Live data from Hacker News

Redbox left PII on decommissioned machines

digipres.club

151–160 of 173 posts

Re: Redbox left PII on decommissioned machines

#151
post #5

Where does Foone keep finding this stuff? Earlier, Foone finds a NUC: https://news.ycombinator.com/item?id=41294585

In this specific case, they started digging through a HDD image that someone else pulled. They're still trying to get hold of an actual Redbox machine to investigate the hardware as well.

Re: Redbox left PII on decommissioned machines

#152
post #96

> Redbox.HAL.Configuration > .ConfigurationFileService implements IConfigurationFileService > STOP MAKING SERVICES AND FACTORIES AND INTERFACES AND JUST READ THE FUCKING > JSON FILE YOU ENTERPRISE FUCKERS I know it's cool to "hate" on OO, but "just read the fucking file" doesn't work if you want to run your unit tests without reading a fucking file. It makes sense to abstract configuration behind an interface so you…

If you need to make your code more baroque and harder to understand in order to unit-test it, that seems like the tail wagging the dog.

> more baroque and harder to understand

I don't understand how this is the case. If anything, an interface is MUCH easier to understand than a variety of functions strung together.

I mean, this is the whole reason we have APIs. If I'm a consumer, I would much rather read and understand the API and its contract than try to read through the code to find out requirements.

Re: Redbox left PII on decommissioned machines

#153
post #71

Earlier quoted context omitted.

What are they going to do? Sue the bankrupted company?

If a company dealing in toxic chemicals goes bankrupt, is it functionally legal to just dump them in the nearby river? I’d be amazed if countries don’t have legal processes in place to deal with situations like this and maybe the courts haven’t caught up to this use case?

I think historically in the US that's exactly how it's been done, and then we just clean it up later (or never). In the meantime a bunch of people get sick

Re: Redbox left PII on decommissioned machines

#154

Earlier quoted context omitted.

Those are integration tests. Integration tests are great, but not when you want to run thousands of them in a few minutes. And not when you want to have lots running in parallel, accessing and potentially making "changes" to the same files. I'm happy to have a long running integration test suite that runs on a build server. But while working on a project, I need fast running unit tests that I can edit and run to get…

You're mixing definitions - integration tests concern testing the "integration" between all parts of a solution. It has nothing to do with reading a JSON file, its perfectly acceptable to read from a JSON file and use its data in a unit test. Also reading / parsing a JSON file is fast enough for hot reloads / auto rerunning unless you have multiple GB files - so the argument for speed makes no sense. I'd argue it's s…

It's an absurdly common mistake though, on the level of hungarian notation being misused and having to split it into two names.

Basically too many unit testing tutorials were simplified too far, so the vast majority of people think a "unit" is syntactic rather than semantic. Like, a single function rather than a single action.

Re: Redbox left PII on decommissioned machines

#155

Earlier quoted context omitted.

Just to work this out together a little more in discussion form, since I appreciate your attitude: Consider these two scenarios: - read "test1-config.json" from disk, into whatever most easy JSON-adjacent format makes sense for your lang - just use the JSON-adjacent format directly Isn't the difference between these that one requires coupling input configuration of the environment to the tests (possibly inclusive of…

yeah - I don't think we should go so far as to write a config file for a test. But if we have something that is already readily convertible to/from json, it should be used. Not seeing it so much as a config for a test but as an argument we're storing in a separate file. For example if we had a dto that serialises to/from json we should be storing json not creating this dto manually - I would push it further and say a…

> yeah - I don't think we should go so far as to write a config file for a test. But if we have something that is already readily convertible to/from json, it should be used. Not seeing it so much as a config for a test but as an argument we're storing in a separate file.

This sounds like a great candidate for the facade pattern: https://en.m.wikipedia.org/wiki/Facade_pattern

Basically you hide dependencies behind a small interface, which lets you swap out implementations more easily. The facade is also part of your codebase rather than an external API, so it gives you something stable to mock. Rather than a building facade like the name is based on, I think of these as a stable foundation of things a module calls out to. Like your code is a box with an interface on one side (what tests and the rest of the codebase interact with) and the facade(s) are on the other side (dependencies/mocks of dependencies).

