Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

tomforb.es

Post reply on HN
Print view View original

201–210 of 218 posts

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#201

Post by dang »

kryptozinc wrote: post #62

Quoted post unavailable.

Can you please stop posting unsubstantive and flamebait comments and otherwise breaking the HN guidelines? You've been doing it repeatedly, unfortunately, and we have to ban such accounts.

If other people are wrong or you feel they are, you're of course you're welcome to post substantive comments explaining why. Other users in this thread have modeled that quite nicely: e.g. https://news.ycombinator.com/item?id=33635659. But snark, name-calling, and swipes are not ok—they're not what this site is for, and destroy what it is for.

If you wouldn't mind reviewing https://news.ycombinator.com/newsguidelines.html and taking the intended spirit of the site more to heart, we'd be grateful.

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#202

Post by genmud »

sbf501 wrote: post #198
genmud wrote: post #84

Earlier quoted context omitted.

They do, this was likely in a private repo which isn’t scanned.

I pretty sure had a PEM cert in a private repo and was alerted. Is this in their TOS somewhere?

You can opt into secret scanning on private repos, but it isn’t default when I last used it.

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#203

Post by unixhero »

kapilkaisare wrote: post #192
unixhero wrote: post #179

Earlier quoted context omitted.

I have had some ridiculous situations with them. For one the developers in Bangalore Delivery Center 8, and what do I know, all of them?, had to work with their private computers. A unix engineer could only work with Aix Tar and would not touch GNU Tar on Linux, because his manager had not approved it. Onshore engineers flying home to India due to a stomach ache, instead of seeing a doctor for free in the host countr…

> Onshore engineers flying home to India due to a stomach ache, instead of seeing a doctor for free in the host country due to being afraid. This feels like an exaggeration to me, although I'm open to hearing specifics to the contrary. I know of (non resident) immigrants who delay medical visits and treatments until they get back to their home country, but flying home (spending a good deal of money on air fare) for j…

It happened, that's all I can say. At times banality knows no limits.

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#204

Post by darkarmani »

nell wrote: post #143

This thread is full of generalized insults at a million people based on where they work. If someone did the same based on a different attribute of a population, they'd be banned. I've worked at one of these companies but left over a decade ago. I know how we're looked at when we do client work (part of why I left). Some of my colleagues were less competent, true. But, some will wipe the floor with the client employee…

> based on where they work. If someone did the same based on a different attribute of a population, they'd be banned.

Why is that surprising? Are you making reference to judging people on the color of the skin versus where they CHOOSE to work? I'm don't know anything about WITCH companies, but this is a serious false-equivalence.

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#206

Post by crossroadsguy »

nell wrote: post #143

This thread is full of generalized insults at a million people based on where they work. If someone did the same based on a different attribute of a population, they'd be banned. I've worked at one of these companies but left over a decade ago. I know how we're looked at when we do client work (part of why I left). Some of my colleagues were less competent, true. But, some will wipe the floor with the client employee…

I am from India and live here. I usually find it offensive the way HN becomes racist, subtly and directly, when topics around this subcontinent, especially India, come up. This is anything but that.

I think people are unnecessarily being much more considerate and respectful than this company and its people (including the British PM’s father-in-law) deserve.

Infosys and anything or anybody related to it are worst of the worst.

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#207

Post by stevewatson301 »

basha94 wrote: post #197
stevewatson301 wrote: post #172

Earlier quoted context omitted.

That's just based on the ability to convince the management types though, and I'm sure you've heard of the phrase "nobody got fired for buying IBM." For an executive, it's easier to justify outsourcing to a large consulting firm simply because of the security afforded by the choice and the ease of justification; rather than any technical abilities they may or may not possess, and certainly it does not imply its corre…

Steve, how dumb do you think management is? Why would a company spend >=$1B+ in OpEx and CapEx just because somebody convinced them instead of seeing any technical value whatsoever?

Did you ever have an interaction with your manager where they could not understand the technical details of a project and insisted on only a high-level overview?

People understand the world through dimensionality reduction and lossy compression of information in domains that they are not involved on a daily basis. This causes an inherent issue when you stack these phenomena across multiple organizational levels; this is how you end up with Intel's or Ballmer-era Microsoft's management failures, to use some non-WITCH examples, or the issues that we're talking about in this article.

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#208

Post by fellellor »

mindentropy wrote: post #185
fellellor wrote: post #130

Earlier quoted context omitted.

Programming/anything to do with PCs in India is a rich man’s hobby. Tinkering is not encouraged in colleges in the country. In any case this is a big country with a lot of talented devs. But for the same reason the pool of mediocre programmers is also pretty big.

>Programming/anything to do with PCs in India is a rich man’s hobby. This is not true. We had a good culture of self assembled PC enthusiasts in our district. This was in early 2000s. In fact it has reduced now maybe due to lack of interest or something even though the prices of PCs have dropped significantly. I see many people use their PCs as locked up phones with no curiosity of hardware. >Tinkering is not encoura…

>This is not true.

It is absolutely true. Just because you don't consider yourself rich doesn't mean that these devices aren't out of the reach of a vast majority of the population.

Almost everyone has access to a smartphone, but most of those are poorly made, overheating pieces of plastic - barely suitable for use as a phone, let alone as a computing device on which you can learn something.

In my second statement, I'm also trying to say that though you have a huge number of people in the workforce who haven't had easy access to computing devices, there are also many who do (in absolute numbers but not in percentage). But the numbers are such that given an average Indian programmer, they are more likely to be someone who got educated in a substandard setting among unmotivated peers who have an aversion or even a fear of tinkering and putting a big investment (like a PC) at risk.

People who have money to get a PC as a hobbyist do it for unworthy reasons - like the chance to play garbage tier games like pubg or whatever, or becoming an influencer. This is a generalisation but it will affect the probabilities.

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#209

Post by ticviking »

ashirviskas wrote: post #173
cmeacham98 wrote: post #119

Earlier quoted context omitted.

I dispute this: I do not think you need to understand the whole stack to know using what effectively is "god mode" access is bad practice. Even if I pretend I don't know anything about AWS, if somebody handed me credentials with access called "FullAdminAccess" and told me to use them for my little script that only needs read-only access to S3 I would be extremely skeptical. The reality is that the culture at Infosys…

>Even if I pretend I don't know anything about AWS, if somebody handed me credentials with access called "FullAdminAccess" and told me to use them for my little script that only needs read-only access to S3 I would be extremely skeptical. If you ask for an access key for your little script and get one, you usually only check if it works for your case and not always check if it has any other access, so I can easily se…

I agree, but that tells me you are much more detail oriented than many developers I've worked with. Most devs at the 70-100k a year range are phoning it in 9-5 and only check exactly the boxes a PM and QA person make them check. I very rarely see developers who are in the standard deviation below median make that kind of check. These are good productive developers who get lots of tickets done.

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#210

Post by ticviking »

pipeline_peak wrote: post #53
ticviking wrote: post #3

I really wish this surprised me. The number of people who completely understand the stack they are working on is shrinking, even as the size of the stack grows. The power of computing is such that every organization on the planet is forced to lower the bar to get people who are marginally competent, even if they lack attention detail and cannot be relied on to solve problems of this sort. This kind of leak is the res…

In a world where all the problems are wrapped in containers and ever increasing bloat, it takes a lot of discipline to understand the stack, if that’s even the proper term anymore.

Even just understanding "the stack" if you're using a cheap Linux VM and admining it directly is a heavy lift for most devs.
Post reply on HN