Elon Musk emails employees about 'extensive and damaging sabotage' by employee • Hacker News Board

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#201

Post by neotek » Tue, Jun 19, 2018, 4:40 AM UTC

manicdee wrote: post #114

neotek wrote: post #108

Earlier quoted context omitted.

The fact Musk still has any credibility at all given his penchant for making wild claims that inevitably fall flat is baffling to me. How many more spurious predictions and imaginary milestones does he need to pump out before people recognise him for the huckster monorail salesman that he is?

For a huckster he’s doing a damn good job of fake shipping fake cars to fake customers who fake drive them in fake public. Excellent scam, would invest again.

Don't be so disingenuous. Nobody is claiming the cars don't exist, the point is that Musk continuously makes insane, overreaching predictions that almost never come to pass, like the ludicrous "three months maybe, six months definitely" fully autonomous driving nonsense, or promises that Model 3 production will be on track for x units per month when the actual numbers are half that, and so on.

This is so typical of any discussion about Musk - anyone who dares point out that he often just makes things up is met with derision from True Believers who are unable to accept that he isn't the superhero his PR team make him out to be.

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#202

Post by noobermin » Tue, Jun 19, 2018, 4:41 AM UTC

davidgay wrote: post #191

noobermin wrote: post #150

Earlier quoted context omitted.

What if they pushed it without asking anyone?

Then the system that allowed them to do so is badly designed.

I guess my thinking is if the disgruntled employee was so upset over not getting a promotion to cause so much damage they must have been in a high enough position already to warrant such a disposition, and "high enough" might mean high enough to have push access themselves.

Edit: see closeparens comment above. Complicated systems can always be subverted when trust is broken.

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#203

Post by neotek » Tue, Jun 19, 2018, 4:42 AM UTC

brightball wrote: post #118

neotek wrote: post #108

Earlier quoted context omitted.

The fact Musk still has any credibility at all given his penchant for making wild claims that inevitably fall flat is baffling to me. How many more spurious predictions and imaginary milestones does he need to pump out before people recognise him for the huckster monorail salesman that he is?

You did see him launch his car into space, right?

So? You couldn't have illustrated my point any better: Musk is a showman, he's great at drumming up PR but not so great at actually running a profitable business or hitting any of the milestones he constantly promises he'll hit.

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#204

Post by flyingswift » Tue, Jun 19, 2018, 4:42 AM UTC

nickparker wrote: post #112

sanderjd wrote: post #100

Earlier quoted context omitted.

> There will always be a small handful of engineers that can push the button to move code into PROD or even change code in PROD live. There is really no reason for this to be the case. Certainly all code that actually runs on the car can be required to go through review and be verifiably built, even if server code standards are more lax.

The code in question is for their manufacturing systems, not the cars. Not that that's necessarily better... Manufacturing equipment's at about the same danger tier as cars.

True. It's possible that the manufacturing software could be modified in some manner to introduce some fundamental flaw in the final product though. For that reason, I would say the code should also be held to a higher set of standards

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#205

Post by ghufran_syed » Tue, Jun 19, 2018, 4:42 AM UTC

TimTheTinker wrote: post #160

colechristensen wrote: post #145

Earlier quoted context omitted.

It doesn't strike me as paranoia. Thinking that industrial espionage doesn't happen seems naive. What they have is an admitted saboteur and code that exports data to third parties. It quacks like a duck. A disgruntled employee succumbed to or sought out people who wished to do harm to Tesla. There's plenty of evidence of similar things happening. (edit to fix words) If you work in the defense industry you get things…

Great comment, but I’m not sure what events you’re referring to when you say: > American companies have overthrown governments to benefit their business Care to elaborate?

Pepsi Cola & Chile

https://www.theguardian.com/business/1998/nov/08/observerbus...

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#206

Post by hamburglar » Tue, Jun 19, 2018, 4:43 AM UTC

closeparen wrote: post #162

EGreg wrote: post #125

Earlier quoted context omitted.

Why is it naive to expect there not to be a single point of failure like that? Code reviews are a thing.

Code review is a policy. If there's automated enforcement, it's through software written by someone, configured by someone, on a server that someone has root access to, in a room that someone has physical access to. If you have code signing, someone set up and patches the code signing server. Someone configures the code signing enforcement plane on the target devices. Someone gets to provision new accounts and enroll…

This++. Even at large, serious organizations with certifications and important government contracts, there are inevitably dozens of people who are/were involved at various levels of the security infrastructure and who happen to know of some aspect of one of the "base turtles" that is secretly a shit show amounting to "this set of people is special." We used to like to play "where's the bullshit" in security design review, because you know there's always something in there with a big fat TBD at some level, and the folks who know what they're doing will readily own up to it and have a future plan for mitigation (often something which will always be a "future" plan). In my experience, the best designs are the ones that don't try to be 100% impossible to subvert, but at least can be audited. Meaning you may be able to come up with a way to push your code into the production line, but the stakes are high because you're probably gonna get caught after the fact.

