Live data from Hacker News

Redbox left PII on decommissioned machines

digipres.club

161–170 of 173 posts

Re: Redbox left PII on decommissioned machines

#161

Earlier quoted context omitted.

I've used them in the past to keep interface and implementation separate. It's an easy way to stick an adapter between something concrete and the thing that needs something but doesn't care where it's coming from. So, for example, I could have a IGadgetStore with methods for creating, retrieving, updating, and deleting gadget instances and then I can have a bunch of different classes implementing that interface. An o…

OK that makes sense. As an outsider, the C# code bases I look at seem to do this as standard practice, even if the requirement for different classes never materialises. I guess you get used to looking at it, but it seems (perhaps naively) as wasteful and a bit distracting.

> it seems (perhaps naively) as wasteful and a bit distracting.

It is.

Nowadays, .NET is usually able to do away with the abstraction cost of such interface abuse luckily, but it remains an additional item you mentally have to deal with, which isn't good.

Single-implementation interfaces are still considered an anti-pattern, and teams that over-abstract and mock everything out when writing unit tests usually just waste time in pursuit of multi-decade old cargo cult. These also often test that modules comprise of specific implementations and not whether they simply satisfy the interface contract, which is terrible. And often turn stateless parts of logic that could have lived on some static class into an interface and an implementation injected with DI, that is then mocked out, instead of just calling methods on a class. More difficult to remove, worse locality of behavior, does not answer the question "if tests are green, are we confident this will work in prod?", sadness all around.

I agree with your sentiment. It's much more practical to write functional and component-level tests with coarser granularity of individual test items, but with more extensive coverage of component inputs. There's a wealth of choices for doing this with little effort (e.g. testcontainers).

Re: Redbox left PII on decommissioned machines

#162

Earlier quoted context omitted.

> and everything suddenly gets trucked-off into receivership. That's the problem. These things aren't getting collected and trucked off. They are just left rotting in their installed locations. I'm pretty confident that you could just show up to any of these with a tool box to just start opening one up to take out whatever you wanted from the insides, and not one person would question you. They already said they don'…

The host locations are pissed off that the machines are sitting there taking up space and using electricity. They certainly aren't going to be happy with someone opening it up and making a mess. Or potentially creating some sort of additional liability for them. But if you show up with a van or a large truck, they'd probably pay you money to take the whole thing off their hands. And you can tear it apart in your own…

> taking up space and using electricity.

how hard would it be to unplug the units? if these things are on a shared electrical circuit with anything else in the store, then that's on them. If they are separated, then just flip the breaker. otherwise, there's going to be j-box some where near the thing connected to some conduit. ten gets you twenty that there's some wire nuts in that j-box that could be disconnected in less than a minute.

also, just show up with a clipboard, and if anyone asks you, just say you were hired to collect certain items from within but not remove the entire thing. just print up a fake work order. i don't think i'm thinking too far outside the box on this one.

Re: Redbox left PII on decommissioned machines

#163
post #2

Take this as a lesson. If you've been a dev long enough, you've worked on a project knowing that how the project is being done isn't the best method with every intention of going back to make it better later, but not at the expense of getting the MVP up and running. You'll also have seen that never actually happening and all of those bad decisions from the beginning still living all the way to the bitter end. I'm gue…

One just wonders if the cooperative-multitasking BASIC implemented in this machine really was necessary for an MVP. Other than if that just happened to be the sort of programming that the developer at the time was familiar with. Also, this really is the 'engineering' discipline with the lowest level of craftsmanship and regard for rigor, isn't it? Because the failures are usually intangible, not directly life-threate…

> One just wonders if the cooperative-multitasking BASIC implemented in this machine really was necessary for an MVP.

I have a feeling that someone already had that hammer ready and was in search of a nail. :)

Re: Redbox left PII on decommissioned machines

#164
post #33

Are there any laws in any country governing how such equipment is supposed to be decommissioned in case if bankruptcy? This does not seem to be an isolated case, it just happening more and more with advance of technology.

What are they going to do? Sue the bankrupted company?

It would require setting aside some amount in escrow to be used in proper asset sanitation in case of bankruptcy, or at least sanitation getting some priority in asset liquidation proceeds.

Re: Redbox left PII on decommissioned machines

#165
post #5

Where does Foone keep finding this stuff? Earlier, Foone finds a NUC: https://news.ycombinator.com/item?id=41294585

I once worked on an ewaste shipment from a rail carrier. 99% of the stuff they sent us was boring corporate desktops running standard, secure soe. 1 laptop however, booted into windows with saved credentials, connected to a vpn automatically, logged into the rail companys in house software automatically, and began displaying what I can only assume was a live map of the rail network. Little green lines running along r…

I hope someone backed all of these up, they sound like a goldmine

Re: Redbox left PII on decommissioned machines

#166
post #143

Earlier quoted context omitted.

