Earlier quoted context omitted.
> You don't get to have your cake and eat it too. The way to do this is to start with 2 cakes. But where is Earth2?
I seem to recall Musk trying to get to Mars...
He's got 4 cakes. Maybe he'll eat one on the way.
Elon Musk emails employees about 'extensive and damaging sabotage' by employee
481–490 of 627 posts
Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee
#482I have no problem believing that a disgruntled employee sabotaged part of the production line. But I do have a problem believing that all of the problems since the Model 3 started production were caused by sabotage. I also have no problem believing that the disgruntled employee simply wanted to take revenge by sabotaging his/her employer -- that's not uncommon, and it should not be difficult to prove if it really hap…
> But I do have a problem believing that all of the problems since the Model 3 started production were caused by sabotage.
On reading your comment I re-read the letter to confirm that he doesn't imply this anywhere.
Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee
#483Earlier quoted context omitted.
This is a very naive comment. There will always be a small handful of engineers that can push the button to move code into PROD or even change code in PROD live. Ideally, with mature controls, the people in this list is short. But to jump to the conclusion that Tesla doesn't use good practises is very short sighted. Who's to say that external parties didn't target this person specifically because of their role/influe…
I think it's your comment that's naive. Mature organizations have strict separation of duties, and a great deal of oversight over code reviews and code deployment. It is becoming obvious that Tesla's focus is on execution speed and other aspects (in this case internal security) are suffering.
You mean all the mature organizations that have security breaches announced every day?
Most companies do not have good security. Even when they do, it's hard to get it right, especially for internal attacks. Don't underestimate what a single individual can do when they're already inside and well-informed.
Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee
#484I made this same comment on the other discussion. I find it concerning that one person was able to push malicious code to 'production'. To me, this suggests that Tesla, a company building highly sensitive software, does not employ basic branch policies. How is is it that these changes could have made it through a code review process and get deployed? If a company like Microsoft or Google announced that a disgruntled…
That is most companies. and Microsoft has such a shitty
security record so they don't really need any disgruntled employees.
Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee
#485Hard to judge whether this is true, but with billions of dollars in play I wouldn’t put it past human nature to do something immoral.
It's enough money to make someone amplify global warming concerns in the media. Then, every news article about climate change - and even very hot days - become an advertisement for the product.
Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee
#486Earlier quoted context omitted.
There were no malicious code changes, rather malicious and deliberate misconfiguration of the software.
That is not at all what the memo says. "Direct code changes"
Judging from their username, tslathrowaway31, this could be an insider who knows more than what's in the memo.
Regardless, I think configuration should be treated as code (use version control and reviews, write tests), since the damage you can do through misconfiguration is often as great as anything you can do with code.
Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee
#487Perhaps they should have better security measures?
If I understand correctly, Tesla cars can be updated OTA including critical functions, so someone who manages to insert a malicious software update might be able to kill everyone driving a Tesla at some moment, plus numerous bystanders.
Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee
#488Earlier quoted context omitted.
How the saboteur knew the passwords of all those users before? If it was a totally new user, shouldn't the system have a list of approved users and a strict protocol to validate a new user?
I'm baffled at your lack of imagination, but: keyloggers, unlocked terminals, API token sniffing from cookies, reactivated old accounts, changing the reviewing account id in the database, …
I'm baffled at your lack of imagination
What does being rude add to the discussion?
Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee
#489Earlier quoted context omitted.
> So he was able to sidestep the normal review process. He should not have been able to sidestep the normal review process . That's the problem in the first place. Even if you're from the sysadmin side. It should not be possible to do it. You may think that looks exaggerated but I've worked in two places where we implemented such a process, both of them far more boring than Tesla and, I suspect, far less money to bur…
I'm interested to know how you plan to keep someone with `wheel` access from doing anything on a server that they maintain. No, seriously.
What are you saying? That because perfect security is impossible, we should give up and do nothing?
It's possible a sysadmin with low-level access can exploit that and a variety of zero-day exploits and escalations of privilege in the layers above to systematically compromise the boot images, steal or falsify credentials and signing keys, and circumvent the safeguards and alarm systems which should be in place to prevent malicious modifications of the source code and the compiled binaries, while hiding his actions from his co-workers, sure whatever.
And if that's what happened to Tesla, wow, sucks to be them, that's amazing.
But if there are no safeguards, no review process, no alarm bells to go off and any damn person can submit malicious code effortlessly and they were basically working off the honor system... I'm going to blame the victim a little bit.
Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee
#490Earlier quoted context omitted.
That's all good and nice but in most cases, this is a matter of policy. If someone actively tries to circumvent the policy or the process, odds are that most software shops would fall victim to the same thing. Especially in the case of internal software. Even if you have a system that attempts to enforce the process, odds are that the system isn't without flaw and is not too hard to circumvent. Most businesses who's…
Self driving cars are both defense and security related.
Indeed they are.
Beginning with the simple workflow:
1. Get many burner phones for cash.
2. Get many prepaid credit card for cash.
3. Sign up for many self-driving car services.
4. Targeted denial of service.
(I'm avoiding the very-slow-cruise-missile scenario because nobody wants to think about it.)