Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Elon Musk emails employees about 'extensive and damaging sabotage' by employee

cnbc.com

Post reply on HN
Print view View original

561–570 of 627 posts

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#561

Post by alxlaz »

daemin wrote: post #552
softawre wrote: post #539

Earlier quoted context omitted.

This is how it works in normal software companies too. I never see the credentials for my employees.

My point is, as a manager one can request that their subordinates get credentials to access systems. Therefore as a manager you could create a fictitious person (or use one that's recently left the company), and have them be given credentials to access those systems. Then you could use that fictional identity to do whatever nefarious things you want to do. Then again it could be just as simple to create an alternate…

In a normal company, you could absolutely not create a fictitious account that way, or re-use the credentials of someone who just left. But more important, there is a very, very long way from having created a fictitious person to being able to push stuff to production in their name.

The former restriction is maybe difficult enough to efficiently implement in an organization that it's excusable (we have a scheme for it at $work, but it unfortunately means that sometimes people show up at work and the paperwork isn't ready yet and some of the accounts they need aren't yet ready).

The latter, on the other hand, is security 101 and not implementing it on the production floor is just irresponsible. I really hope it's not what happened.

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#562

Post by daemin »

alxlaz wrote: post #561
daemin wrote: post #552

Earlier quoted context omitted.

My point is, as a manager one can request that their subordinates get credentials to access systems. Therefore as a manager you could create a fictitious person (or use one that's recently left the company), and have them be given credentials to access those systems. Then you could use that fictional identity to do whatever nefarious things you want to do. Then again it could be just as simple to create an alternate…

In a normal company, you could absolutely not create a fictitious account that way, or re-use the credentials of someone who just left. But more important, there is a very, very long way from having created a fictitious person to being able to push stuff to production in their name. The former restriction is maybe difficult enough to efficiently implement in an organization that it's excusable (we have a scheme for i…

So what are the odds then that they created a new user account on some local machine and used that to make the changes?

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#563

Post by pokemongoaway »

nixpulvis wrote: post #179
pokemongoaway wrote: post #45

Earlier quoted context omitted.

Everyone whose speech you don't like in 2018 is "literally" Trump, says the left and its proponents. What's your point, that his paranoia should be treated and he should hand his company over to the government? Either he is too careful in his speech or he is too paranoid - you can't have it both ways.

The left is pretty screwed up these days, but not as badly as the right. This email from Musk isn't at all the same as what we hear from the Trump camp. Sure he's talking about a conspiracy, but it's pretty reasonable, unlike the Trump conspiracies.

Yet I get down-voted to oblivion without reason or evidence :P

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#564

Post by SolarNet »

falcolas wrote: post #146
SolarNet wrote: post #120

Earlier quoted context omitted.

I think you misunderstand. Even with code review policies, there is still a short list of people who can push to production without going through code review. Not from a policy standpoint but from a security and access perspective.

Which indicates a different problem if the sabatuer was on that short list. And in this day and age of cryptographically signed commits, the number of people who could do this should go down even further. Given this, I think it’s much more likely there were few or bad controls, than a person in an incredibly privileged position working in the margins.

Someone builds the code, it doesn't have to be committed.

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#565

Post by alxlaz »

daemin wrote: post #562
alxlaz wrote: post #561

Earlier quoted context omitted.

In a normal company, you could absolutely not create a fictitious account that way, or re-use the credentials of someone who just left. But more important, there is a very, very long way from having created a fictitious person to being able to push stuff to production in their name. The former restriction is maybe difficult enough to efficiently implement in an organization that it's excusable (we have a scheme for i…

So what are the odds then that they created a new user account on some local machine and used that to make the changes?

If we're talking about changes to the software that's used to manufactures vehicles that are driving on public roads, I sure as hell hope the odds are zero.

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#566

Post by hateful »

From: Elon Musk

To: Everybody

Subject: Some concerning news

June 17, 2018

11:57 p.m.

