Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Uber Paid Hackers to Delete Stolen Data on 57M People

bloomberg.com

Post reply on HN
Print view View original

471–480 of 606 posts

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#471

Post by wiz21c »

fovc wrote: post #229
briandear wrote: post #199

Earlier quoted context omitted.

And then we can go back to getting ripped off by taxis. I’ve lost more money in taxi rip offs than I ever spent on Uber. Other than the sexist nonsense of the CEO, there really is an irrational hatred of Uber. Are many of us secretly moonlighting as cab drivers? Uber’s nonsense is minuscule compared to generations of taxi corruption. This isn’t me excusing Uber but it does seem like many people, especially Europeans…

Most European cities I've been in have way better public transportation than any US city, which makes Uber a much less valuable proposition. On top of that, taxis tend to be more professional, so even as a high-end option uber is less compelling.

taxis are also participating in the social security system : they pay taxes and therefore get social protection. Uber drivers don't get that. So basically Uber is pulling social security standards down. I understand they do fill a niche and they provide good service, but they have to play by the rules (esp. when the rules are here to help people). Now you can always complain that the social security system is not efficient but that's an entirely different debate

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#472

Post by flexie »

harry8 wrote: post #106

Every day we see more evidence that boards of directors and senior management should be personally accountable financially and with respect to their liberty for the company they are managing or overseeing doing foul things that they ought to have known. The "I didn't know, I just took a vast salary to play golf" argument should not be any kind of defence. If there is the real prospect of going to jail, golfers will r…

There is personal liability for board members and management boards (CEO etc.) in many (most?) jurisdictions, usually including for some things that they should have known but didn't know, typically if the "not knowing" part can be characterized as gross negligent.

Also, the personal liability for board members and managers is something that is exceedingly pursued by shareholders and creditors (for the financial liability) and prosecutors (for the criminal liability) compared to how it used to be.

I don't think it matters much, though.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#473

Post by dannyw »

Scoundreller wrote: post #164
mewmew wrote: post #18

Earlier quoted context omitted.

This would have been interesting if GDPR was applied. https://www.gdpr.associates/data-breach-penalties/ "There will be two levels of fines based on the GDPR. The first is up to €10 million or 2% of the company’s global annual turnover of the previous financial year, whichever is higher. The second is up to €20 million or 4% of the company’s global annual turnover of the previous financial year, whichever is higher.…

> The first is up to €10 million or 2% of the company’s global annual turnover of the previous financial year, whichever is higher. Why do big firms get off easier than the smaller firms?

The fines say “up to”. I don’t think a small mom n pop shop will get fined 10 million.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#474

Post by katastic »

ibmthrowaway218 wrote: post #452
brianpan wrote: post #409

Earlier quoted context omitted.

I think the commenter meant the new CEO will not tolerate unethical behavior.

The new CEO will not tolerate new unethical behaviour. Hopefully he will also slowly eradicate the existing unethical behaviour.

The new CEO will fix everything just like the last 3 GM CEO's changed their corporate culture and stopped them from making cars that kill teenagers...

... crap. My kids won't be buying a GM car.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#475

Post by JonoBB »

ryandrake wrote: post #470
komali2 wrote: post #44

Earlier quoted context omitted.

This is so gob-smackingly uncommon I started asking "do you require 2fa for your github accounts" as part of my interview questions when I was looking for jobs (i.e. I'd ask my interviewers). I don't know how to feel knowing that there is even one software-focused company out there that doesn't enforce 2fa on its github accounts. Like... how?! Why?!

Unless you're talking about a 3 person start-up, wouldn't the use of github itself be a red flag? If you're a software company, you live and die by your source code. Why on earth would you rely on some other company to hold it for you? This seems as ridiculous as doing your bookkeeping on Google Docs. I've never once worked in a company that permitted source code to leave the company network.

What makes you think you (or most devs for that matter) know more about security than Github's security team?

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#476

Post by ryanplant-au »

ryandrake wrote: post #470
komali2 wrote: post #44

Earlier quoted context omitted.

