▲ 1032 ▼ The Batshit Crazy Story Of The Day Elon Musk Decided To Personally Rip Servers Out Of A Sacramento Data Center (www.techdirt.com) submitted 2 years ago by stopthatgirl7@kbin.social to c/technology@lemmy.world 266 comments fedilink hide all child comments Back on Christmas Eve of last year there were some reports that Elon Musk was in the process of shutting down Twitter’s Sacramento data center. In that article, a number of ex-Twitter employees wer…
[–] Maybe@lemm.ee 1 point 2 years ago (3 children) What sensitive data does Twitter hold? Genuinely curious permalink fedilink source parent hideshow 6 child comments replies: [–] DesertCreosote@lemm.ee 24 points 2 years ago (2 children) We don't know what was on those servers, but it was apparently sensitive enough that the government redacted descriptions of the data in court filings. The US government brief said the relocated servers were not wiped before being moved to a new data center. The type of data on the relocated servers was apparently so sensitive that it could not be described in the US court filing, which redacts the sentence that describes what the servers contained. https://arstechnica.com/tech-policy/2023/09/us-government-slams-musk-in-court-filing-describing-chaotic-environment-at-x/ permalink fedilink source parent hideshow 4 child comments replies: [–] Maybe@lemm.ee 1 point 2 years ago (1 child) Isn’t all of it encrypted though? Like I understand physical access to servers is generally bad, but you’d think once the the things are unplugged it would be difficult to access the data again without bypassing encryption. I’m not a software engineer though permalink fedilink source parent hideshow 2 child comments replies: [–] DesertCreosote@lemm.ee 2 points 2 years ago I'm a security engineer, and encryption is great, but can be bypassed. Relying on encryption assumes it was implemented properly, that the system was shut down properly so all keys were flushed correctly, and the encryption algorithm doesn't have weaknesses. Generally if somebody dedicated enough can acquire physical access to a system, they can probably find a way into it given the right resources. Did that happen here? Probably not. Could it have? Absolutely. That's why most enterprises or government hard drives are shredded rather than just relying on them being wiped or encrypted. Encryption is part of the solution, but it's not automatically the complete solution. permalink fedilink source parent [–] alvvayson@lemmy.world -3 points 2 years ago Probably because the government is still illegally spying on citizens and they don't want the specifics to leak out. permalink fedilink source parent [–] demlet@lemmy.world 13 points 2 years ago (1 child) You don't consider credit card info sensitive? May I have yours? permalink fedilink source parent hideshow 2 child comments replies: [+] alvvayson@lemmy.world -7 points 2 years ago (1 child) BS, I don't know if Twitter holds credit card data, but if they did, they would have needed to abide by PCI DSS rules, which requires encrypting the data in special hardware security modules. So no, moving those servers wouldn't put the data at risk. permalink fedilink source parent hideshow 2 child comments replies: [–] ramble81@lemm.ee 8 points 2 years ago encrypting the data in special hardware security modules Tell me you don't understand how PCI works without saying you don't understand how PCI works. Those systems can very much store PCI data and it's very much possible that those were the systems that contain information as most of the times it's on general servers. permalink fedilink source parent [–] SatanicNotMessianic@lemmy.ml 9 points 2 years ago (1 child) Personally identifiable information (PII) is any set of data that has a chance to uniquely identify a person, including name, address, credit card info, social security, etc. It can also include things like birthdate, city, IP address, and so on, depending on how the combination of data works. The general rule of thumb is that you want to aggregate out to the city level at least, or completely anonymize the data. These, I’m supposing, we’re raw records that contained account info. permalink fedilink source parent hideshow 2 child comments replies: [–] Maybe@lemm.ee 1 point 2 years ago Isn’t all of it encrypted though? Like I understand physical access to servers is generally bad, but you’d think once the the things are unplugged it would be difficult to access the data again without bypassing encryption. I’m not a software engineer though permalink fedilink source parent
[–] DesertCreosote@lemm.ee 24 points 2 years ago (2 children) We don't know what was on those servers, but it was apparently sensitive enough that the government redacted descriptions of the data in court filings. The US government brief said the relocated servers were not wiped before being moved to a new data center. The type of data on the relocated servers was apparently so sensitive that it could not be described in the US court filing, which redacts the sentence that describes what the servers contained. https://arstechnica.com/tech-policy/2023/09/us-government-slams-musk-in-court-filing-describing-chaotic-environment-at-x/ permalink fedilink source parent hideshow 4 child comments replies: [–] Maybe@lemm.ee 1 point 2 years ago (1 child) Isn’t all of it encrypted though? Like I understand physical access to servers is generally bad, but you’d think once the the things are unplugged it would be difficult to access the data again without bypassing encryption. I’m not a software engineer though permalink fedilink source parent hideshow 2 child comments replies: [–] DesertCreosote@lemm.ee 2 points 2 years ago I'm a security engineer, and encryption is great, but can be bypassed. Relying on encryption assumes it was implemented properly, that the system was shut down properly so all keys were flushed correctly, and the encryption algorithm doesn't have weaknesses. Generally if somebody dedicated enough can acquire physical access to a system, they can probably find a way into it given the right resources. Did that happen here? Probably not. Could it have? Absolutely. That's why most enterprises or government hard drives are shredded rather than just relying on them being wiped or encrypted. Encryption is part of the solution, but it's not automatically the complete solution. permalink fedilink source parent [–] alvvayson@lemmy.world -3 points 2 years ago Probably because the government is still illegally spying on citizens and they don't want the specifics to leak out. permalink fedilink source parent