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#207

Post by flyingswift » Tue, Jun 19, 2018, 4:44 AM UTC

tslathrowaway31 wrote: post #91

flyingswift wrote: post #65

I made this same comment on the other discussion. I find it concerning that one person was able to push malicious code to 'production'. To me, this suggests that Tesla, a company building highly sensitive software, does not employ basic branch policies. How is is it that these changes could have made it through a code review process and get deployed? If a company like Microsoft or Google announced that a disgruntled…

There were no malicious code changes, rather malicious and deliberate misconfiguration of the software.

That is not at all what the memo says. "Direct code changes"

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#208

Post by legolas2412 » Tue, Jun 19, 2018, 4:45 AM UTC

abc_lisper wrote: post #25

yasp wrote: post #8

Earlier quoted context omitted.

Not that anyone cares or asked what I think but I wouldn't be surprised if Elon ends up surpassing Crazie Eddie Antar [0] as far as fraud goes. (I have no idea whether he is a fraud. He just strikes me as likely a fraud.) [0] https://en.m.wikipedia.org/wiki/Crazy_Eddie

Let me guess, you have never driven a Tesla, have you?

Let me guess, if you had a BMW with similar interior, and similar production quality, you won't be a fan of it?

Tesla fandom is based on futurism. Take regular driver assistance, call it autonomous self driving driverless cars and make a cult of personality around Elon musk. If BMW sold substandard cars at a higher price than comparative cars, and had fanboys buying it, and yet be rewarded by the stock market for making losses, BMW would be making Model S/X all year long.

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#209

Post by solatic » Tue, Jun 19, 2018, 4:46 AM UTC

zxcmx wrote: post #28

prepend wrote: post #21

Earlier quoted context omitted.

My company only allows authenticated users to commit changes. Even pull requests on our public repos get scanned and reviewed before human review. And pull requests are infrequent enough that unknown users usually involve some interaction. It seems like if an organization is allowing randos to push changes, they would also allow randos with valid pgp to push changes as well. So the investigation would change to “Who…

What you might not realise is that the author of a commit is not related to the (authenticated) user who pushes. You couldn’t merge changes from multiple people otherwise. Signed commits do fix this although you have to be careful about your threat model. Lots of software (e.g. gitlab) will prevent alice from pretending to be bob but will not protect you against server compromise (because public key directory and sig…

> but will not protect you against server compromise (because public key directory and signing enforcement are done on the server)

Which is why it's important for the security team to directly manage and be responsible for the code repository server. Usually the server also stores all the git repositories in some filesystem directory, meaning that server compromise would allow an attacker to remove all the company's code, regardless of permissions set for those repositories, and potentially leak it.

Re: Elon Musk emails employees about 'extensive and damaging sabotage' by employee

#210

Post by TangoTrotFox » Tue, Jun 19, 2018, 4:47 AM UTC

TimTheTinker wrote: post #175

misterhtmlcss wrote: post #126

Earlier quoted context omitted.

There are far more people aligned against him, so it's easy for him to feel defensive. I genuinely wouldn't be surprised if there was something bad going on with their finances, but I'd ALSO easily believe that there are actors very very actively working against him and Tesla. Google and Apple can grow without restraint because until they were massive they didn't affect anyone, Tesla from day 1 flew against the grain…

> Google and Apple can grow without restraint because until they were massive they didn't affect anyone Microsoft in particular lost an entire industry and way of doing business, partly (or maybe mostly) because of Apple and Google. It was only about 5 years ago that the “us vs them” mindset started to dissipate.

I don't think the comparison there is entirely apt. Microsoft was really killed off by the cycle rate of desktops radically decreasing as even decade old machines started to be good enough for everything except for extremely high performance usage like gaming, and mobile starting to advance enough to work as an alternative computing platform for many purposes. For direct competition in what was their bread and butter (desktop OS) - even Apple is still completely negligible.

Musk's competition against the automotive and space industry companies has been very direct, and his competition against the petrol industry has been at most with one degree of separation. And like others have said, there is a huge short position against Tesla that has cost people an immense amount of money, but also stands to make them an immense amount of money if Tesla tanks.