Re: Redbox left PII on decommissioned machines

#156

Ahh I miss Foone's threads on Twitter/X!!! They were always such an interesting joy to read. I know they migrated off of Twitter/X and they were one of the ones I was most sad to see leave. But given 95-99% of the accounts I follow never left, I'm not going to bother to cultivate another social media account just for Foone's threads, or whomever else's which I've forgotten left Twitter/X.

I am so glad people are leaving Twitter even if they don't do anything else, and maybe especially lol

Re: Redbox left PII on decommissioned machines

#157
post #148

As an aside, I see we've re-invented Twitter-style blog posts - but did anyone stop and ask why? This format is so tedious to read - one sentence fragment at a time. It's like reading someone's subconscious inner-dialog shower thoughts.

Sort of the other way, many social networks had longer formats and Twitter eventually adopted it. On twitter it actually never quite made sense but on fedi stuff it works a lot better.

Re: Redbox left PII on decommissioned machines

#158
post #5

Where does Foone keep finding this stuff? Earlier, Foone finds a NUC: https://news.ycombinator.com/item?id=41294585

I once worked on an ewaste shipment from a rail carrier.

99% of the stuff they sent us was boring corporate desktops running standard, secure soe.

1 laptop however, booted into windows with saved credentials, connected to a vpn automatically, logged into the rail companys in house software automatically, and began displaying what I can only assume was a live map of the rail network. Little green lines running along red lines, the green lines would come to junctions and stop. It had buttons. I think I shucked the hard drive and drilled it within 60 seconds and had the hardware completely disintegrated.

One other time a games company that got liquidated sent us a pallet of computers that had source code for a relatively popular strategy game on the drives.

Another games company shipped us their test kits one of which had a dev build of a relatively well known action adventure game. The warehouse guys would play the dev build of the game on their lunch breaks.

Basically no one gives a shit.

All of that before I worked for a business that stored their customer info including credit cards in plain text one dirwalk away on their public website. When we complained we were told that it was fine because they "encrypted" the card numbers. The encryption was adding 1 to the card number. I died.

Re: Redbox left PII on decommissioned machines

#159

Earlier quoted context omitted.

Kind of off topic, but can someone explain why else C# has factories and interfaces? Is it just mocking? I really don't understand the pattern at all. FWIW I am no dev. EDIT: Found xnorswap's comment below about configuration, which makes sense I get - but as they mentioned, it does feel like "turtles all the way down".

I've used them in the past to keep interface and implementation separate. It's an easy way to stick an adapter between something concrete and the thing that needs something but doesn't care where it's coming from. So, for example, I could have a IGadgetStore with methods for creating, retrieving, updating, and deleting gadget instances and then I can have a bunch of different classes implementing that interface. An o…

OK that makes sense. As an outsider, the C# code bases I look at seem to do this as standard practice, even if the requirement for different classes never materialises. I guess you get used to looking at it, but it seems (perhaps naively) as wasteful and a bit distracting.

Re: Redbox left PII on decommissioned machines

#160
post #5

Where does Foone keep finding this stuff? Earlier, Foone finds a NUC: https://news.ycombinator.com/item?id=41294585

I know an employee in an IT company. He told me that they have hundreds of decommissioned laptops and no time to wipe them. And they won't pay someone else to do it because it's too expensive. So right now they are in storage. If they go bust, the storage company will likely dump them. I've seen a lot of stuff in e-waste. There are several facilities within 5 miles of my home, and you can walk right in and drop off y…

I am loosely aware of a time that a local bank performed a large data centre migration.

They built new infrastructure at the new site, then just decommed the old building.

Pretty standard stuff, but the old building was like, 1930s era or something. After the hardware was deracked, it was left in a loading dock, in a now abandoned building, behind an unlocked roller door for like 6 months before it was recovered for data destruction.

Post reply on HN