371–380 of 627 posts
Earlier quoted context omitted.
This is an absolutely vile personal attack. This is the poison contained in the blooming flower of the internet.
The poison of the internet thrives on 140 characters or less, it facilitates lies wonderfully. The truth needs more words. Twitter is Musk's preferred medium. Trump's too.
Earlier quoted context omitted.
This is a very naive comment. There will always be a small handful of engineers that can push the button to move code into PROD or even change code in PROD live. Ideally, with mature controls, the people in this list is short. But to jump to the conclusion that Tesla doesn't use good practises is very short sighted. Who's to say that external parties didn't target this person specifically because of their role/influe…
"There will always be a small handful of engineers that can push the button to move code into PROD" I have very different experiences from a SEC regulated company. With SOX there are controls to prevent such a thing to happen. If this is a SOX breakage, Tesla is in deep trouble with the SEC.
Earlier quoted context omitted.
I think you misunderstand. Even with code review policies, there is still a short list of people who can push to production without going through code review. Not from a policy standpoint but from a security and access perspective.
> Even with code review policies, there is still a short list of people who can push to production without going through code review. That's completely unnecessary and should not be the case. If you need something pushed quickly, you can get a colleague with review bit and get them to ack for "urgency" reasons after a quick lookover.
Often it boils down to not taking sufficient measures against social engineering. In this case the claim is they used fake usernames - most places I've worked, successfully getting a fake account if you already work there would tend to "only" require a willingness to lie on a form or two ("fake" a contractor) and then request elevated privileges. Very few places I've done work requires sufficient checks or counter-signatures to require additional accomplices or make it harder than that. They do exist, but they're rare.
The state of security most places is quite depressing at times. Then again, most of the time it's enough.
Earlier quoted context omitted.
I think you misunderstand. Even with code review policies, there is still a short list of people who can push to production without going through code review. Not from a policy standpoint but from a security and access perspective.
The chain we had in ${BIGCORP}: Programmers: read-write to repository Staging team: read-only on repository, read-write to test servers and staging zone Deployment team: read-only on repository and staging zone, read-write to production It wouldn't prevent malicious code going out but at least would require a chain of cooperation between employees, which would be harder to achieve.
Earlier quoted context omitted.
This is a very naive comment. There will always be a small handful of engineers that can push the button to move code into PROD or even change code in PROD live. Ideally, with mature controls, the people in this list is short. But to jump to the conclusion that Tesla doesn't use good practises is very short sighted. Who's to say that external parties didn't target this person specifically because of their role/influe…
Why is it naive to expect there not to be a single point of failure like that? Code reviews are a thing.
Everyone's reaction to this seems to be "He is crazy / paranoid". He gave very specific examples of things this person did. If you were someone with a large position against Telsa, or a competing manufacturer, or an oil / gas company finally picking things up after a terrible oil price collapse, yeah maybe it makes sense to go mess things up subtly enough that the company slips a little bit closer to bankruptcy? I'm…
This is the crazy thing about the stock market in general, it incentivizes you to cheat and get dirty in a lot of ways when a large amount of your money is in it.