Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Redbox left PII on decommissioned machines

digipres.club

Post reply on HN
Print view View original

61–70 of 173 posts

Re: Redbox left PII on decommissioned machines

#61

Post by Kuinox »

xnorswap wrote: post #56
throwaway365x2 wrote: post #54

Earlier quoted context omitted.

I don't follow .Net closely, but it seems like there should be a better alternative. Java has a library called "Mockito" that can mock classes directly without requiring an interface. I assume something similar exists for .Net, as they have similar capabilities. Making an interface for one class, just so another class can be tested seems like we allow the tool (tests) to determine the architecture of what it is testi…

I'm sure the same exists for .NET ( Moq can probably do it? ), but writing against an interface and having concrete implementations supplied by the DI framework is pretty much the ordained way to do things in .NET. I used to be in the "Interfaces with only a single implementation is a code smell" camp, but I prefer to follow the principle of least surprise, so going with the flow and following the way the MS standard…

Moq® cannot do it. I forked Moq® and made a library that can mock classes: https://github.com/Kuinox/Myna. It can do that by weaving the class you mock at compile time for your mocks (you can still use your class normally).

Re: Redbox left PII on decommissioned machines

#62

Post by gU9x3u8XmQNG »

I once worked for an MSP that would reuse decommissioned storage for other customers and services.

Tried to convince them to stop, and even setup a service on lunch breaks to attempt and sanitise them using open guidelines available at that time - an automated service that would display drive sanitisation status on a text based panel next to a multi disk bay caddy in the storage room.

I resigned because of this, and many other similar business practices - all just to make more money (it was not malicious otherwise).

The business is rather successful to this day. I only hope they have stopped such activities.

And yet I still lose sleep about this..

Re: Redbox left PII on decommissioned machines

#63

Post by throwaway365x2 »

Dalewyn wrote: post #29
WhyNotHugo wrote: post #23

Earlier quoted context omitted.

When a developer says “this is a temporary solution” they mean “this is a temporary solution forever”.

There is nothing more permanent than a temporary solution, and nothing more temporary than a permanent solution.

That's very true.

When a customer has a problem, you create a solution to it. Often the problem is part of a much larger space, so you tend to have discussions of all the possible features you could implement. This is a necessary step to gain knowledge about the problem space, but it can lead you to think that the solution have to cover it all

Time restraints leads to a "temporary" feature to solve the customer's immediate need. Most of the time it turns out that all the other features are neither necessary nor important enough to spend time on.

Projects without time restraints or focus tends to create a complex system that will "solve" the entire problem space. Most of the time it turns out that our assumptions are wrong and we need to do a major refactoring.

"Temporary" solutions may not have the best code structure or architecture, but it is not necessarily a bad technical debt, as many new developers to the project seems to think it is. Also, the time restraints of a temporary solution encourages the developer to create simple code and not "clever" code, because they can always blame time restraints for their lack of cleverness. If the code has been mostly unchanged for years, somewhat maintainable and solves the customer's problems, it's not really a problem.

Re: Redbox left PII on decommissioned machines

#65

Post by larodi »

nextlevelwizard wrote: post #35
larodi wrote: post #33

Are there any laws in any country governing how such equipment is supposed to be decommissioned in case if bankruptcy? This does not seem to be an isolated case, it just happening more and more with advance of technology.

What are they going to do? Sue the bankrupted company?

Or perhaps make sure it gets sanitised before refurbished and resold. I mean bankruptcy always means debt collector tries to sale assets to cover for losses, no?

But this does not answer my question. So basically many people here are unaware where such legal framework exist at all.

Re: Redbox left PII on decommissioned machines

#66

Post by xnorswap »

xnorswap wrote: post #58
proikan wrote: post #57

Earlier quoted context omitted.

