Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Dropbox account gave me stomach ulcers

reddit.com

Post reply on HN
Print view View original

81–90 of 129 posts

Re: A Dropbox account gave me stomach ulcers

#81

Post by weystrom »

n00b123 wrote: post #35
doctor_eval wrote: post #24

I actually have had the reverse experience. My company was acquired 18 months ago. We were the smaller company, about 1/4 the size, and as the founder/CTO, I expected the acquiring company to be all over us. I mean, we had a pretty tight operation but there was only so much 16 people could achieve. There were plenty of things we could improve, and I was looking forward to the resources and experience of this bigger c…

> Service passwords are still stored in clear text in the corporate wiki. I know this painfully well :(. Can you recommend some good solution? Ideally open source and self hosted, instead of cloud password manager.

https://github.com/gopasspw/gopass

Crossplatform, git versioning, gpg security (allows you to integrate with smartcards and tokens that you might already have in place for your employees).

Decent UX too, works with clipboard, supports totp.

Re: A Dropbox account gave me stomach ulcers

#82

Post by beardedman »

Tistron wrote: post #64

I worked in a software company once where we acquired a product to integrate into ours. It was developed by a self taught programmer in his 50ies that did versioning by making copies of the whole directory when he had something that worked, the way I also worked before university. Since he was the only developer and he was pretty good this mostly worked. His first name was/is Leif so from then on me and my friends sp…

Why would you call out someone like that?

Re: A Dropbox account gave me stomach ulcers

#83

Post by masklinn »

Tistron wrote: post #64

I worked in a software company once where we acquired a product to integrate into ours. It was developed by a self taught programmer in his 50ies that did versioning by making copies of the whole directory when he had something that worked, the way I also worked before university. Since he was the only developer and he was pretty good this mostly worked. His first name was/is Leif so from then on me and my friends sp…

TBF making tarballs and storing that was how many projects used to work. Linus did that until they got Bitkeeper & git, he refused to use any existing VCS before that.

Re: A Dropbox account gave me stomach ulcers

#84

Post by bartread »

pixiemaster wrote: post #66
n00b123 wrote: post #35

Earlier quoted context omitted.

> Service passwords are still stored in clear text in the corporate wiki. I know this painfully well :(. Can you recommend some good solution? Ideally open source and self hosted, instead of cloud password manager.

Disagree about the Cloud requirement. Because: in this scenario you need to drive adoption first,if it is any complicated the humans will not use it. so you need the easiest tool possible. when everybody is using it, THEN go for the real security move. (you can try to find a non-cloud one that is super easy, but...)

> Because: in this scenario you need to drive adoption first ...

Be careful: that sort of behaviour can get you fired and potentially land your company in hot water from a legal and/or compliance standpoint, as well as lose them customers.

Compliance is often as much, or more, about having and following documented processes, as it is about having good processes. This can include an approved list of software and services. If you step outside this you are likely breaching your compliance regime.

In the specific case of passwords you may have policies and procedures around secret management that would be violated by storing this information in the cloud, even with a service specifically designed for this. As stupid as it is, the quality (or lack thereof) of your current solution is not the key point here.

If you decide to get all subversive and start using a cloud service then, at the very least, if discovered you're going to get into trouble. At worst, if customers become aware they might leave, and as I've already said, the company might find themselves in legal difficulties.

Re: A Dropbox account gave me stomach ulcers

#85

Post by masklinn »

narag wrote: post #74
Tistron wrote: post #64

I worked in a software company once where we acquired a product to integrate into ours. It was developed by a self taught programmer in his 50ies that did versioning by making copies of the whole directory when he had something that worked, the way I also worked before university. Since he was the only developer and he was pretty good this mostly worked. His first name was/is Leif so from then on me and my friends sp…

I won't name the offender, but a well-known company I worked for did something funnier: zipping entire directory and checking the zip files in Visual Source Safe.

Given how broken VSS is, that might have been safer than using VSS as if it worked properly.

Re: A Dropbox account gave me stomach ulcers

#86

Post by sneak »

tmikaeld wrote: post #39
n00b123 wrote: post #35

Earlier quoted context omitted.

> Service passwords are still stored in clear text in the corporate wiki. I know this painfully well :(. Can you recommend some good solution? Ideally open source and self hosted, instead of cloud password manager.

Bitwarden is fully open source and audited. You can self host the server and client if you want without additional cost (they charge small per user).

Bitwarden derives its keys using SHA256 on the passphrase and a hilariously low iteration count.

The developer refuses to acknowledge it as a security risk, and actually caps the max iterations you can configure, both on the client and the server.

https://github.com/bitwarden/jslib/issues/52

https://github.com/bitwarden/server/issues/589

“It was audited” is meaningless if the audit missed this, or reported this and the dev dismissed it. Either way, it is unsafe.

Re: A Dropbox account gave me stomach ulcers

#87

Post by masklinn »

Thorrez wrote: post #69
Operyl wrote: post #27

Earlier quoted context omitted.

I’ve come to the assumption that either this happened already months ago, or the much more likely scenario that it’s probably largely fake (if based on a true story)

It mentions December, so either that's a lie, it's recent, or it was December in some previous year.

Updates are written in present tense as actions being undertaken so this seems to be an ongoing trash fire.

Re: A Dropbox account gave me stomach ulcers

#88

Post by Gibbon1 »

ryandrake wrote: post #14

I hate to be That Guy but how on earth is this not discovered during due diligence before “insane asylum” Company was acquired?

Sturgeon's revelation: 90% of everything is crap applies to due diligence.

I just remember two of our engineers had a gig, spent 6 months at $150/hr wading through VHDL and C++ code of some company that was being acquired. They also had to work closely with a patent attorney who was billing probably $500/hr.

Re: A Dropbox account gave me stomach ulcers

#89

Post by koolba »

vezycash wrote: post #79
semi-extrinsic wrote: post #62

Earlier quoted context omitted.

FWIW stress is a contributing factor in pretty much all diseases we know. Particularly those where the immune system is active.

I've got ulcer. My last ulcer attack, 5 years had me rolling on the floor. Since then, I avoided stress. Ate at the slightest hint of hunger, even as I grew a pot belly. Also, I avoided situps, cos the muscle pains felt like ulcer attacks. There's this specific food that I love. It's eaten RAW but often prepared in a not too hygienic manner. Since I banned myself from eating it, I've slowly become able to stay a few…

What’s the food?

Re: A Dropbox account gave me stomach ulcers

#90

Post by [deleted] »

koolba wrote: post #89
vezycash wrote: post #79

Earlier quoted context omitted.

I've got ulcer. My last ulcer attack, 5 years had me rolling on the floor. Since then, I avoided stress. Ate at the slightest hint of hunger, even as I grew a pot belly. Also, I avoided situps, cos the muscle pains felt like ulcer attacks. There's this specific food that I love. It's eaten RAW but often prepared in a not too hygienic manner. Since I banned myself from eating it, I've slowly become able to stay a few…

What’s the food?

[deleted]
Post reply on HN