I have contacts in the security team of most banks in Australia. Happy to help
Ask HN: I work for consulting firm that's illegally moving bank code to GitHub
41–50 of 82 posts
Re: Ask HN: I work for consulting firm that's illegally moving bank code to GitHub
#42As a consultant, this is why it is a good idea to have a corporate entity to absorb contractual liability...and why it is a good idea for that corporate entity to have no assets. Practically speaking, and skipping the 'hire a lawyer' part. It is likely that if there is legal action, it will be directed at the consulting company first and foremost because it is likely to have deeper pockets and be backed by an insuran…
Yes, what you are saying is true and that is indeed how I have worked in financial industries. I have my own ACN (C-Corp) consulting company with Indemnity/Liability insurance through which I work.
However this muddies up as I consult to a consulting company which in turn consults to the bank. I was informed by the Ombudsman that this was a common way to work in Silicon Valley and US has laws that clarifies it however Australia has not updated the laws regarding this "double employment"
Re: Ask HN: I work for consulting firm that's illegally moving bank code to GitHub
#43Earlier quoted context omitted.
100% public github because they want to give access to new employees who do not have access to enterprise system.
Please tell me you're not saying they're using a public repository (one reachable to anyone, even people not logged in to GitHub).
Sorry, that's not what I meant. I mean *.github.com and NOT an enterprise level private repository.
If you go to the company's public github & bitbucket profile you cannot see the project but you can see all the devs and all these devs have access to the code.
The logic is: All the employees are able to work with minimal delay (caused by background checks)
Re: Ask HN: I work for consulting firm that's illegally moving bank code to GitHub
#44A word of warning - it's quite straightforward to do a Google search for 'site:github.com {bank_name}' for the large Australian banks, and find a repository that looks like the one you describe. You might want to contact the HN admins and ask them to completely scrub this entire thread, as it could well get you into trouble.
I don't get your comment. Assuming we are not talking about public repos here. OP's employer did set up a private github repo where contractors collaborate on bank's code. This cannot be searched by google. The problem OP has is that the code should not be hosted outside bank's own infrastructure and contractors should not have access before they pass background checks. According to my understanding.
>OP's employer did set up a private github repo where contractors collaborate on bank's code.
This is correct. They are not doing anything criminal. They just want to make sure all employees start working from Day 0. However this is illegal and I refused to push my code out of the intranet
Re: Ask HN: I work for consulting firm that's illegally moving bank code to GitHub
#45I am not clear on one important detail: Is the code being pushed to a public or private GitHub repository? In any case, there are 2 issues: 1. Your employer (the consulting company) does not want to pay you for the work that you have done. 2. Your current assignment involves supposedly illegal activities (putting the customer's (i.e. bank's) code to GitHub) in which you do not want to participate. In order to resolve…
1. Theoretically I am the asshole. I refused to push the code to github and the company refused to pay me.
2. Yes, I refused to do it until proper channels were established but I ended up looking like a sore thumb when other employees didn't mind pushing/pulling from github.com via wifi hotspots.
I can talk to the bank, I can quit the job but the bottom line is that I will be without any cash inflow. My lawyer said that the consulting company is one of the biggest one and they will make sure that I don't have another job (Which is kind of true because of reference checks)
Re: Ask HN: I work for consulting firm that's illegally moving bank code to GitHub
#46As a consultant, this is why it is a good idea to have a corporate entity to absorb contractual liability...and why it is a good idea for that corporate entity to have no assets. Practically speaking, and skipping the 'hire a lawyer' part. It is likely that if there is legal action, it will be directed at the consulting company first and foremost because it is likely to have deeper pockets and be backed by an insuran…
Yes, what you are saying is true and that is indeed how I have worked in financial industries. I have my own ACN (C-Corp) consulting company with Indemnity/Liability insurance through which I work. However this muddies up as I consult to a consulting company which in turn consults to the bank. I was informed by the Ombudsman that this was a common way to work in Silicon Valley and US has laws that clarifies it howeve…
Thanks. I tried to avoid getting too specific since I knew Australian law would be different, i.e. in the US the normal form of protection would be an LLC or an S-corp (tax pass through closely held entity) and a consulting firm in the US would very rarely be a C-corp (taxable income at both corporate and individual levels).
What employment means is also different. A person consulting to a consulting company that consults to a bank would have no employment relationship with either the bank or its direct consultant. The person might have an employment relationship with their own company that was contracted to the bank's direct consultant.
All of which ought to be governed by contracts...which I failed to mention, but I'd not be surprised it they were in play here.
Re: Ask HN: I work for consulting firm that's illegally moving bank code to GitHub
#47I would use the consulting company's open door policy and go up the chain... right to the country lead partner and mention this to them in writing. Believe it or not ethics is extremely important to consulting companies as trust and future work depends on this - and bring up any fears of being dismissed for bringing this up to their attention.
Re: Ask HN: I work for consulting firm that's illegally moving bank code to GitHub
#48Earlier quoted context omitted.
Yes, what you are saying is true and that is indeed how I have worked in financial industries. I have my own ACN (C-Corp) consulting company with Indemnity/Liability insurance through which I work. However this muddies up as I consult to a consulting company which in turn consults to the bank. I was informed by the Ombudsman that this was a common way to work in Silicon Valley and US has laws that clarifies it howeve…
Thanks. I tried to avoid getting too specific since I knew Australian law would be different, i.e. in the US the normal form of protection would be an LLC or an S-corp (tax pass through closely held entity) and a consulting firm in the US would very rarely be a C-corp (taxable income at both corporate and individual levels). What employment means is also different. A person consulting to a consulting company that con…
Off topic: It would be good to have C-Corp and be taxable at both corporate and individual levels because companies pay a flat tax while individuals are tiered. This way we can choose our salary and leave the rest in company.
This however severely complicates cases like mine which has three pass-thru contracts
Re: Ask HN: I work for consulting firm that's illegally moving bank code to GitHub
#49Earlier quoted context omitted.
Please tell me you're not saying they're using a public repository (one reachable to anyone, even people not logged in to GitHub).
could be the repos at https://github.com/WestpacCXTeam
I vouched for this because it's a fair point to make, and also because it can be 200% debunked:
1. That repo links to a publicly-viewable website, I'm seeing files in the list from 9 months ago (way long enough), and GitHub has a very clear, very well-oiled DMCA process. This is up because it's okay.
2. From https://news.ycombinator.com/item?id=13682657 (nearby this thread):
> If you go to the company's public github & bitbucket profile you cannot see the project but you can see all the devs and all these devs have access to the code.
IOW, it's a private repo hosted on GitHub. «The code is safe from the public» but the contractor's actions still squarely violate the security guidelines for the project such as no USB drive access (!) (https://news.ycombinator.com/item?id=13679303).
The OP qualified this fairly explicitly here: https://news.ycombinator.com/item?id=13682501
Re: Ask HN: I work for consulting firm that's illegally moving bank code to GitHub
#50Earlier quoted context omitted.
it's a public repo https://news.ycombinator.com/item?id=13679334
Let the hunt begin!
To everyone worried and/or curious, the code is in a private repo. https://news.ycombinator.com/item?id=13680180