), as well as limited advertiser information. Based on several days of initial investigation by security, engineering, and data science (and friends!), we have no evidence to suggest that any of your non-public data has been accessed, or that Reddit’s information has been published or distributed online.
Reddit claims that user data is secure, but:
Since we’re talking about security and safety, this is a good time to remind you how to protect your Reddit account. The most important (and simple) measure you can take is to set up 2FA (two-factor authentication) which adds an extra layer of security when you access your Reddit account. Learn how to enable 2FA in Reddit Help. And if you want to take it a step further, it’s always a good idea to update your password every couple of months – just make sure it’s strong and unique for greater protection.
Also: use a password manager! Besides providing great complicated passwords, they provide an extra layer of security by warning you before you use your password on a phishing site… because the domains won’t match!
Now I can’t tell if Reddit is saying this because there is a legitimate threat out there that they haven’t disclosed, or this is generally good advice. Which it is good advice from my view. But if you’re a Reddit user, you should likely take their advice just in case this turns into a LastPass type of situation.
UPDATE: Monti Knode, Director of Customer Success at Horizon3.ai has this comment:
“Another successful phishing campaign isn’t a surprise and shouldn’t be. This attack vector is successful because it can look so legit, from plausible prompts to cloning their intranet gateway. This attack further reinforces the fact that the old perceptions of a perimeter are dead and gaining access is almost trivial, while understanding the blast radius of a successful attack matters more than ever.
“What can an attacker do if they landed on a specific asset? What could they do with a specific credential? In what scenario is our sensitive data at risk? These are the questions we should all be asking, because it’s not a matter of if, but when.”
Jesh Sax, Technical Account Manager at Tanium adds this:
“The techniques used at Reddit are all too familiar. Attackers are adapting to security techniques like multi-factor authentication and organizations need to take measures to mitigate potential vulnerabilities. Whether it’s physical security tokens or finding ways to authenticate both the user and the device that they’re logging in from, security teams need to continue to evolve.
“However, the fact that the user self-reported and the security team was able to catch things early on prevented this from becoming a much larger story. This speaks volumes to the culture that the security team has promoted at Reddit, where users feel comfortable speaking up when they’ve clicked on a phishing link. This type of security-aware culture is what every organization should strive for.”
Leave a comment »