This is so gob-smackingly uncommon I started asking "do you require 2fa for your github accounts" as part of my interview questions when I was looking for jobs (i.e. I'd ask my interviewers). I don't know how to feel knowing that there is even one software-focused company out there that doesn't enforce 2fa on its github accounts. Like... how?! Why?!

Unless you're talking about a 3 person start-up, wouldn't the use of github itself be a red flag? If you're a software company, you live and die by your source code. Why on earth would you rely on some other company to hold it for you? This seems as ridiculous as doing your bookkeeping on Google Docs. I've never once worked in a company that permitted source code to leave the company network.

Because you trust their security better than your own, which at any organisation without a dedicated security team seems like a reasonable decision. I live and die by my money, too, and I give that to a private company to hold rather than protect it myself.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#477

Post by gjjrfcbugxbhf »

ryandrake wrote: post #469
ctennis1 wrote: post #200

Earlier quoted context omitted.

Yep, but think of all of the private keys and tokens used in automation servers (think CI) for pulling down source. Those don't have 2FA - because they don't login - but they have full access to most source. In an organization of about 200 engineers across various products, 1000+ github repos, and 10 or so different CI systems. We enforce 2FA at github. I can still easily see how someone could easily gain access to s…

> In an organization of about 200 engineers across various products, 1000+ github repos Wait, what? That's 5+ repos per engineer. What on earth would warrant that level of granularity? I've only worked once in my career in a place that used more than 2-3 repositories total, and that was a "MegaTechGiant" with thousands of engineers.

It depends upon the culture. Some places favour a project repo others a repo per microservice/job.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#478

Post by woolvalley »

ryandrake wrote: post #470
komali2 wrote: post #44

Earlier quoted context omitted.

This is so gob-smackingly uncommon I started asking "do you require 2fa for your github accounts" as part of my interview questions when I was looking for jobs (i.e. I'd ask my interviewers). I don't know how to feel knowing that there is even one software-focused company out there that doesn't enforce 2fa on its github accounts. Like... how?! Why?!

Unless you're talking about a 3 person start-up, wouldn't the use of github itself be a red flag? If you're a software company, you live and die by your source code. Why on earth would you rely on some other company to hold it for you? This seems as ridiculous as doing your bookkeeping on Google Docs. I've never once worked in a company that permitted source code to leave the company network.

You have a full checkout on your laptop and probably a whole bunch of other developers laptops. With git you can also have random backup computers do the same thing! You don't have to rely on github alone, for this.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#479

Post by ransom1538 »

rickcnagy wrote: post #16

> Here’s how the hack went down: Two attackers accessed a private GitHub coding site used by Uber software engineers and then used login credentials they obtained there to access data stored on an Amazon Web Services account that handled computing tasks for the company. From there, the hackers discovered an archive of rider and driver information. Later, they emailed Uber asking for money, according to the company. D…

"Don't check secrets into VCS, folks! "

I suppose? But at this point they have your code base. You are so owned at that point.

Re: Uber Paid Hackers to Delete Stolen Data on 57M People

#480

Post by netsharc »

briandear wrote: post #199
HenryBemis wrote: post #168

Earlier quoted context omitted.

What? Uber acted in an unethical manner? Seriously, is anyone surprised? I kinda hope (but not really) that they get hacked again in June 2018 and play the same trick.. us in the EU will have a party on Uber's corpse over GDPR.

And then we can go back to getting ripped off by taxis. I’ve lost more money in taxi rip offs than I ever spent on Uber. Other than the sexist nonsense of the CEO, there really is an irrational hatred of Uber. Are many of us secretly moonlighting as cab drivers? Uber’s nonsense is minuscule compared to generations of taxi corruption. This isn’t me excusing Uber but it does seem like many people, especially Europeans…

AirBnB might solve the hotel problem, but left unregulated, they would (and did) stress the rental market. Not just in Europe, but also in San Francisco.

> regulatory handouts to the privileged classes

And unregulated AirBnB is basically a way for rich people (privileged classes) to buy apartments in cities and turn them to money-making machines, to the detriment of the lower-incomed renter (lower-incomed because they can only afford to rent, not to buy their own place).

Post reply on HN