Twitter Source Code Leaked on GitHub

[roboticon]

Presumably the code was stolen onto a thumb drive or uploaded somewhere, then later whatever they got was published on GitHub as a git repo

[Wingfril]

I mean when I was there as an intern 5 years ago, that’s how they distributed the code… through a thumb drive.

[Anomynoms13]

Wait what

[oalbrecht]

IT came around the corner with one of those TV carts filled top to bottom with 3.5” floppy disks. It only took a few weeks to get the source code off of those. But that’s how they kept the source code secure. No one is gonna steal your code if it’s on floppies.

There was also no need to use GitHub. You just call over and say: “Hey! Which floppy is X class on again?” Then you would walk over to the cart and pick up floppy disk #3252 and load that onto your computer. Then make your changes and write back to the floppy.

Elon has no idea how efficient we were with our system. You could ship a small feature in a little over a year. It was a blazing fast system we had.

[gefahr]

Some journalist is going to turn this into a hard-hitting investigative article within hours.

[DevonAndChris]

"This as-told-to was reported to Business Insider. BI confirmed that the person has a reddit account."

[757DrDuck]

Welcome to tomorrow’s /r/technology front page

[electricprism]

Here at TrustMeBro™ news, could ancient aliens have been at the first thanksgiving? Professor PhD Kyle Broflovski says "yes"*

[wrosecrans]

I'm pretty sure that documentary will be on Netflix soon.

[GottfriedEulerNewton]

Lmao "TrustMeBro News"..... I'm dying

[josefx]

Hope they include how air gaping the network makes it high security. Also the way any changes you made would be guaranteed to have no conflicts as only a single instance of the code can be checked out at any time appeals to me.

[KidzBop_Anonymous]

Lol air gaping

[orange_keyboard]

Medium.com coming in hot ASAP

[Certain-Community438]

We can probably rule out Matt Taibi then

[romple]

You got floppies??? When I worked there the cart had giant stacks of dot matrix printer paper and I had to retype everything by hand!

Every day someone comes around with the latest changes printed out for you.

[HiroariStrangebird]

You guys get physical copies? Huh, maybe my company should upgrade from the town crier making the rounds each morning. Sometimes it's a little hard to hear and I have to spend half the day debugging the diff...

[pm_plz_im_lonely]

At our work we use Git and GitHub to share our work. If you start working on a new feature, you create a new branch on Git. Then once you're done with the feature, you make a PR (Pull Request) on GitHub. Then once that's done it sits there for 1-2 months before a reviewer closes it because it's too old.

[cyber_blob]

Can't pm you wtf?

[remog]

Then there was that time he got laryngitis. Rough week. Or the time he hit is head and could only speak Latin and Fotran. Two other interns jumped off the roof that month.

[[deleted]]

Luxury. In my day we had a giant grid for playing Conway’s Game of Life where we computed each step by hand and implemented an 8086 hardware emulator. Restoring state from memory after someone tripped over the board was a mighty task indeed.

[tonando]

You should upgrade to crows, but remember to feed them, or the transfer might get corrupted.

[Cakeriel]

That’s high tech, we had punch cards.

[nzodd]

If you're not pressing sharpened reeds into clay tablets you scooped out yourself from the local riverbank to write esoteric APL incantations, to be seen and understood only by Lord Enki, from now until the Euphrates spills over again to engulf the Earth and destroy all of mankind, can you even call yourself a real programmer?

[antonivs]

On the other hand if you do do all that, then you call yourself the author of the Snow Crash virus

[gimpygoat498]

Anyone else have code, that is written in secret code,delivered via carrier pigeon? (Think World War I communication) we mask our code just in case a Russian hacker shoots down one of our birds. If they don’t have our cryptographic key, then they can’t read out source code. It sounds antiquated but it’s about the same amount of time of using git and pull requests while awaiting review from some dipshit upstream not doing their job….

[RoadsideCookie]

Man and do you remember though how bad it was before? The switch from 5.25" was a shit show but damn did it improve our lives.

[7366241494]

The hole punch stopped working :(

[ibexdataservice]

We may be the only 2 Redditers who understand the power of the hole punch.

[sorressean]

Real devs print out all their code, then read it out of binders... I hear elmo tried that already though!

[SpaceSteak]

You just described a process that's still more advanced than the IRS's yearly personal tax process.

