john retweeted
I used to be the person companies called after they got hacked.
And I noticed something early on.
The hack almost never sank them. The cover-up did.
Every time, the team’s instinct was the same: wait until we know more, wait until we're sure, wait until we have the perfect statement, etc.
And some of the biggest companies in the world have learned what that waiting costs.
In 2016, Uber got hacked. Instead of telling anyone, it paid the hackers $100K to delete the data and stay quiet, and labeled it a bug bounty. The truth came out a year later. Uber paid $148M to settle with all 50 states, and its former security chief was criminally convicted.
That same year, Yahoo revealed that a 2014 breach had exposed 500M accounts. The news landed in the middle of Verizon buying the company. Verizon cut $350M off the price.
And in 2017, Equifax discovered a breach affecting over 140M Americans, then waited 40 days to tell the public. During that window, an executive who'd figured out what happened sold nearly $1M in stock. He went to prison for insider trading.
Meanwhile, hackers don't wait. They post your data. They email your customers directly. And when customers hear it from a stranger first, that trust is gone for good.
Telling customers early doesn't mean admitting fault. It can be as simple as: "We found suspicious activity. We're investigating. Here's what you should do right now. We'll update you as we learn more."
On Tuesday, I'm sharing the exact framework I'd use to write that email if I were in your shoes. Follow and turn on notifications so it's there when you need it.
Customers will forgive you for getting hacked. Most of them expect it by now.
What they won't forgive is finding out you knew and said nothing.
And I noticed something early on.
The hack almost never sank them. The cover-up did.
Every time, the team’s instinct was the same: wait until we know more, wait until we're sure, wait until we have the perfect statement, etc.
And some of the biggest companies in the world have learned what that waiting costs.
In 2016, Uber got hacked. Instead of telling anyone, it paid the hackers $100K to delete the data and stay quiet, and labeled it a bug bounty. The truth came out a year later. Uber paid $148M to settle with all 50 states, and its former security chief was criminally convicted.
That same year, Yahoo revealed that a 2014 breach had exposed 500M accounts. The news landed in the middle of Verizon buying the company. Verizon cut $350M off the price.
And in 2017, Equifax discovered a breach affecting over 140M Americans, then waited 40 days to tell the public. During that window, an executive who'd figured out what happened sold nearly $1M in stock. He went to prison for insider trading.
Meanwhile, hackers don't wait. They post your data. They email your customers directly. And when customers hear it from a stranger first, that trust is gone for good.
Telling customers early doesn't mean admitting fault. It can be as simple as: "We found suspicious activity. We're investigating. Here's what you should do right now. We'll update you as we learn more."
On Tuesday, I'm sharing the exact framework I'd use to write that email if I were in your shoes. Follow and turn on notifications so it's there when you need it.
Customers will forgive you for getting hacked. Most of them expect it by now.
What they won't forgive is finding out you knew and said nothing.
20
58
1,126
154,080
john retweeted
live-tweeting on samsung findings were fun.
i'll let my agents give it a bit more time, but this document is already the most comprehensive breakdown of some key concerns of tizen i've seen run on a live device.
it takes like a good while for me just to scroll through it ups as of right now on individual functionality).
release is probably happening in a few days.
i'll let my agents give it a bit more time, but this document is already the most comprehensive breakdown of some key concerns of tizen i've seen run on a live device.
it takes like a good while for me just to scroll through it ups as of right now on individual functionality).
release is probably happening in a few days.
48
145
1,849
212,982
john retweeted
My saturday evening project: hacking my remarkable to see if Opus 5.5 can help me draw (and also animate cuz why not)
57
54
1,157
66,075
john retweeted
Trans voter to @AOC: Trans people in America feel like they've been abandoned by the Democratic Party, that we are a losing issue, that it's not worth defending us. What do you say to that?
AOC:
25
178
2,755
57,938
john retweeted
Vibecoders, 𝗜'𝗺 𝗯𝗲𝗴𝗴𝗶𝗻𝗴 𝘆𝗼𝘂, add these two lines to your AGENTS.md:
"Cut taglines, helper text and secondary labels. If a screen needs them to make sense, fix the layout."
"Make the best decision that will elevate all three: the user experience (UX), developer experience (DX), and agent experience (AX) always, without breaking anything."
"Cut taglines, helper text and secondary labels. If a screen needs them to make sense, fix the layout."
"Make the best decision that will elevate all three: the user experience (UX), developer experience (DX), and agent experience (AX) always, without breaking anything."
143
291
6,842
680,638
john retweeted
Logged back in just to laugh at you @h3h3productions enjoy your two-parent solution nigga
You can tell Ethan Klein genuinely thinks he deserves to live
259
9,998
144,465
3,832,175
john retweeted
turns out it classifies what audio it hears, before reporting back to samsung.
sensor preferences, dog-barking and baby-crying event counters, and camera streaming duration are built into telemetry paths.
sensor preferences, dog-barking and baby-crying event counters, and camera streaming duration are built into telemetry paths.
this is pretty evil and clever.
so if your samsung TV model doesnt have a microphone, it will look for connected devices with one, such as a soundbar or a connected bluetooth device.
this gets shipped off to bixby.
233
1,836
15,395
1,291,015
john retweeted
This one maybe as bad or worse than the PHP ones. Get used to lots of patching.
we've found and have been working on disclosure for a remote code execution in a widely-deployed compression library.
it's both an impactful issue and an example that shows how complicated it can be to coordinate patching, since it's integrated into a lot of downstream software:
50
129
1,865
210,727
john retweeted
the cowardly thing about John Oliver in my opinion is that he never ever ever ever ever challenges the biases of his overwhelmingly liberal audience or presents them with any information that might cause them to question their existing beliefs. it’s all just partisan comfort food
HBO's @LastWeekTonight has a long track record of citing social science findings without the appropriate context, massaging them to support whatever point @iamjohnoliver is trying to make.
160
390
8,176
210,584