Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

tomforb.es

Post reply on HN
Print view View original

51–60 of 218 posts

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#51

Post by rodgerd »

drcross wrote: post #14
precompute wrote: post #9

> To put it bluntly, I’m not sure I trusted Infosys to revoke this key in a timely manner. So I did it for them with aws iam delete-access-key --access-key-id=$AWS_ACCESS_KEY_ID, and now the key is useless: Hilarious. Infosys is a known "mass recruiter" in indian colleges. WITCH (Wipro, Infosys, TCS, Cognizant, HCL) companies is where talent goes to die. No competent employee stays in those companies (from what I've…

>No competent employee stays in those companies Absolutely true from first hand experience. Imagine being a top performer doing great work for a company whose managers insist on wasting your time putting you into needless meetings getting you to explain how you're doing everything all through badly communicated text with typos and misspellings.

No post body was provided.

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#52

Post by rodgerd »

stefan_ wrote: post #10
avg_dev wrote: post #5

Wow. Really crazy. I know it was not right to revoke the key, he touched into their system. He probably broke someone’s production. But it was also absolutely the right thing to do. A god mode key floating around for over a year unrevoked, with real human beings’s medical data on the other side… I am glad the post author revoked the key. It is probably too little too late but they did close that door and maybe saved…

Pretty sure GitHub runs a system that will automatically revoke every (AWS and other) key to ever become part of a repository.

They have the tools to do that.

You might be horrified by how many shitty developers want all the good guardrails GHE provides switched off, and how many managers will support them because they're a "superstar who gets things done".

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#53

Post by pipeline_peak »

ticviking wrote: post #3

I really wish this surprised me. The number of people who completely understand the stack they are working on is shrinking, even as the size of the stack grows. The power of computing is such that every organization on the planet is forced to lower the bar to get people who are marginally competent, even if they lack attention detail and cannot be relied on to solve problems of this sort. This kind of leak is the res…

In a world where all the problems are wrapped in containers and ever increasing bloat, it takes a lot of discipline to understand the stack, if that’s even the proper term anymore.

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#54

Post by Gare »

drcross wrote: post #14
precompute wrote: post #9

> To put it bluntly, I’m not sure I trusted Infosys to revoke this key in a timely manner. So I did it for them with aws iam delete-access-key --access-key-id=$AWS_ACCESS_KEY_ID, and now the key is useless: Hilarious. Infosys is a known "mass recruiter" in indian colleges. WITCH (Wipro, Infosys, TCS, Cognizant, HCL) companies is where talent goes to die. No competent employee stays in those companies (from what I've…

>No competent employee stays in those companies Absolutely true from first hand experience. Imagine being a top performer doing great work for a company whose managers insist on wasting your time putting you into needless meetings getting you to explain how you're doing everything all through badly communicated text with typos and misspellings.

Well, at least it got Rishi('s wife) rich.

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#55

Post by belter »

zaptheimpaler wrote: post #47

In a world filled with more competence and less corruption, Infosys would have gone bankrupt 20 years ago. But here we are with Wipro, Infosys, TCS etc. all chugging along.

TCS -> US$25 billion Revenue in 2022

InfoSys-> US$16 billion Revenue in 2022

Wipro -> US$10 billion Revenue in 2022

I want to get out of this Universe and get into one that makes sense...

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#56

Post by another_devy »

The GitHub user instead of reporting incident to their security team chose to take sneaky approach to remove the keys fearing the actions from company.

They will be fired and instead of retrospectively improving the security Infosys will ban all OSS contributions from their developers.

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#57

Post by alfiedotwtf »

precompute wrote: post #9

> To put it bluntly, I’m not sure I trusted Infosys to revoke this key in a timely manner. So I did it for them with aws iam delete-access-key --access-key-id=$AWS_ACCESS_KEY_ID, and now the key is useless: Hilarious. Infosys is a known "mass recruiter" in indian colleges. WITCH (Wipro, Infosys, TCS, Cognizant, HCL) companies is where talent goes to die. No competent employee stays in those companies (from what I've…

I've seen Infosys-produced code that there was no way it was going to work... turns out that after I googled it, multiple lines were straight 1:1 copy pasta from multiple StackOverflow answers - just jammed together in the hope that something would work. I was shook.

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#58

Post by alfiedotwtf »

dessant wrote: post #50
precompute wrote: post #9

> To put it bluntly, I’m not sure I trusted Infosys to revoke this key in a timely manner. So I did it for them with aws iam delete-access-key --access-key-id=$AWS_ACCESS_KEY_ID, and now the key is useless: Hilarious. Infosys is a known "mass recruiter" in indian colleges. WITCH (Wipro, Infosys, TCS, Cognizant, HCL) companies is where talent goes to die. No competent employee stays in those companies (from what I've…

Fun fact: Mozilla projects are now developed in part by Cognizant Softvision, including Firefox for Android. Their employees are everywhere on Mozilla bug trackers, and their numbers seem to have increased since 2020, right after Mozilla fired a quarter of its workforce. https://www.cognizantsoftvision.com/blog/pedal-metal-mozilla...

This pisses me straight off. Someone needs to fork Mozilla (the company) and bring back its hayday culture.

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#59

Post by P5fRxh5kUvp2th »

precompute wrote: post #9

> To put it bluntly, I’m not sure I trusted Infosys to revoke this key in a timely manner. So I did it for them with aws iam delete-access-key --access-key-id=$AWS_ACCESS_KEY_ID, and now the key is useless: Hilarious. Infosys is a known "mass recruiter" in indian colleges. WITCH (Wipro, Infosys, TCS, Cognizant, HCL) companies is where talent goes to die. No competent employee stays in those companies (from what I've…

> No competent employee stays in those companies

I gotta say, this explains so much.

We have a FTE who came from infosys and he's very good. I have such a hard time squaring that with the team that submits an initial PR with the bin and obj directories checked in, then follows it up by adding .gitignore.txt file before FINALLY submitting a .gitignore file. And then finding them representing currency as float, or finding catch statements with a single line that rethrows it, as below (C#)

// this form throws away the stack trace from the original exception. catch(Exception ex) { throw ex; }

And when asked why this exists they add logging to it

catch(Exception ex) { _log.Debug("Unhandled exception handled.", ex); throw ex; }

----

I could go on, but the ole eyebrow just twitches whenever I think about infosys.

But then I see this other person who came from infosys. It's like trying to understand how that 6'11" basketball player came from that family who has no one over 5' tall.

Rationally I know strong technical folks can come from these companies, but damn... how? There's another poster claiming everyone makes mistakes, but no, many of the mistakes they make are not reasonable.

Re: Infosys leaked FullAdminAccess AWS keys on PyPI for over a year

#60

Post by andrewxdiamond »

ticviking wrote: post #3

I really wish this surprised me. The number of people who completely understand the stack they are working on is shrinking, even as the size of the stack grows. The power of computing is such that every organization on the planet is forced to lower the bar to get people who are marginally competent, even if they lack attention detail and cannot be relied on to solve problems of this sort. This kind of leak is the res…

I don’t think there are any people who understand the full stack. I don’t think anyone like that has existed in computing in a very long time.

It’s truly impossible for a single human to actually understand the physics of electronics, the world of CPU micro-architecture, packet shuffling network equipment, the nuance of CSS, and the never ending complexity of UI/UX design.

The only way this statement could be accurate is if you arbitrarily start cutting parts of the “stack” out.

Post reply on HN