Isn't ```dependency injection``` (aka passing arguments) the big thing that's supposed to solve this? Config config; // production config_from_file(&config, "config.json"); run_production_stuff(&config); // unit tests Config config; config_from_memory(&config, &some_test_values); run_tests(&config);

Yes, and the typical pattern for .NET DI is to do so with interface based parameters. So let's say you have a service FooService that requires some configuration. ( Ignoring the System.configuration namespace for now) You'd have: class FooService(IConfigurationService ConfigurationService){ // Access Configuration Through IConfigurationService } Then elsewhere you'd set up your DI framework to inject your ConfigFileS…

My example above is terrible, because in reality you'd have another level before this, which sorts out your global configuration, reads it and just injects service specific parameters and configuration for each service.

But I just wanted to illustrate idiomatic .NET DI, and on reflection picking configuration was probably the worst way to illustrate it.

Re: Redbox left PII on decommissioned machines

#67

Post by danielmg »

ChicagoDave wrote: post #52

I worked at RedBox in 2010. C# with embedded Lua for the screens. The intent was to build a flexible architecture for CoinStar to use on many kiosk businesses. The PII is likely log files that should have been erased nightly, but I don’t remember. I know the guy that designed the architecture. He’s a friend that I’ve argued with about over-engineering things. He never cared if people understood his work, which is a c…

It's not just an 'old school' thing. FFS look at the state of the Javascript ecosystem.

Re: Redbox left PII on decommissioned machines

#68

Post by BlueTemplar »

nextlevelwizard wrote: post #43
michaelt wrote: post #39

Earlier quoted context omitted.

If instead of a load of old computers the bankrupt company had a pile of old tyres, I'd expect the receivers winding up the bankrupt company would dispose of the old tyres properly, paid for with the company's assets before anything is distributed to creditors.

If someone creates this fucked up compute stack and handles the customer data this poorly, what makes you think they would be any better at disposal even if there was some laws around it? It is not like law makers have any idea either what is going on.

They are not the company under discussion.

Re: Redbox left PII on decommissioned machines

#69

Post by BlueTemplar »

michaelt wrote: post #40
raffraffraff wrote: post #37

Earlier quoted context omitted.

I know an employee in an IT company. He told me that they have hundreds of decommissioned laptops and no time to wipe them. And they won't pay someone else to do it because it's too expensive. So right now they are in storage. If they go bust, the storage company will likely dump them. I've seen a lot of stuff in e-waste. There are several facilities within 5 miles of my home, and you can walk right in and drop off y…

> I've seen a lot of stuff in e-waste. [...] if you have a quiet word with the attendant you can usually walk off with stuff that someone else dropped off. In my country, there are specialist e-waste disposal companies large IT organisations can hire, which guarantee to remove and shred the hard drives before recycling the rest.

I don't think that the people responsible for dealing with the mess left from bankruptcy are large IT organizations, they probably barely have the money to transport the waste to the nearest trash dump, unsorted, and forget about "recycling" now that poor countries are less willing to take the e-waste.

Companies leaving their waste as someone else's problem to deal with is a common occurrence (heck, even before they go bankrupt), and in many cases they would never have existed in the first place if they had to pay for all of it, for instance :

https://www.desmog.com/2019/12/20/fracking-oil-gas-bankruptc...

(Note also that there are funds set aside for cleanup, but they are typically woefully insufficient.)

How to prevent companies that are a net negative for society from existing remains an unsolved problem.

(Aside of course from disallowing companies altogether, I wonder when is the point that the limited liability company as a concept is a net negative to society ? Could it be in the past already ? Of course comes the question of whether any alternative can have a positive contribution, in a context of overshoot...)

Re: Redbox left PII on decommissioned machines

#70

Post by JoachimS »

ChicagoDave wrote: post #52

I worked at RedBox in 2010. C# with embedded Lua for the screens. The intent was to build a flexible architecture for CoinStar to use on many kiosk businesses. The PII is likely log files that should have been erased nightly, but I don’t remember. I know the guy that designed the architecture. He’s a friend that I’ve argued with about over-engineering things. He never cared if people understood his work, which is a c…

Not an old school engineering. There a fresh engineers rolling of the production line everyday that behaves exactly like this.

I would even venture to say that senior engineers are probably much better at documenting, writing clean code, not over engineer things. My personal experience is that bad engineers move into project management, administration much faster. Which is a problem in itself since they end up being the boss of the engineers that are better than what they are.

Post reply on HN