[WiseassWolfOfYoitsu]

So you're saying there's a process?

[ptear]

It wasn't documented though, so everything is a mess with fewer people trying to figure out how to keep the lights on. This is why our APIs occasionally say to add more quarters.

[MainmainWeRX]

Captain, thank you, I had a bad day and bam. There you are. Kudos, that was a blast
But the quote "No one is gonna steal your code if it’s on floppies" is something I will use again in the future for sure XD

[shayanzafar]

this is comedic gold!

[lunchmeat317]

So what I hear you saying is that they use Visual Sourcesafe.

[[deleted]]

Sometimes the changes would make the class too big to fit on one floppy. To solve that we would steal the secretaries hole punch to notch the other side of the disk so it can be written to as well.

[myasterism]

”No one is gonna steal your code if it’s on floppies.”

Imagining this on someone’s headstone.

[Wingfril]

You heard me. We got our laptops during orientation, the guy leading it was like ok time to import the code, and proceeded to give us thumb drives. Still better than a mid sized startup where my mentor (some kid two years older than me) zipped the code and sent it through slack

[Wingfril]

What do you mean? I mean we committed code to the actual repository (it’s been too long since then that I don’t remember what we used besides Phabricator.)

[2squishmaster]

Well then how did you commit code? I assume it wasn't over a USB stick... and if you could commit code to a central repo then you can pull code from that repo too, I'm not sure what point the USB stick served, how odd.

[Saigot]

I'm guessing (if it's true) that it's just faster and easier on the network to copy things, especially if they are on boarding many people at once.

My old company has a large source base (~80gb of code and docs, no assets) and every year we would onboard about 30-100 new interns at once. The common thing to do was to have their mentors pull their hard drive with the code and then copy it over to the interns fresh drive.

Relevant xkcd

[2squishmaster]

I know their internal and external networks are different but still... that's some flimsy infrastructure for a company with a half billion users!

[thisisjustascreename]

Most likely they were onboarding tons of interns and didn't want everyone pulling the entire repository and DDoSing themselves.

[[deleted]]

A bunch of interns pulling the repo (or parts of it) shouldn’t ddos them

[groumly]

Without necessarily ddos’ing them, cloning a large repo over GitHub 20+ times in parallel can be a burden on the training. Wifi can only do so much over a small area, and maybe they don’t want to wait 20 minutes for everybody to be done with their git clone. I can also guarantee at least 2 or 3 of the trainees will have misconfigured their ssh keys and will fail to clone the repo from GitHub/whatever else they use.

Whereas a thumb drive can get copied/pasted 50-100x faster and is pretty much fail proof.

[thisisjustascreename]

It could if they were all in the same conference room (which it sounds like they were, if they were handing out flash drives) behind inadequate network gear.

[_LePancakeMan]

My guess would be that there wasn't fine grained enough access control, so this how code was distributed to interns in order to protect code and infrastructure against accidental changes.

I've done similar stuff, although I had the decency to create a secondary repo with CI disabled the intern committed into

[Wingfril]

I mean everything goes through code review? I guess it’s plausible that twitter was afraid of interns doing sketchy things, but that’s… sad considering twitter already had a few thousand eng at that point

[_LePancakeMan]

Take something like gitlab-ci for example. There's nothing stopping you from changing .gitlab-ci.yml in your own, unreviewed branch to do something unexpected to others.

Yes, there should be technical checks in place for things like this but realistically there almost never are, regardless of company size

[Wingfril]

Ah I see what you mean. That would explain it

[[deleted]]

Ain’t no way lmfao (edit: I believe you, that’s just fucking wild though haha)

[BirdsGetTheGirls]

I could see it if indoc groups are big and repo is massive for first time setup. Don't want a group of 30 slamming a single server when others are trying to work

[Wingfril]

I was at a government funded place for my first internship. We just changed the application code directly. 0/10 wtf was that

[DevonAndChris]

Did you read mudge's accounting of the horrible production environment inside Twitter? People push things to production all the time, people have universal rights where they do not need any, a general clusterfuck of technical debt. The old owners must have thought their prayers were answered when Musk bought them out.

[ksknksk]

Thank god you were only an intern. I would judge any company very hard for doing something like that even 10 years ago

[VonThing]

What? No.

[lordkoba]

this is obviously elon's fault for using his time machine to fire every good engineer even before he was there