101–110 of 218 posts
The GitHub user instead of reporting incident to their security team chose to take sneaky approach to remove the keys fearing the actions from company. They will be fired and instead of retrospectively improving the security Infosys will ban all OSS contributions from their developers.
You assume they have a security team :)
Earlier quoted context omitted.
I've seen Infosys-produced code that there was no way it was going to work... turns out that after I googled it, multiple lines were straight 1:1 copy pasta from multiple StackOverflow answers - just jammed together in the hope that something would work. I was shook.
This is unfortunately common even outside of Infosys. I've experienced it at several of my former employers, although admittedly more in China than in other countries I worked. It's interesting when you sit beside a developer who does this kind of stuff in a pair-programming context, because it immediately becomes clear that they really don't have a clue how to read and understand code in the abstract. Their process…
When attempting to look at the git pull request files changed details [1], Github returns a server error. Any ideas why? [1] https://github.com/orf/pypi-data/pull/2/files
> To put it bluntly, I’m not sure I trusted Infosys to revoke this key in a timely manner. So I did it for them with aws iam delete-access-key --access-key-id=$AWS_ACCESS_KEY_ID, and now the key is useless: Hilarious. Infosys is a known "mass recruiter" in indian colleges. WITCH (Wipro, Infosys, TCS, Cognizant, HCL) companies is where talent goes to die. No competent employee stays in those companies (from what I've…
The Indian government has, over the years, awarded contracts worth billions of dollars to Infosys for projects like the Goods and Service Tax portal, Income Tax portal. In all these cases, the implementations are slow and super buggy. Deadlines to deliver are routinely missed. In an ideal world, these companies should not be allowed to exist.
When attempting to look at the git pull request files changed details [1], Github returns a server error. Any ideas why? [1] https://github.com/orf/pypi-data/pull/2/files
> To put it bluntly, I’m not sure I trusted Infosys to revoke this key in a timely manner. So I did it for them with aws iam delete-access-key --access-key-id=$AWS_ACCESS_KEY_ID, and now the key is useless: Hilarious. Infosys is a known "mass recruiter" in indian colleges. WITCH (Wipro, Infosys, TCS, Cognizant, HCL) companies is where talent goes to die. No competent employee stays in those companies (from what I've…
> No competent employee stays in those companies I gotta say, this explains so much. We have a FTE who came from infosys and he's very good. I have such a hard time squaring that with the team that submits an initial PR with the bin and obj directories checked in, then follows it up by adding .gitignore.txt file before FINALLY submitting a .gitignore file. And then finding them representing currency as float, or find…
But those talented students take up any job offer they get (I.e. WITCH). when they get experience, they switch to higher tier companies.
There are many talented folks at WITCH companies, they just don't stay there.
[dead]
I applaud any bad press on InfoSys. I picked up contract gig through them a few years ago. Here are some of the takeaways from my short lived experience: - It took them over two weeks to send me a computer. - They cancelled PTO for everyone. (this was the most egregious single thing they did) - They had absolute worst internal site for accessing HR documents and accessing personal resources. Just a maze of links. You…
Is it possible to do a full sweep across all tokens in all Python files (for instance) in Github and find such keys? Can you tell from the contents if it's a key or some such "important" string?
The keys here were actually in the published package, not in GitHub, as it seems it was published by accident. Here[1] are the prefixes used for all AWS IAM access keys. Here[2] is the API definition for an access key. If you're going to search all of PyPy for keys, here's some more keys you can look for: [3] [4] [1] https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_i... [2] https://docs.aws.amazon.com/IAM/l…