Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Elon Musk emails employees about 'extensive and damaging sabotage' by employee

cnbc.com

Post reply on HN
Print view View original

511–520 of 627 posts

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#511

Post by gnode »

_Codemonkeyism wrote: post #382
gnode wrote: post #374

Earlier quoted context omitted.

Can you explain how Sarbanes-Oxley applies to the situation of an employee sabotaging a production line? Specifically how it would inherently imply wrongdoing on Tesla's part.

Part of Sarbanes-Oxley is to make sure IT systems are not manipulated. This includes regulating access to systems and controlling software development. Mainly this means, people who write code can't push code into production systems on their own. One person writes a requirement, this needs to be OKed by another person, then a third person writes this code and it's pushed to production. Controls are setup - e.g. check…

> Part of Sarbanes-Oxley is to make sure IT systems are not manipulated.

I would expect that there are limits to this. If a rogue employee engages in fraudulent behaviour against you, using "false usernames" to subvert your security as this employee reportedly did, then I don't see how the organisation could be considered responsible.

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#512

Post by Hernanpm »

flyingswift wrote: post #65

I made this same comment on the other discussion. I find it concerning that one person was able to push malicious code to 'production'. To me, this suggests that Tesla, a company building highly sensitive software, does not employ basic branch policies. How is is it that these changes could have made it through a code review process and get deployed? If a company like Microsoft or Google announced that a disgruntled…

That happens at G too, I remember the case where all open wifi were tracked by street view software while mapping streets, and it led to G being sued.

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#513

Post by mkstowegnv »

rplst8 wrote: post #95
ricardobeat wrote: post #53

Earlier quoted context omitted.

Fifteen years ago Echelon, NSA's email surveillance program, was considered a wild conspiracy on par with chemtrails. I think this kind of 'paranoia' is absolutely justified in today's world.

Yeah, as far as I'm concerned, the argument "you sound like a conspiracy theorist" doesn't hold water any more.

I hold to my own metaconspiracy theory - that there is a conspiracy to create and promote conspiracy theories. It's Russians and rogue libertarians who want us to fear and hate each other and our government. I mean have you seen all the slick, high production YouTube videos describing the most ridiculous paranoid nonsense? Who's paying for all that? But I have only indirect evidence so I am only metaworried about it.

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#514

Post by ballenf »

molteanu wrote: post #233

Searching For “Production Hell” At Ford’s Kentucky Truck Plant [0] https://dailykanban.com/2018/02/searching-production-hell-fo...

Thanks for posting that. Great article. I was blown away at the open access Ford grants to visitors and media at its most advanced production facility. ("Most advanced" is my assumption given that this plant produces Ford's highest margin vehicles.)

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#515

Post by sanderjd »

SolarNet wrote: post #120
sanderjd wrote: post #100

Earlier quoted context omitted.

> There will always be a small handful of engineers that can push the button to move code into PROD or even change code in PROD live. There is really no reason for this to be the case. Certainly all code that actually runs on the car can be required to go through review and be verifiably built, even if server code standards are more lax.

I think you misunderstand. Even with code review policies, there is still a short list of people who can push to production without going through code review. Not from a policy standpoint but from a security and access perspective.

No I understood your point. I just don't think it must be true, in the strong formulation you are using, that there must be a short list of people who can independently cause new code to run on a vehicle. I believe security and access can be set up such that no one person can accomplish that. It may be very difficult to set that up, but it seems worthwhile in this case.

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#516

Post by woliveirajr »

arcticfox wrote: post #495
mieseratte wrote: post #451

Earlier quoted context omitted.

> If someone actively tries to circumvent the policy or the process, odds are that most software shops would fall victim to the same thing. Too often the focus is entirely on outside attacks, with little consideration given to insider attacks. Previous job was at a cyber security firm. We'd routinely come under attack from criminal and, we believed, occasional nation state attacks as our researchers attributed a few…

> Then you'd come back from lunch and find the mantrap doors propped open, or someone left a workstation unlocked with root access to something important, or random guests just wandering around. It's a miracle we never were compromised by a disgruntled employee (of which there were many). Maybe not the most technical solution to this, but one of my previous employers had a workplace culture of setting the desktop bac…

Doesn't even need to use unicorns or something gross, the simple fact that the person was perceived as a "he got caught" is enought. Yes, shaming has its uses...

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#517

Post by avs733 »

Diederich wrote: post #476
avs733 wrote: post #213

Earlier quoted context omitted.

The best counter argument you have is sarcasm? They had their 5th body shop fire yesterday. Immediately they implied the saboteur was to blame. What is more realistic I don't short TSLA, I don't hold TSLA stock or options. I don't want to be involved with it in anyway shape or form.

> The best counter argument you have is sarcasm? Yeah, I was tired and irratible when I wrote that. As quotes, it's actuly true: his small but extremely vocal 'cult' following is a big problem. I still don't agree with most of what his most strident critics say. I think he's being unusually straightforward in thought and communication.

Fair, I have definitely done the same thing.

Friends?

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#518

Post by ckastner »

slivym wrote: post #454
ckastner wrote: post #295

> Looking forward to having a great week with you as we charge up the super exciting ramp to 5000 Model 3 cars per week! This was actually the most surprising part to me -- it appears that they believe that they will actually make the 5K/week goal by the end of this quarter. As to the allegations... the email doesn't say much, but it sounds like a disgruntled employee grabbing data to me, and perhaps modifying some O…

I don't know if you've worked in a large corporation, but during my time in one we would constantly get senior management talking about how we were doing really well and going to do great things and we were making history.... whilst goals and deadlines were missed constantly and everyone knew we had no chance of meeting them. We had a product delayed by 4 years and when it finally shipped the head of software sent ou…

Yeah but in this case, this is not a goal, but the goal everyone both inside and outside has been monitoring closely now.

It could be bullshit, it could be a PR stunt... but to what end? We're going to find out the real number on August 1st anyway, when TSLA reports their Q3 data.

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#519

Post by sanderjd »

XorNot wrote: post #453
tomp wrote: post #376

Earlier quoted context omitted.

So the deployment team could write and push malicious code to production?

They pretty much always can. Sure sure you can imagine some perfect system which would mitigate it but no one - definitely not your bank - is doing that. It very much sounds like thats the case here - production code was edited, and subsequent auditing has found what should've been deployed and what is deployed differs.

Lots of people do work really hard on mitigating this problem. It's a tough and constant battle, but that doesn't mean you have to throw your hands up and not bother working on it. I'm sure you're right that my bank isn't working to mitigate insider threat to the extent I'd like, but Tesla's code is more safety critical than my bank and I think it would be worth their while to work very hard on keeping this from happening with their computer-on-wheels.

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#520

Post by sanderjd »

sokoloff wrote: post #410
masklinn wrote: post #350

Earlier quoted context omitted.

> Even with code review policies, there is still a short list of people who can push to production without going through code review. That's completely unnecessary and should not be the case. If you need something pushed quickly, you can get a colleague with review bit and get them to ack for "urgency" reasons after a quick lookover.

I wrote the policy for our company (and got it through the audit and compliance processes, including SOX404 and PCI-DSS) that specifically and intentionally allows a specific group to take whatever action they determine is appropriate in the face of a production emergency, provided they declared the emergency, their intent, and documented/published what they did afterwards. I believe this policy, used only a few time…

This is great, thank you. Are you able to say what company you work for?
Post reply on HN