Not an old school engineering. There a fresh engineers rolling of the production line everyday that behaves exactly like this. I would even venture to say that senior engineers are probably much better at documenting, writing clean code, not over engineer things. My personal experience is that bad engineers move into project management, administration much faster. Which is a problem in itself since they end up being…

I agree on the management aspect, and even promoting good engineers "too high" on the "parallel promotion track" can effectively take them out of the engineering work just as much as if they went into pure management. "Does the CTO still code at least sometimes?" is the only tell I have for whether a company has fallen into that trap or not. For the engineers themselves, though, I think it's a mixed bag when it comes…

I never said old. I said old school. Age is irrelevant.

Guys that adhere ruthlessly to their own framework designs without regard for onboarding timeframes.

They truly believe if you can’t understand their framework designs, you’re not smart enough.

I’ve always believed a critical aspect of software architecture is making sure the developers that will maintain it are a part of the design. If they’re junior and mid-level, your architecture better accommodate their skills.

Re: Redbox left PII on decommissioned machines

#167

Earlier quoted context omitted.

One just wonders if the cooperative-multitasking BASIC implemented in this machine really was necessary for an MVP. Other than if that just happened to be the sort of programming that the developer at the time was familiar with. Also, this really is the 'engineering' discipline with the lowest level of craftsmanship and regard for rigor, isn't it? Because the failures are usually intangible, not directly life-threate…

> One just wonders if the cooperative-multitasking BASIC implemented in this machine really was necessary for an MVP. I have a feeling that someone already had that hammer ready and was in search of a nail. :)

Might be case of a VB6 programmer who graduated to .Net C# but still misses the good old days.

Re: Redbox left PII on decommissioned machines

#168
post #155

Earlier quoted context omitted.

yeah - I don't think we should go so far as to write a config file for a test. But if we have something that is already readily convertible to/from json, it should be used. Not seeing it so much as a config for a test but as an argument we're storing in a separate file. For example if we had a dto that serialises to/from json we should be storing json not creating this dto manually - I would push it further and say a…

> yeah - I don't think we should go so far as to write a config file for a test. But if we have something that is already readily convertible to/from json, it should be used. Not seeing it so much as a config for a test but as an argument we're storing in a separate file. This sounds like a great candidate for the facade pattern: https://en.m.wikipedia.org/wiki/Facade_pattern Basically you hide dependencies behind a…

I have seen over-reliance on the facade pattern devolve into endless indirection that can make the code needlessly confusing. If you are already familiar with the codebase, it doesn't seem like a big deal, but when you onboard, you'll find your new teammate combing through file after file after file just to discover, "oh, there's never any external API call or specific business logic involved, we were just reading a static json file from disk that does not change its content during a single run."

Using the known baked in stdlib functions for standard behavior removes a lot of potential uncertainty from your codebase (while also making it sometimes harder to test).

Re: Redbox left PII on decommissioned machines

#169
post #96

Earlier quoted context omitted.

If you need to make your code more baroque and harder to understand in order to unit-test it, that seems like the tail wagging the dog.

> more baroque and harder to understand I don't understand how this is the case. If anything, an interface is MUCH easier to understand than a variety of functions strung together. I mean, this is the whole reason we have APIs. If I'm a consumer, I would much rather read and understand the API and its contract than try to read through the code to find out requirements.

We are talking about a single function that possibly takes zero arguments versus an interface (TFA doesn't seem to show the code, but the interface presumably exists for DI).

I have waded through such code in Java, rather than C#. At least some of it is fighting the language; Java is pretty hostile to writing DI style code.

On top of that, even in languages that are more DI friendly, DI significantly decreases the lexical locality of code that is dynamically very close.

Re: Redbox left PII on decommissioned machines

#170
post #71

Earlier quoted context omitted.

If a company dealing in toxic chemicals goes bankrupt, is it functionally legal to just dump them in the nearby river? I’d be amazed if countries don’t have legal processes in place to deal with situations like this and maybe the courts haven’t caught up to this use case?

I think historically in the US that's exactly how it's been done, and then we just clean it up later (or never). In the meantime a bunch of people get sick

I don’t know the US system but in the UK you have two basic routes to running a business: sole trader or LLC.

In the former, short of dying, it’s not possible to “disappear,” because you’re personally liable for everything. I’d guess that includes data breaches.

In the latter, it’s also not really possible because the company must be wound up if it goes bankrupt. In the worst case, the government appoints administrators to wind the company up, who would be responsible for handling the assets.

Now, if the processes aren’t up to scratch, maybe that’s a thing that needs to be fixed, but the structure is there to do it. At least in the UK.

Post reply on HN