I can't stand it, I know you planned it I'mma set it straight, this Watergate I can't stand rockin' when I'm in here 'Cause your crystal ball ain't so crystal clear So while you sit back and wonder why I got this fuckin' thorn in my side Oh my god, it's a mirage I'm tellin' y'all, it's sabotage So, so, so, so listen up, 'cause you can't say nothin' You'll shut me down with a push of your button But, yo, I'm out and I'm gone I'll tell you now, I keep it on and on 'Cause what you see, you might not get And we can bet, so don't you get souped yet Scheming on a thing, that's a mirage I'm trying to tell you now, it's sabotage Why Our backs are now against the wall Listen all y'all, it's a sabotage Listen all y'all, it's a sabotage Listen all y'all, it's a sabotage Listen all y'all, it's a sabotage I can't stand it, I know you planned it I'mma set it straight, this Watergate But I can't stand rockin' when I'm in this place Because I feel disgrace because you're all in my face But make no mistakes and switch up my channel I'm Buddy Rich when I fly off the handle What could it be, it's a mirage You're scheming on a thing, that's sabotage

Thanks for working so hard to make Tesla successful, Elon

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#567

Post by brianpan »

kchr wrote: post #546
nmeofthestate wrote: post #482

Earlier quoted context omitted.

> But I do have a problem believing that all of the problems since the Model 3 started production were caused by sabotage. On reading your comment I re-read the letter to confirm that he doesn't imply this anywhere.

Sure, but he seems very eager to steer the thing towards external interests and sabotage rather than this being an isolated incident. Sounds to me that he is fishing for scapegoats in general...

I read it as a general motivational tactic. Everyone else is out to get us. We need to pull together. They want us to fail, let's prove them wrong. From coaches or CEOs. This is essentially newspaper clippings in the locker room.

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#568

Post by woodandsteel »

lovich wrote: post #18
woodandsteel wrote: post #13

Earlier quoted context omitted.

This was my thought exactly. Sounds like they hired an ex-CIA field operative who was expert at what he was doing.

>"This included making direct code changes to the Tesla Manufacturing Operating System under false usernames and exporting large amounts of highly sensitive Tesla data to unknown third parties." What in here indicates ex-CIA operative to you? Theres no need to add any conspiracy around it. Adding a commit with a different username is incredibly trivial to anyone who can run commit with the command line, i.e. 99% of s…

What matters is motivation. A person who is trained in sabotage, is used to doing it, and is being well-paid to do it is a lot more likely to so behave than a regular person who knows they will likely go to jail if they get caught. And there are lots of actors out there who have both the funds and motivation to hire such a person.

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#569

Post by therealdrag0 »

hateful wrote: post #566

From: Elon Musk To: Everybody Subject: Some concerning news June 17, 2018 11:57 p.m. I can't stand it, I know you planned it I'mma set it straight, this Watergate I can't stand rockin' when I'm in here 'Cause your crystal ball ain't so crystal clear So while you sit back and wonder why I got this fuckin' thorn in my side Oh my god, it's a mirage I'm tellin' y'all, it's sabotage So, so, so, so listen up, 'cause you ca…

I don't get it.

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#570

Post by toddh »

cottsak wrote: post #84
flyingswift wrote: post #65

I made this same comment on the other discussion. I find it concerning that one person was able to push malicious code to 'production'. To me, this suggests that Tesla, a company building highly sensitive software, does not employ basic branch policies. How is is it that these changes could have made it through a code review process and get deployed? If a company like Microsoft or Google announced that a disgruntled…

This is a very naive comment. There will always be a small handful of engineers that can push the button to move code into PROD or even change code in PROD live. Ideally, with mature controls, the people in this list is short. But to jump to the conclusion that Tesla doesn't use good practises is very short sighted. Who's to say that external parties didn't target this person specifically because of their role/influe…

You're describing how websites work, but that's not how embedded systems work, especially those were lives are it risk. If this happened then it can only be because good practices were not followed.
Post reply on HN