[–] Maybe@lemm.ee 1 point 2 years ago (1 child) Isn’t all of it encrypted though? Like I understand physical access to servers is generally bad, but you’d think once the the things are unplugged it would be difficult to access the data again without bypassing encryption. I’m not a software engineer though permalink fedilink source parent hideshow 2 child comments replies: [–] DesertCreosote@lemm.ee 2 points 2 years ago I'm a security engineer, and encryption is great, but can be bypassed. Relying on encryption assumes it was implemented properly, that the system was shut down properly so all keys were flushed correctly, and the encryption algorithm doesn't have weaknesses. Generally if somebody dedicated enough can acquire physical access to a system, they can probably find a way into it given the right resources. Did that happen here? Probably not. Could it have? Absolutely. That's why most enterprises or government hard drives are shredded rather than just relying on them being wiped or encrypted. Encryption is part of the solution, but it's not automatically the complete solution. permalink fedilink source parent
[–] DesertCreosote@lemm.ee 2 points 2 years ago I'm a security engineer, and encryption is great, but can be bypassed. Relying on encryption assumes it was implemented properly, that the system was shut down properly so all keys were flushed correctly, and the encryption algorithm doesn't have weaknesses. Generally if somebody dedicated enough can acquire physical access to a system, they can probably find a way into it given the right resources. Did that happen here? Probably not. Could it have? Absolutely. That's why most enterprises or government hard drives are shredded rather than just relying on them being wiped or encrypted. Encryption is part of the solution, but it's not automatically the complete solution. permalink fedilink source parent
[–] alvvayson@lemmy.world -3 points 2 years ago Probably because the government is still illegally spying on citizens and they don't want the specifics to leak out. permalink fedilink source parent
[–] demlet@lemmy.world 13 points 2 years ago (1 child) You don't consider credit card info sensitive? May I have yours? permalink fedilink source parent hideshow 2 child comments replies: [+] alvvayson@lemmy.world -7 points 2 years ago (1 child) BS, I don't know if Twitter holds credit card data, but if they did, they would have needed to abide by PCI DSS rules, which requires encrypting the data in special hardware security modules. So no, moving those servers wouldn't put the data at risk. permalink fedilink source parent hideshow 2 child comments replies: [–] ramble81@lemm.ee 8 points 2 years ago encrypting the data in special hardware security modules Tell me you don't understand how PCI works without saying you don't understand how PCI works. Those systems can very much store PCI data and it's very much possible that those were the systems that contain information as most of the times it's on general servers. permalink fedilink source parent
[+] alvvayson@lemmy.world -7 points 2 years ago (1 child) BS, I don't know if Twitter holds credit card data, but if they did, they would have needed to abide by PCI DSS rules, which requires encrypting the data in special hardware security modules. So no, moving those servers wouldn't put the data at risk. permalink fedilink source parent hideshow 2 child comments replies: [–] ramble81@lemm.ee 8 points 2 years ago encrypting the data in special hardware security modules Tell me you don't understand how PCI works without saying you don't understand how PCI works. Those systems can very much store PCI data and it's very much possible that those were the systems that contain information as most of the times it's on general servers. permalink fedilink source parent
[–] ramble81@lemm.ee 8 points 2 years ago encrypting the data in special hardware security modules Tell me you don't understand how PCI works without saying you don't understand how PCI works. Those systems can very much store PCI data and it's very much possible that those were the systems that contain information as most of the times it's on general servers. permalink fedilink source parent
[–] SatanicNotMessianic@lemmy.ml 9 points 2 years ago (1 child) Personally identifiable information (PII) is any set of data that has a chance to uniquely identify a person, including name, address, credit card info, social security, etc. It can also include things like birthdate, city, IP address, and so on, depending on how the combination of data works. The general rule of thumb is that you want to aggregate out to the city level at least, or completely anonymize the data. These, I’m supposing, we’re raw records that contained account info. permalink fedilink source parent hideshow 2 child comments replies: [–] Maybe@lemm.ee 1 point 2 years ago Isn’t all of it encrypted though? Like I understand physical access to servers is generally bad, but you’d think once the the things are unplugged it would be difficult to access the data again without bypassing encryption. I’m not a software engineer though permalink fedilink source parent
[–] Maybe@lemm.ee 1 point 2 years ago Isn’t all of it encrypted though? Like I understand physical access to servers is generally bad, but you’d think once the the things are unplugged it would be difficult to access the data again without bypassing encryption. I’m not a software engineer though permalink fedilink source parent