It's not the tweets, it's the retweets. People's tweets on Twitter are usually not that bad. Their retweets, and, for slightly crazier people, their quote tweets are what contain the bizarre mischaracterizations, because they're the pulls from the top of the attention-seeking crab bucket. 

I run a company that sells security software to large enterprises. I remember seeing this (since deleted) post Eliezer retweeted last year during the Crowdstrike blue screen incident, and thinking: "Am I crazy? What on earth is this guy talking about?"

The audit requirements Mark is talking about don't exist. He just completely made them up. ChatGPT's explanation here is correct; even if you're selling to the federal government^[1], there's no "fast track" for big names like Crowdstrike. At absolute maximum your auditor is going to ask for evidence that you use some IDS solution, and you'll have to gather the same evidence no matter what solution you're using. 

Now, Yudkowsky is not a mendacious person, and he isn't going to pump misinfo into the ether himself. But naturally if anybody goes on Twitter long enough they're gonna see stuff like this, and it will just feel plausible to you. It will pass whatever cogsec antimalware blacklists & heuristics you've developed for assessing the credibility of things on the internet.

Probably because, like, if you overheard this kind of thing at a party, it would be credible! It's only on this platform, where people are literally stepping over one another to concoct absurd lies for attention, where people are additionally incentivized to present as having personal expertise in the lie to go slightly more viral, and then an algorithm is selectively boosting the people that do that well enough and effectively enough to the top of your feed, that you encounter this nonsense. And then it goes into your world model, and the next time you see someone claim some crazy thing about how the food industry is in cahoots with Big Chicken you're more likely to believe it, etc. etc.

1. ^{^}

   And the vast majority of software companies, to be clear, don't have to do anything like FedRAMP. The largest and most ubiquitous compliance frameworks, like SOC2 or ISO 27001, are self-imposed standards maintained by nonprofits like the AICPA and have nothing to do with the government.