To me this sounds like a major violation of SOX controls. If this is the case Tesla is in deep trouble with the SEC.
Elon Musk emails employees about 'extensive and damaging sabotage' by employee
341–350 of 627 posts
Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee
#342I made this same comment on the other discussion. I find it concerning that one person was able to push malicious code to 'production'. To me, this suggests that Tesla, a company building highly sensitive software, does not employ basic branch policies. How is is it that these changes could have made it through a code review process and get deployed? If a company like Microsoft or Google announced that a disgruntled…
> I find it concerning that one person was able to push malicious code to 'production'.
Production line software is almost certainly handled separately from the software that runs their vehicles, and isn't "production" in the usual web sense of being customer facing. This sounds more like someone messed with their factory automation setup.
Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee
#343I'm sorry but Musk's email is ridiculous and unprofessional, and the defenses here are extremely concerning. By ArsTechnica's count this is the 5th fire in the plant. 5th. That's insane. Report after report is that things continue to not go well and the email sent out reeks of paranoia and combined with other comments made recently are quite clearly dishonest. They aren't failing at the details of ramping a manufactu…
> When a spaceX rocket blew up, he claimed sabotage.
That is false. All they said was that they were looking at all option, he mentioned sabotage as an offhand example of what they were investigating and he explicitly said in that very first comment that they had no evidence.
After that the press and twitter got hold of it and blew up story.
SpaceX insisted again there was no sabotage and announced that the problem was about COPV tanks.
Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee
#344> As you know, there are a long list of organizations that want Tesla to die. Is it correct to use 'are' here instead of 'is'?
I'm not sure, but my hunch is either is OK. Compare: > There are a hundred organizations that want Tesla to die. > There is a hundred organizations that want Tesla to die.
... is ... list of organizations ...
... are ... organizations ...
Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee
#345> As you know, there are a long list of organizations that want Tesla to die. Is it correct to use 'are' here instead of 'is'?
I'm not sure, but my hunch is either is OK. Compare: > There are a hundred organizations that want Tesla to die. > There is a hundred organizations that want Tesla to die.
How many organizations? A hundred: plural. "There are a hundred organizations.."
How many lists? One: singular. "There is a list of a hundred organizations.."
Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee
#346Earlier quoted context omitted.
I think you misunderstand. Even with code review policies, there is still a short list of people who can push to production without going through code review. Not from a policy standpoint but from a security and access perspective.
The chain we had in ${BIGCORP}: Programmers: read-write to repository Staging team: read-only on repository, read-write to test servers and staging zone Deployment team: read-only on repository and staging zone, read-write to production It wouldn't prevent malicious code going out but at least would require a chain of cooperation between employees, which would be harder to achieve.
Did your staging or deployment team review code?
And what stops a single member of the staging or deployment team patching the build scripts, binaries or just installing their own software to a server?
Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee
#347Earlier quoted context omitted.
Yes, although it turns out their stream was using fake footage for one of the boosters
This is the closest that I've ever felt the need to call someone an idiot on the internet. Both boosters' feeds were fed from the same booster, i.e. we were seeing the same image twice. That is _not_ fake.
The footage itself was real video from a real camera, but the announcers said the footage was something different than it actually was. The YouTube _recording_ of the livestream was also edited after the fact without any mention that it no longer reflected the originally broadcast. While technically not 100% fake, I think at the very least it would be fair to call that misleading. If this is the closest you've ever come to calling someone on the internet an idiot, I applaud you for your restraint.
Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee
#348Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee
#349I made this same comment on the other discussion. I find it concerning that one person was able to push malicious code to 'production'. To me, this suggests that Tesla, a company building highly sensitive software, does not employ basic branch policies. How is is it that these changes could have made it through a code review process and get deployed? If a company like Microsoft or Google announced that a disgruntled…
This is a very naive comment. There will always be a small handful of engineers that can push the button to move code into PROD or even change code in PROD live. Ideally, with mature controls, the people in this list is short. But to jump to the conclusion that Tesla doesn't use good practises is very short sighted. Who's to say that external parties didn't target this person specifically because of their role/influe…
Fully agree. In an ideal world all of this would be locked down, but you've gotta be prerty naive to assume that everything is perfectly locked down.
There are areas that I couldn't push code willy nilly, namely in the security space. But I'd be willing to bet that a majority of teams at any bigN could have a single bad actor cause some damage... That's just the maturity of the industry.
Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee
#350Earlier quoted context omitted.
> There will always be a small handful of engineers that can push the button to move code into PROD or even change code in PROD live. There is really no reason for this to be the case. Certainly all code that actually runs on the car can be required to go through review and be verifiably built, even if server code standards are more lax.
I think you misunderstand. Even with code review policies, there is still a short list of people who can push to production without going through code review. Not from a policy standpoint but from a security and access perspective.
> Even with code review policies, there is still a short list of people who can push to production without going through code review.
That's completely unnecessary and should not be the case. If you need something pushed quickly, you can get a colleague with review bit and get them to ack for "urgency" reasons after a quick lookover.